# Patent

## Title
Cryptographic system and computer readable medium

## Abstract

A cryptographic system (10) performs a cryptographic process using a basis. B and a basis B*. An encryption device (200) generates a ciphertext including a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj of a polynomial having xi as roots and a second vector consisting of v1i being a power of v1. A decryption device (300) decrypts the ciphertext generated by the encryption device (200) with a decryption key including a reception-side vector being a vector in the basis B* and being generated using the other vector of the first vector and the second vector.

## Background
TECHNICAL FIELD
The present invention relates to a functional encryption (FE) scheme.
BACKGROUND ART
Patent Literature 1 describes a functional encryption (FE) scheme.
CITATION LIST
Patent Literature


    Patent Literature 1: JP 2012-133214 A


Non-Patent Literature


    Non-Patent Literature 1: Attrapadung, N., Libert, B., de Panafieu, E.: Expressive key-policy attribute-based encryption with constant-size ciphertexts. In: Catalano et al. [6], pp. 90.108
    Non-Patent Literature 2: Okamoto, T., Takashima, K.: Achieving Short Ciphertexts or Short Secret-Keys for Adaptively Secure General Inner-Product Encryption. CANS 2011, LNCS, vol. 7092, pp. 138-159 Springer Heidelberg (2011).
    Non-Patent Literature 3: Okamoto, T Takashima, K.: Decentralized Attribute-Based Signatures.ePrint http://eprint.iacr.org/2011/701


SUMMARY OF INVENTION
Technical Problem
In the functional encryption scheme described in Patent Literature 1, it is necessary to generate a vector constituting a ciphertext or a vector constituting a decryption key for each attribute category t. The size of a ciphertext is large, so that decryption and so on require processing time.
It is an object of the present invention to reduce the sizes of a ciphertext, a decryption key, a signature, and so on.
Solution to Problem
A cryptographic system according to the present invention performs a cryptographic process using a basis B and a basis B*, and the cryptographic system includes:
a transmission device to generate a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj (j=1, . . . , n) of a polynomial having attribute information xi (i=1, . . . , n′, n′ being an integer from 1 to n−1, n being an integer of 2 or greater) as roots and a second vector consisting of v1′ (i=0, . . . , n−1) being a power of predicate information v1; and
a reception device to perform a pairing operation on the transmission-side vector and a reception-side vector being a vector in the basis B* and being generated using the other vector of the first vector and the second vector.
Advantageous Effects of Invention
A cryptographic system according to the present invention can reduce the sizes of a ciphertext, a decryption key, a signature, and so on by providing special configurations of vectors used to generate a transmission-side vector and a reception-side vector.



BRIEF DESCRIPTION OF DRAWINGS
FIG. 1 is an explanatory drawing of a matrix M^;
FIG. 2 is an explanatory drawing of a matrix Mδ;
FIG. 3 is an explanatory drawing of s0;
FIG. 4 is an explanatory drawing of {right arrow over (s)}T;
FIG. 5 is a configuration diagram of a cryptographic system 10 that implements a KP-ABE scheme according to Embodiment 1;
FIG. 6 is a configuration diagram of a key generation device 100 according to Embodiment 1;
FIG. 7 is a configuration diagram of an encryption device 200 according to Embodiment 1;
FIG. 8 is a configuration diagram of a decryption device 300 according to Embodiment 1;
FIG. 9 is a flowchart illustrating the process of a Setup algorithm according to Embodiment 1;
FIG. 10 is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 1;
FIG. 11 is a flowchart illustrating the process of an Enc algorithm according to Embodiment 1;
FIG. 12 is a flowchart illustrating the process of a Dec algorithm according to Embodiment 1;
FIG. 13 is a configuration diagram of a cryptographic system 10 that implements a CP-ABE scheme according to Embodiment 2;
FIG. 14 is a configuration diagram of a key generation device 100 according to Embodiment 2;
FIG. 15 is a configuration diagram of an encryption device 200 according to Embodiment 2;
FIG. 16 is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 2;
FIG. 17 is a flowchart illustrating the process of an Enc algorithm according to Embodiment 2;
FIG. 18 is a configuration diagram of a cryptographic system 10 that implements an ABS scheme according to Embodiment 4;
FIG. 19 is a configuration diagram of a key generation device 100 according to Embodiment 4;
FIG. 20 is a configuration diagram of a signature device 400 according to Embodiment 4;
FIG. 21 is a configuration diagram of a verification device 500 according to Embodiment 4;
FIG. 22 is a flowchart illustrating the process of a Setup algorithm according to Embodiment 4;
FIG. 23 is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 4;
FIG. 24 is a flowchart illustrating the process of a Sig algorithm according to Embodiment 4;
FIG. 25 is a flowchart illustrating the process of a Ver algorithm according to Embodiment 4; and
FIG. 26 is a diagram illustrating an example of a hardware configuration of each device of the cryptographic system 10 presented in Embodiments 1 to 5.



DESCRIPTION OF EMBODIMENTS
Embodiment 1
Notations to be used in the following description will be described.
When A is a random variable or distribution, Formula 101 denotes that y is randomly selected from A according to the distribution of A. That is, y is a random number in Formula 101.




  
    
      
        y
        ⁢
        
          ⟵
          R
        
        ⁢
        A
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          101
        
        ]
      
    
  




When A is a set, Formula 102 denotes that y is uniformly selected from A. That is, y is a uniform random number in Formula 102.




  
    
      
        y
        ⁢
        
          ⟵
          U
        
        ⁢
        A
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          102
        
        ]
      
    
  




Formula 103 denotes that y is set, defined, or substituted by z.

y:=z  [Formula 103]

When a is a fixed value, Formula 104 denotes that a machine (algorithm) A outputs a on input x.

A(x)→a  [Formula 104]

For example,

A(x)→1

Formula 105, namely Fq, denotes a finite field of order q.

q  [Formula 105]

A vector symbol denotes a vector representation over the finite field Fq, as indicated in Formula 106.

{right arrow over (x)} denotes

(x1, . . . ,xn)εqnqn.  [Formula 106]

Formula 107 denotes that the inner-product, indicated in Formula 109, of two vectors {right arrow over (x)} and {right arrow over (v)} indicated in Formula 108.

{right arrow over (x)}·{right arrow over (v)}  [Formula 107]

{right arrow over (x)}=(x1, . . . ,xn),

v=(v1, . . . ,vn)  [Formula 108]

Σi=1nxivi  [Formula 109]

Note that XT denotes the transpose of a matrix X.
For a basis B and a basis B* indicated in Formula 110, Formula 111 is established.

:=(b1, . . . ,bN),

*:=(b1*, . . . ,bN*)  [Formula 110]

:=Σi=1Nxibi,

:=Σi−1Nyibi*  [Formula 111]

Note that {right arrow over (e)}j denotes a normal basis vector indicated in Formula 112.




  
    
      
        
          
            
              
                
                  e
                  ->
                
                j
              
              ⁢
              
                :
              
              ⁢
              
                
              
              ⁢
              
                (
                
                  
                    
                      0
                      ⁢
                      
                        
                      
                      ⁢
                      ...
                      ⁢
                      
                        
                      
                      ⁢
                      0
                    
                    
                      {
                      
                        j
                        -
                        1
                      
                    
                  
                  ,
                  1
                  ,
                  
                    
                      0
                      ⁢
                      
                        
                      
                      ⁢
                      ...
                      ⁢
                      
                        
                      
                      ⁢
                      0
                    
                    
                      {
                      
                        n
                        -
                        j
                      
                    
                  
                
                )
              
            
            ∈
            
              
                F
                q
                n
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              j
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        n
        ,
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          112
        
        ]
      
    
  




In the following description, when Vt, nt, ut, wt, zt, nu, wu, and zu are each represented as a subscript or superscript, these Vt, nt, ut, wt, zt, nu, wu, and zu respectively denote Vt, ut, nt, wt, zt, nu, wu, and zu. Similarly, when δi,j is represented as a superscript, this δi,j denotes δi,j. Similarly, when φj is represented as a superscript, this φj denotes φj. Similarly, when s0 is represented as a superscript, this s0 denotes s0.
When → denoting a vector is attached to a subscript or superscript, it is meant that this → is attached as a superscript to the subscript or superscript.
In the following description, a cryptographic process and a cryptographic scheme include not only a narrowly-defined cryptographic process for keeping information secure from a third party, but also include a signature process, and include a key generation process, an encryption process, a decryption process, a signature process, and a verification process.
In Embodiment 1, a basic concept for implementing a cryptographic scheme will be described, and then a structure of a cryptographic scheme according to Embodiment 1 will be described.
First, a space having a rich mathematical structure called “dual pairing vector spaces (DPVS)” which is a space for implementing the cryptographic scheme will be described.
Second, a concept for implementing the cryptographic scheme will be described. Here, a span program, an access structure, and a secret distribution scheme (secret sharing scheme) will be described.
Third, a basic structure of the cryptographic scheme according to Embodiment 1 will be described. In Embodiment 1, a key-policy attribute-based encryption (KP-ABE) scheme will be described.
Fourth, a basic configuration of a cryptographic system 10 that implements the cryptographic scheme according to Embodiment 1 will be described.
Fifth, a key technique and a simplified cryptographic scheme of the cryptographic scheme according to Embodiment 1 will be described.
Sixth, the cryptographic scheme according to Embodiment 1 will be described in detail.
<1. Dual Pairing Vector Spaces>
First, symmetric bilinear pairing groups will be described.
Symmetric bilinear pairing groups (g, G, GT, g, e) are a tuple of a prime q, a cyclic additive group G of order q, a cyclic multiplicative group GT of order q, g≠0εG, and a polynomial-time computable nondegenerate bilinear pairing e: G×G→GT. The nondegenerate bilinear pairing signifies e(sg, tg)=e(g, g)st, and e(g, g)≠1.
In the following description, let Gbpg be an algorithm that takes as input 1λ and outputs values of a parameter paramG:=(q, G, GT, g, e) of bilinear pairing groups with a security parameter λ.
Dual pairing vector spaces will now be described.
Dual pairing vector spaces (q, V, GT, A, e) can be constructed by a direct product of the symmetric bilinear pairing groups (paramG:=(q, G, GT, g, e)). The dual pairing vector spaces (q, V, GT, A, e) are a tuple of a prime q, an N-dimensional vector space V over Fq indicated in Formula 113, a cyclic group GT of order q, and a canonical basis A:=(a1, . . . , aN) of the space V, and have the following operations (1) and (2), where ai is as indicated in Formula 114.




  
    
      
        V
        :=
        
          
            G
            ×
            ...
            ×
            G
          
          
            {
            N
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          113
        
        ]
      
    
  
  
    
      
        
          a
          i
        
        :=
        
          (
          
            
              
                0
                ,
                ...
                ⁢
                
                  
                
                ,
                0
              
              
                {
                
                  i
                  -
                  1
                
              
            
            ,
            g
            ,
            
              
                0
                ,
                ...
                ⁢
                
                  
                
                ,
                0
              
              
                {
                
                  N
                  -
                  i
                
              
            
          
          )
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          114
        
        ]
      
    
  




Operation (1): Nondegenerate Bilinear Pairing
A pairing in the space V is defined by Formula 115.

e(x,y):=Πi−1Ne(Gi,Hi)εT  [Formula 115]

where

(G1, . . . ,GN):=xε, 

(H1, . . . ,HN):=yε

This is nondegenerate bilinear, that is, e(sx, ty)=e(x, y)st and if e(x, y)=1 for all yεV, then x=0. For all i and j, e(ai, aj)=e(g, g)δi,j, where δi,j=1 if i=j, and δi,j=0 if i≠j, and e(g, g)≠1εGT.

Operation (2): Distortion Maps
Linear transformations φi,j on the space V indicated in Formula 116 can achieve Formula 117.

If φi,j(aj)=ai and

k≠j, then φi,j(ak)=0.  [Formula 116]





  
    
      
        
          
            
              φ
              
                i
                ,
                j
              
            
            ⁡
            
              (
              x
              )
            
          
          :=
          
            (
            
              
                
                  0
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  0
                
                
                  {
                  
                    i
                    -
                    1
                  
                
              
              ,
              
                g
                j
              
              ,
              
                
                  0
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  0
                
                
                  {
                  
                    N
                    -
                    i
                  
                
              
            
            )
          
        
        ⁢
        
          

        
        ⁢
        
          
            where
            ⁢
            
              

            
            (
            
              
                g
                1
              
              ,
              
                ...
                ⁢
                
                  
                
                ⁢
                
                  g
                  N
                
              
            
            )
          
          :=
          x
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          117
        
        ]
      
    
  




The linear transformations φi,j will be called distortion maps.
In the following description, let Gdpvs be an algorithm that takes as input 1λ (λε natural number), Nεnatural number, and values of a parameter paramG:=(q, G, GT, g, e) of bilinear pairing groups, and outputs values of a parameter paramV:=(q, V, GT, A, e) of dual pairing vector spaces with a security parameter λ and an N-dimensional space V.
Description will be directed herein to a case where the dual pairing vector spaces are constructed using the above-described symmetric bilinear pairing groups. The dual pairing vector spaces can also be constructed using asymmetric bilinear pairing groups. The following description can easily be adapted to a case where the dual pairing vector spaces are constructed using asymmetric bilinear pairing groups.
<2. Concept for Implementing Cryptographic Scheme>
<2-1. Span Program>
FIG. 1 is an explanatory drawing of a matrix M^.
Let {p1, . . . , pn} be a Set of Variables. M^:=(M, ρ) is a Labeled Matrix. The matrix M is an (L rows×r columns) matrix over Fq, and ρ is a label of columns of the matrix M and is related to one of literals {p1, . . . , pn, p1, . . . , pn}. A label ρi (i=1, . . . , L) of each row of M is related to one of the literals. That is, ρ: {1, . . . , L}→{p1, . . . , pn, p1, . . . , Pn}.
For every input sequence δ ε{0, 1}n, a submatrix Mδ of the matrix M is defined. The matrix Mδ is a submatrix consisting of those rows of the matrix M the labels p of which are related to a value “1” by the input sequence δ. That is, the matrix Mδ is a submatrix consisting of the rows of the matrix M which are related to pi such that δi=1 and the rows of the matrix M which are related to pi such that δi=0.
FIG. 2 is an explanatory drawing of the matrix Mδ. In FIG. 2, note that n=7, L=6, and r=5. That is, the set of variables is {p1, . . . , p7}, and the matrix M is a (6 rows×5 columns) matrix. In FIG. 2, assume that the labels p are related such that ρ1 is related to p2, ρ2 to p1, ρ3 to p4, ρ4 to p5, ρ5 to p3, and ρ6 to p5.
Assume that in an input sequence δ ε{0, 1}7, δ1=1, δ2=0, δ3=, δ4=0, δ5=0, δ6=1, and δ7=1. In this case, a submatrix consisting of the rows of the matrix M which are related to literals (p1, p3, p6, p7, p2, p4, p5) surrounded by broken lines is the matrix Mδ. That is, the submatrix consisting of the first row (M1), second row (M2), and fourth row (M4) of the matrix M is the matrix Mδ.
In other words, when map γ: {1, . . . , L}→{0, 1} is [ρ(j)=pi][δi=1] or [ρ(j)=pi][δi=0], then γ(j)=1; otherwise γ(j)=0. In this case, Mδ:=(Mj):=(Mj)γ(j)=1. Note that Mj is the j-th row of the matrix M.
That is, in FIG. 2, map γ(j)=1 (j=1, 2, 4), and map γ(j)=0 (j=3, 5, 6). Hence, (Mj)γ(j)=1 is M1, M2, and M4, and is the matrix Mδ.
More specifically, whether or not the j-th row of the matrix M is included in the matrix Mδ is determined by whether the value of the map γ(j) is “0” or “1”.
The span program M⨣ accepts an input sequence δ if and only if {right arrow over (1)}ε span<Mδ>, and rejects the input sequence δ otherwise. That is, the span program M^ accepts the input sequence δ if and only if linear combination of the rows of the matrix Mδ which are obtained from the matrix M^ by the input sequence δ gives {right arrow over (1)}. {right arrow over (1)} is a row vector which has a value “1” in each element.
For example, in an example of FIG. 2, the span program M^ accepts the input sequence δ if and only if linear combination of the respective rows of the matrix Mδ consisting of the first, second, and fourth rows of the matrix M gives {right arrow over (1)}. That is, if there exist α1, α2, and α4 with which α1(M1)+α2(M2)+α4(M4)={right arrow over (1)}, the span program M^ accepts the input sequence δ.
The span program is called monotone if its labels p are related to only positive literals {p1, . . . , pn}. The span program is called non-monotone if its labels ρ are related to the literals {p1, . . . , pn, p1, . . . , pn}. It is assumed herein that the span program is non-monotone. An access structure (non-monotone access structure) is constructed using the non-monotone span program. Briefly, an access structure controls access to encryption, that is, it controls whether a ciphertext is to be decrypted or not.
The span program being non-monotone, instead of being monotone, allows for a wider range of applications of the cryptographic scheme constructed using the span program.
<2-2. Access Structure>
U (⊂{0, 1}*) is a universe and a set of attributes, and U is represented by values of attributes, that is, v εFXq (:=Fq\{0}).
It is defined such that the attributes are a variable p in M^:=(M, ρ). That is, p:=v. The access structure S is a span program M^:=(M, ρ) with variables p:=v and p′:=v′, . . . . That is, the access structure S is S:=(M, ρ) with p: {1, . . . , L}→{v, v′, . . . , v, v′, . . . }.
Let Γ be a set of attributes. That is, Γ:={xj|1≦j≦n′}.
When Γ is given to the access structure S, map γ: {1, . . . , L}→{0, 1} for the span program M^:=(M, ρ) is defined as follows. For each integer i=1, . . . , L, set γ(j)=1 if [ρ(i)=vi)][vi εΓ] or [ρ(i)=vi][vi εΓ]. Set γ(j)=0 otherwise.
The access structure S:=(M, ρ) accepts Γ if and only if {right arrow over (1)}ε span <(Mi)γ(i)=1>.
<2-3. Secret Distribution Scheme>
A secret distribution scheme for the access structure S:=(M, ρ) will be described.
The secret distribution scheme is distributing secret information to render it nonsense distributed information. For example, secret information s is distributed into 10 pieces to generate 10 pieces of distributed information. Each of the 10 pieces of distributed information does not have information on the secret information s. Hence, even when one of the pieces of distributed information is obtained, no information can be obtained on the secret information s. On the other hand, if all of the 10 pieces of distributed information are obtained, the secret information s can be recovered.
There is another secret distribution scheme according to which the secret information s can be recovered if some (for example, 8 pieces) of distributed information can be obtained, without obtaining all of the 10 pieces of distributed information. A case like this where the secret information s can be recovered using 8 pieces out of 10 pieces of distributed information will be called 8-out-of-10. That is, a case where the secret information s can be recovered using t pieces out of n pieces of distributed information will be called t-out-of-n. This t will be called a threshold value.
There is still another secret distribution scheme according to which when 10 pieces of distributed information d1, . . . , d10 are generated, the secret information s can be recovered with 8 pieces of distributed information d1, . . . , d8, but the secret information s cannot be recovered with 8 pieces of distributed information d3, . . . , d10. In other words, secret distribution schemes include a scheme according to which whether or not the secret information s can be recovered is controlled not only by the number of pieces of distributed information obtained, but also the combination of distributed information obtained.
FIG. 3 is an explanatory drawing of s0. FIG. 4 is an explanatory drawing of {right arrow over (s)}T.
Let a matrix M be an (L rows×r columns) matrix. Let {right arrow over (f)}T be a column vector indicated in Formula 118.




  
    
      
        
          
            f
            ->
          
          T
        
        :=
        
          
            
              (
              
                
                  f
                  1
                
                ,
                
                  ...
                  ⁢
                  
                    
                  
                  ⁢
                  
                    f
                    r
                  
                
              
              )
            
            T
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
            r
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          118
        
        ]
      
    
  




Let s0 indicated in Formula 119 be secret information to be shared.

s0:={right arrow over (1)}·{right arrow over (f)}T:=Σk=1rfk  [Formula 119]

Let {right arrow over (s)}T indicated in Formula 120 be a vector of L pieces of distributed information of s0.

{right arrow over (s)}T:=(s1, . . . sL)T:=M·{right arrow over (f)}T  [Formula 120]

Let the distributed information si belong to ρ(i).
If the access structure S:=(M, ρ) accepts Γ, that is, if {right arrow over (1)}ε span<(Mi)γ(i)=1> for γ:{1, . . . , L}→{0, 1}, then there exist constants {αi εFq|i εI} such that I⊂{i ε{1, . . . , L}|γ(i)−=1}.
This is obvious from the explanation about the example of FIG. 2 that if there exist α1, α2, and α4 with which α1(M1)+α2(M2)+α4(M4)={right arrow over (1)}, the span program M{right arrow over ( )} accepts the input sequence δ. That is, if the span program M^ accepts the input sequence δ when there exist α1, α2, and α4 with which α1(M1)+α2(M2)+α4(M4)={right arrow over (1)}, then there exist α1, α2, and α4 with which α1(M1)+α2(M2)+α4(M4)={right arrow over (1)}.
Note Formula 121.

ΣiεIαisi:=s0  [Formula 121]

Note that constants {αi} are computable in time polynomial in the size of the matrix M.
<3. Basic Structure of Cryptographic Scheme (KP-ABE Scheme)>
The structure of the KP-ABE scheme will be briefly described. Note that KP (key policy) means that a policy, namely an access structure, is embedded in a key.
The KP-ABE scheme includes four algorithms: Setup, KeyGen, Enc, and Dec.
(Setup)
A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ and an upper limit n for the number of attributes for a ciphertext, and outputs a public parameter pk and a master key sk.
(KeyGen)
A KeyGen algorithm is a probabilistic algorithm that takes as input the public parameter pk, the master key sk, and an access structure S:=(M, ρ), and outputs a decryption key skS.
(Enc)
An Enc algorithm is a probabilistic algorithm that takes as input the public parameter pk, a message m, and an attribute set Γ:={xj}1≦j≦n′, and outputs a ciphertext ctΓ.
(Dec)
A Dec algorithm is an algorithm that takes as input the public parameter pk, the decryption key skS, and the ciphertext ctΓ, and outputs the message m or a distinguished symbol ⊥.
<4. Basic Configuration of Cryptographic System 10>
The cryptographic system 10 that implements the algorithms of the KP-ABE scheme will be described.
FIG. 5 is a configuration diagram of the cryptographic system 10 that implements the KP-ABE scheme according to Embodiment 1.
The cryptographic system 10 includes a key generation device 100, an encryption device 200 (an example of a transmission device), and a decryption device 300 (an example of a reception device).
The key generation device 100 executes the Setup algorithm taking as input a security parameter λ and an upper limit n for the number of attributes for a ciphertext, and thereby generates a public parameter pk and a master key sk.
Then, the key generation device 100 publishes the public parameter pk. The key generation device 100 also executes the KG algorithm taking as input an access structure S, and thereby generates a decryption key skS, and transmits the decryption key skS to the decryption device 300 in secrecy.
The encryption device 200 executes the Enc algorithm taking as input the public parameter pk, a message m, and an attribute set Γ, and thereby generates a ciphertext ctΓ. The encryption device 200 transmits the ciphertext ctΓ to the decryption device 300.
The decryption device 300 executes the Dec algorithm taking as input the public parameter pk, the decryption key skS, and the ciphertext ctΓ, and outputs the message m or a distinguished symbol ⊥.
<5. Key Technique and Simplified Cryptographic Scheme>
<5-1. Encoding>
In the functional encryption scheme described in Patent Literature 1, an identifier t is assigned to each attribute category, and a vector which is an element of a ciphertext (or a decryption key) is generated for each identifier t.
In Embodiment 1, a method for encoding attribute information is specially devised such that the identifier t for an attribute category is eliminated and one vector is used as an element of a ciphertext.
In Embodiment 1, a vector (one vector) which is an element of a ciphertext is generated such that each element of a vector {right arrow over (y)}:=(y1, . . . , yn) (first vector) consisting of coefficients yj of a polynomial having attribute information xi as roots is set as the coefficient of each basis vector of a basis B. That is, a vector which is an element of a ciphertext is generated such that the vector {right arrow over (y)}:=(y1, . . . , yn) being f(z)=(z-x1)(z-x2) . . . (z-xn)=y1zn+ . . . +yn-1z+yn is set as the coefficient of each basis vector of the basis B.
A vector (one or more vectors) which is an element of a decryption key is generated such that a vector {right arrow over (v)}i:=(vin-1, . . . , vi, 1) (second vector) consisting of vij being a power of vi is set as the coefficient of each basis vector of a basis B*, for each integer i=1, . . . , L.
With this arrangement, it is possible to control such that when a pairing operation is performed on the vector which is the element of the ciphertext and the vector which is the element of the decryption key, vi is assigned to f(z), and if vi is equal to any of x1, . . . , xn, then f(vi)=0, and if vi is not equal to any of x1, . . . , xn, then f(vi)≠0.
<5-2. Sparse Matrix>
In the functional encryption scheme described in Patent Literature 1, a basis B and a basis B* being a pair of dual bases are generated. The basis B and the basis B* are generated using a fully random linear transformation X (change-of-basis matrix) uniformly selected from GL(N, Fq). In particular, the basis B and the basis B* are generated by transforming a canonical basis A by linear transformations X and (X−1)T, respectively. Note that N denotes the number of dimensions of span<B> and span<B>.
In a typical application in which dual pairing vector spaces are applied to a cryptographic process, a part of the basis B (to be referred to as B^) is used as a public parameter, and the corresponding part of the basis B* (to be referred to as B^*) is used as a trapdoor.
In Embodiment 1, a special form of the random linear transformation X being XεGL(N, Fq) (a sparse matrix) is employed, in place of the fully random linear transformation X described above.
<5-3. Simplified Cryptographic Scheme>
A simplified KP-ABE scheme will be described.
A ciphertext in the simplified KP-ABE scheme consists of two vector elements (c0, c1)εG5×Gn as well as c3≢GT. A secret key consists of the L+1 number of vector elements (k*0, k*1, . . . , k*LεG5×(Gn)L) for an access structure S:=(M, ρ), where L denotes the number of rows in a matrix M and each vector element k*i corresponds to each row of the matrix M. Note that (c0, c1)εG5×Gn signifies that c0 is five elements of G, and c1 is the n number of elements of G. Similarly, (k*0, k*1, . . . , k*LεG5×(Gn)L) signifies that k*0 is five elements of G, and k*1, . . . , k*L are the n number of elements of G.
Therefore, to achieve constant-size ciphertexts, it is necessary to compress c1εGn to a constant size in n.
In Embodiment 1, a special linear transformation X indicated in Formula 122 is employed.




  
    
      
        X
        :=
        
          
            (
            
              
                
                  μ
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    μ
                    1
                    ′
                  
                
              
              
                
                  
                    
                  
                
                
                  ⋱
                
                
                  
                    
                  
                
                
                  ⋮
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  μ
                
                
                  
                    μ
                    
                      n
                      -
                      1
                    
                    ′
                  
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    μ
                    n
                    ′
                  
                
              
            
            )
          
          ∈
          
            H
            ⁡
            
              (
              
                n
                ,
                
                  F
                  q
                
              
              )
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          122
        
        ]
      
    
  




Note that μ, μ′1, . . . , μ′n are values uniformly selected from a finite field Fq, and a blank in the linear transformation X denotes 0εFq. Note also that H(n, Fq) signifies a set of n-dimensional matrices having the finite field Fq as elements.
A public key (basis in DPVS) is a basis B indicated in Formula 123-1.




  
    
      
        B
        :=
        
          
            (
            
              
                
                  
                    b
                    1
                  
                
              
              
                
                  ⋮
                
              
              
                
                  
                    
                  
                
              
              
                
                  
                    b
                    n
                  
                
              
            
            )
          
          :=
          
            (
            
              
                
                  
                    μ
                    ⁢
                    
                      
                    
                    ⁢
                    g
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                      μ
                      1
                      ′
                    
                    ⁢
                    g
                  
                
              
              
                
                  
                    
                  
                
                
                  ⋱
                
                
                  
                    
                  
                
                
                  ⋮
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    μ
                    ⁢
                    
                      
                    
                    ⁢
                    g
                  
                
                
                  
                    
                      μ
                      
                        n
                        -
                        1
                      
                      ′
                    
                    ⁢
                    g
                  
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                      μ
                      n
                      ′
                    
                    ⁢
                    g
                  
                
              
            
            )
          
        
      
    
    
      
        [
        
          
            Formula
            ⁢
            
              
            
            ⁢
            123
          
          -
          1
        
        ]
      
    
  




Let a ciphertext associated with an attribute set Γ:=(x1, . . . , xn′) be a ciphertext c1 indicated in Formula 123-2.

c1:=(ω{right arrow over (y)}=ω(y1b1+ . . . +ynbn)=(y1ωμg, . . . ,yn-1ωμg,ω(Σi=1nyiμi′)g)  [Formula 123]

Note that ω is a value uniformly selected from the finite field Fq, and {right arrow over (y)}:=(y1, yn) is a vector indicated in Formula 124.

Σj=0n-1yn-jzj=zn-1-n′·Πj=1n′(z−xj)  [Formula 124]

Then, the ciphertext c1 can be compressed to two group elements C1 and C2 indicated in Formula 125 and the vector {right arrow over (y)}.

C1:=ωμg, 

C2:=ω(Σi=1nyiμi′)g[Formula 103]

This is because the ciphertext c1 is obtained by (y1C1, . . . , yn-1C1, C2). Note that yiC1=yiωμg for each i=1, . . . , n−1.
Therefore, the ciphertext (excluding the vector {right arrow over (y)}) can be two group elements, and the size is constant in n.
Let B*:=(b*i) be the dual orthonormal basis of B:=(bi), and let the basis B* be a master secret key in the simplified KP-ABE scheme.
(c0, k*0, c3) is specified such that e(c0, k*0)=gTζ-ωs0 and c3:=gTζmεGT. Note that s0(s0) is a center secret of shared information {si}i=1, . . . , L associated with the access structure S.
Using the shared information {si}i=1, . . . , L, a set of secret keys for the access structure S is set as indicated in Formula 126.




  
    
      
        
          
            
              k
              i
              *
            
            :=
            
              
                
                  
                    (
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            e
                            →
                          
                          1
                        
                      
                      +
                      
                        
                          θ
                          i
                        
                        ⁢
                        
                          
                            v
                            →
                          
                          i
                        
                      
                    
                    )
                  
                  
                    B
                    *
                  
                
                ⁢
                
                  
                
                ⁢
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                (
                
                  t
                  ,
                  
                    
                      v
                      →
                    
                    i
                  
                
                )
              
            
          
          ,
          
            

          
          ⁢
          
            
              k
              i
              *
            
            :=
            
              
                
                  
                    (
                    
                      
                        s
                        i
                      
                      ⁢
                      
                        
                          v
                          →
                        
                        i
                      
                    
                    )
                  
                  
                    B
                    *
                  
                
                ⁢
                
                  
                
                ⁢
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                ⫬
                
                  (
                  
                    t
                    ,
                    
                      
                        v
                        →
                      
                      i
                    
                  
                  )
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            
              
                v
                →
              
              i
            
            :=
            
              (
              
                
                  v
                  i
                  
                    n
                    -
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  v
                  i
                
                ,
                1
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              θ
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          126
        
        ]
      
    
  




From the dual orthonormality of the basis B and the basis B*, if the access structure S accepts the attribute set Γ, there exists a complementary coefficients {αi}iεI such that Formula 127 is satisfied.




  
    
      
        
          
            e
            ⁡
            
              (
              
                
                  c
                  1
                
                ,
                
                  
                    k
                    ~
                  
                  *
                
              
              )
            
          
          =
          
            g
            T
            
              ω
              ⁢
              
                
              
              ⁢
              
                s
                0
              
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            
              k
              ~
            
            *
          
          :=
          
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    v
                    i
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  k
                  i
                  *
                
              
            
            +
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    ⫬
                    
                      v
                      i
                    
                  
                
              
              ⁢
              
                
                  
                    
                      α
                      i
                    
                    ⁡
                    
                      (
                      
                        
                          y
                          →
                        
                        ·
                        
                          
                            v
                            →
                          
                          i
                        
                      
                      )
                    
                  
                  
                    -
                    1
                  
                
                ⁢
                
                  k
                  i
                  *
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          127
        
        ]
      
    
  




Hence, a decryptor can compute gTωs0 and obtain a message m if and only if the access structure S accepts the attribute set Γ.
The ciphertext c1 is represented as (y1C1, . . . , yn-1C1, C2)εGn, and a secret key k ̃* is parsed as n-tuple (D*1, . . . , D*n). Thus, the value of e(c1, k ̃*) is as indicated in Formula 128.




  
    
      
        
          
            ∏
            
              i
              =
              1
            
            
              n
              -
              1
            
          
          ⁢
          
            
              
                e
                ⁡
                
                  (
                  
                    
                      
                        y
                        i
                      
                      ⁢
                      
                        C
                        1
                      
                    
                    ,
                    
                      D
                      i
                      *
                    
                  
                  )
                
              
              ·
              e
            
            ⁢
            
              (
              
                
                  C
                  2
                
                ,
                
                  D
                  n
                  *
                
              
              )
            
          
        
        =
        
          
            
              ∏
              
                i
                =
                1
              
              
                n
                -
                1
              
            
            ⁢
            
              
                e
                ⁡
                
                  (
                  
                    
                      C
                      1
                    
                    ,
                    
                      
                        y
                        i
                      
                      ⁢
                      
                        D
                        i
                        *
                      
                    
                  
                  )
                
              
              ·
              
                e
                ⁡
                
                  (
                  
                    
                      C
                      2
                    
                    ,
                    
                      D
                      n
                      *
                    
                  
                  )
                
              
            
          
          =
          
            
              e
              ⁡
              
                (
                
                  
                    C
                    1
                  
                  ,
                  
                    
                      ∑
                      
                        i
                        =
                        1
                      
                      
                        n
                        -
                        1
                      
                    
                    ⁢
                    
                      
                        y
                        i
                      
                      ⁢
                      
                        D
                        i
                        *
                      
                    
                  
                
                )
              
            
            ·
            
              e
              ⁡
              
                (
                
                  
                    C
                    2
                  
                  ,
                  
                    D
                    n
                    *
                  
                
                )
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          128
        
        ]
      
    
  




That is, the n−1 number of scalar multiplications in G and two pairing operations are enough for computing e(c1, k ̃*). This means that only a small (constant) number of pairing operations are required for decryption. Generally, a pairing operation is an operation which requires processing time. Therefore, by reducing the number of pairing operations, the processing time for the entirety of processing can be shortened.
In the simplified KP-ABE scheme, the ciphertext c1 has only the basis vector in which the vector {right arrow over (y)} is set (real encoding part), and the secret key k*1 has only the basis vector in which the vector {right arrow over (v)} is set (real encoding part).
In the KP-ABE scheme to be described below, in order to enhance security, a hidden part, a secret key randomness part, and a ciphertext randomness part are added to the ciphertext c1 and the secret key k*1 in addition to the real encoding part.
Therefore, the linear transformation X is expanded six-fold, as indicated in Formula 129. Then, the real encoding part, the hidden part, the secret key randomness part, and the ciphertext randomness part are assigned n, 2n, 2, and n dimensions, respectively.




  
    
      
        X
        :=
        
          (
          
            
              
                
                  X
                  
                    1
                    ,
                    1
                  
                
              
              
                ...
              
              
                
                  X
                  
                    1
                    ,
                    6
                  
                
              
            
            
              
                ⋮
              
              
                
                  
                
              
              
                ⋮
              
            
            
              
                
                  X
                  
                    6
                    ,
                    1
                  
                
              
              
                ...
              
              
                
                  X
                  
                    6
                    ,
                    6
                  
                
              
            
          
          )
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          129
        
        ]
      
    
  




Note that each Xi,j is XεH(n, Fq) indicated in Formula 122. The vector space consists of four orthogonal subspaces. That is, the vector space consists of four orthogonal subspaces for the encoding part, the hidden part, the secret key randomness part, and the ciphertext randomness part.
<6. Cryptographic Scheme>
FIG. 6 is a configuration diagram of the key generation device 100 according to Embodiment 1. FIG. 7 is a configuration diagram of the encryption device 200 according to Embodiment 1. FIG. 8 is a configuration diagram of the decryption device 300 according to Embodiment 1.
FIG. 9 and FIG. 10 are flowcharts illustrating the operation of the key generation device 100 according to Embodiment 1. FIG. 9 is a flowchart illustrating the process of the Setup algorithm according to Embodiment 1, and FIG. 10 is a flowchart illustrating the process of the KeyGen algorithm according to Embodiment 1. FIG. 11 is a flowchart illustrating the operation of the encryption device 200 according to Embodiment 1 and illustrating the process of the Enc algorithm according to Embodiment 1. FIG. 12 is a flowchart illustrating the operation of the decryption device 300 according to Embodiment 1 and illustrating the process of the Dec algorithm according to Embodiment 1.
The function and operation of the key generation device 100 will be described.
As illustrated in FIG. 6, the key generation device 100 includes a master key generation part 110, a master key storage part 120, an information input part 130, a decryption key generation part 140, and a key transmission part 150. The master key generation part 110 includes a space generation part 111, a matrix generation part 112, a basis generation part 113, and a key generation part 114. The decryption key generation part 140 includes an f vector generation part 141, an s vector generation part 142, a random number generation part 143, and a key element generation part 144.
With reference to FIG. 9, the process of the Setup algorithm will be described.
(S101: Space Generation Step)
With a processing device, the space generation part 111 executes Gbpg taking as input a security parameter 1λ, and thereby generates a parameter paramG:=(q, G, GT, g, e) of symmetric bilinear pairing groups.
Further, the space generation part 111 sets N0:=5 and N1:=6n. Then, with the processing device and for each integer t=0, 1, the space generation part 111 executes Gdpvs taking as input the security parameter 1λ, Nt, and the parameter paramG of the symmetric bilinear pairing groups, and thereby generates a parameter paramVt:=(q, Vt, GT, A, e) of dual pairing vector spaces.
(S102: Linear Transformation Generation Step)
With the processing device, the matrix generation part 112 generates a linear transformation X0, as indicated in Formula 130.




  
    
      
        
          X
          0
        
        :=
        
          
            
              (
              
                χ
                
                  0
                  ,
                  i
                  ,
                  j
                
              
              )
            
            
              i
              ,
              
                j
                =
                1
              
              ,
              ...
              ⁢
              
                
              
              ,
              5
            
          
          ⁢
          
            ←
            U
          
          ⁢
          
            GL
            ⁡
            
              (
              
                
                  N
                  0
                
                ,
                
                  F
                  q
                
              
              )
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          130
        
        ]
      
    
  




Note that (χ0,i,j)i,j=1, . . . , 5 in Formula 130 signifies a matrix concerning the suffixes i and j of the matrix χ0,i,j.
With the processing device, the matrix generation part 112 also generates a linear transformation X1, as indicated in Formula 131.




  
    
      
        
          X
          1
        
        ⁢
        
          ←
          U
        
        ⁢
        
          L
          ⁡
          
            (
            
              6
              ,
              n
              ,
              
                F
                q
              
            
            )
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          131
        
        ]
      
    
  




Note that L(6, n, Fq) in Formula 131 is as indicated in Formula 132.




  
    
      
        
          L
          ⁡
          
            (
            
              w
              ,
              n
              ,
              
                F
                q
              
            
            )
          
        
        :=
        
          {
          
            
              X
              :=
              
                
                  
                    (
                    
                      
                        
                          
                            X
                            
                              1
                              ,
                              1
                            
                          
                        
                        
                          ...
                        
                        
                          
                            X
                            
                              1
                              ,
                              w
                            
                          
                        
                      
                      
                        
                          ⋮
                        
                        
                          
                            
                          
                        
                        
                          ⋮
                        
                      
                      
                        
                          
                            X
                            
                              w
                              ,
                              1
                            
                          
                        
                        
                          ...
                        
                        
                          
                            X
                            
                              w
                              ,
                              w
                            
                          
                        
                      
                    
                    )
                  
                  ❘
                  
                    X
                    
                      i
                      ,
                      j
                    
                  
                
                :=
                
                  
                     
                    
                      
                        (
                        
                          
                            
                              
                                μ
                                
                                  i
                                  ,
                                  j
                                
                              
                            
                            
                              
                                
                              
                            
                            
                              
                                
                              
                            
                            
                              
                                μ
                                
                                  i
                                  ,
                                  j
                                  ,
                                  1
                                
                                ′
                              
                            
                          
                          
                            
                              
                                
                              
                            
                            
                              ⋱
                            
                            
                              
                                
                              
                            
                            
                              ⋮
                            
                          
                          
                            
                              
                                
                              
                            
                            
                              
                                
                              
                            
                            
                              
                                μ
                                
                                  i
                                  ,
                                  j
                                
                              
                            
                            
                              
                                μ
                                
                                  i
                                  ,
                                  j
                                  ,
                                  
                                    n
                                    -
                                    1
                                  
                                
                                ′
                              
                            
                          
                          
                            
                              
                                
                              
                            
                            
                              
                                
                              
                            
                            
                              
                                
                              
                            
                            
                              
                                μ
                                
                                  i
                                  ,
                                  j
                                  ,
                                  n
                                
                                ′
                              
                            
                          
                        
                        )
                      
                      ⁢
                      
                        
                          
                            
                              ∈
                              
                                H
                                ⁡
                                
                                  (
                                  
                                    ,
                                    
                                      F
                                      q
                                    
                                  
                                  )
                                
                              
                            
                          
                        
                        
                          
                            
                              
                                for
                                ⁢
                                
                                  
                                
                                ⁢
                                i
                              
                              ,
                              
                                j
                                =
                              
                            
                          
                        
                        
                          
                            
                              1
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              w
                            
                          
                        
                      
                    
                    }
                  
                  ⋂
                  
                    GL
                    ⁡
                    
                      (
                      
                        wn
                        ,
                        
                          F
                          q
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
                H
                ⁡
                
                  (
                  
                    n
                    ,
                    
                      F
                      q
                    
                  
                  )
                
              
              :=
              
                {
                
                  
                    (
                    
                      
                        
                          u
                        
                        
                          
                            
                          
                        
                        
                          
                            
                          
                        
                        
                          
                            u
                            1
                            ′
                          
                        
                      
                      
                        
                          
                            
                          
                        
                        
                          ⋱
                        
                        
                          
                            
                          
                        
                        
                          ⋮
                        
                      
                      
                        
                          
                            
                          
                        
                        
                          
                            
                          
                        
                        
                          u
                        
                        
                          
                            
                              
                            
                            ⁢
                            
                              u
                              
                                n
                                -
                                1
                              
                              ′
                            
                          
                        
                      
                      
                        
                          
                            
                          
                        
                        
                          
                            
                          
                        
                        
                          
                            
                          
                        
                        
                          
                            u
                            n
                            ′
                          
                        
                      
                    
                    )
                  
                  ❘
                  
                    
                      
                        
                          u
                          ,
                          
                            
                              u
                              L
                              ′
                            
                            ∈
                            
                              F
                              q
                            
                          
                          ,
                          
                            
                              for
                              ⁢
                              
                                
                              
                              ⁢
                              L
                            
                            =
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          n
                          ,
                        
                      
                    
                    
                      
                        
                          a
                          ⁢
                          
                            
                          
                          ⁢
                          blank
                          ⁢
                          
                            
                          
                          ⁢
                          element
                          ⁢
                          
                            
                          
                          ⁢
                          in
                          ⁢
                          
                            
                          
                          ⁢
                          the
                          ⁢
                          
                            
                          
                          ⁢
                          matrix
                        
                      
                    
                    
                      
                        
                          
                            denotes
                            ⁢
                            
                              
                            
                            ⁢
                            0
                          
                          ∈
                          
                            F
                            q
                          
                        
                      
                    
                  
                
                }
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          132
        
        ]
      
    
  




In the following, {μi,j, μi,j,L}i,j=1, . . . , 6; L=1, . . . , n denotes non-zero elements in the linear transformation X1.
(S103: Basis B Generation Step)
With the processing device, the basis generation part 113 generates a basis B0, a variable Bi,j, and a variable B′i,j,L, as indicated in Formula 133.

b0,i:=(χ0,i,1, . . . ,χ0,i,5=Σj=15χ0,i,jaj for i=1, . . . ,5,

0:=(b0,1, . . . ,b0,5),

Bi,j:=μi,jg,Bi,j,L′:=μi,j,L′g for i,j=1, . . . ,6; L=1, . . . ,n  [Formula 133]

With the processing device, the basis generation part 113 also generates a basis B*0 and a basis B*1, as indicated in Formula 134.
for t=0, 1,

(θt,i,j)i,j=1, . . . ,Nt:=ψ·(XtT)−1,

b*t,i:=(θt,i,1, . . . ,θt,i,Nt=Σj=1Ntθt,i,jaj for i=1, . . . ,Nt,

*t:=(b*t,1, . . . ,bt,Nt*)  [Formula 134]

(S104: Basis B^ Generation Step)
With the processing device, the key generation part 114 generates a basis B{right arrow over ( )}0, a basis B^1, a basis B^*0, and a basis B^*1, as indicated in Formula 135.

B0:=(b0,1,b0,3,b0,5),

:=(b1,1, . . . ,b1,n,b1,5n+1, . . . ,b1,6n)={Bi,j,Bi,j,L′}i=1,6;j=1, . . . ,6;L=1, . . . ,n,

0*:=(b0,1*,b0,3*b0,4),

1*:=(b1,1* . . . ,b1,n*,b1,3n+1*, . . . ,b1,5n*)  [Formula 135]

(S105: Master Key Generation Step)
With the processing device, the key generation part 114 generates a public parameter pk:=(1λ, paramn, {B^t}t=0, 1) and a master secret key sk:={B^*t}t=0, 1. Then, the key generation part 114 stores the public parameter pk and the master secret key sk in the master key storage part 120.
Note that paramn:=({paramVt}t=0, 1, gT:=e(g, g)φ).
In brief, in (S101) through (S105), the key generation device 100 generates the public parameter pk and the master secret key sk by executing the Setup algorithm indicated in Formula 137, the Setup algorithm using an algorithm GABE(1)ob indicated in Formula 136.




  
    
      
        
          
        
        ⁢
        
          
            
              
                
                  
                    G
                    ob
                    
                      ABE
                      ⁡
                      
                        (
                        1
                        )
                      
                    
                  
                  ⁡
                  
                    (
                    
                      
                        1
                        λ
                      
                      ,
                      6
                      ,
                      n
                    
                    )
                  
                
                ⁢
                
                  :
                
              
              ⁢
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  
                    param
                    G
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        G
                        ,
                        
                          G
                          T
                        
                        ,
                        g
                        ,
                        e
                      
                      )
                    
                    ⁢
                    
                      ←
                      R
                    
                    ⁢
                    
                      
                        G
                        bpg
                      
                      ⁡
                      
                        (
                        
                          1
                          λ
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    N
                    0
                  
                  :=
                  5
                
                ,
                
                  
                    N
                    1
                  
                  :=
                  
                    6
                    ⁢
                    n
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    param
                    
                      V
                      t
                    
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        
                          V
                          t
                        
                        ,
                        
                          G
                          T
                        
                        ,
                        A
                        ,
                        e
                      
                      )
                    
                    :=
                    
                      
                        
                          
                            G
                            dpvs
                          
                          ⁡
                          
                            (
                            
                              
                                1
                                λ
                              
                              ,
                              
                                N
                                t
                              
                              ,
                              
                                param
                                G
                              
                            
                            )
                          
                        
                        ⁢
                        
                          
                        
                        ⁢
                        for
                        ⁢
                        
                          
                        
                        ⁢
                        t
                      
                      =
                      0
                    
                  
                
                ,
                1
                ,
                
                  

                
                ⁢
                
                  ψ
                  ⁢
                  
                    ←
                    U
                  
                  ⁢
                  
                    F
                    q
                    ×
                  
                
                ,
                
                  
                    g
                    T
                  
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          g
                          ,
                          g
                        
                        )
                      
                    
                    ψ
                  
                
                ,
                
                  
                    param
                    n
                  
                  :=
                  
                    (
                    
                      
                        
                          {
                          
                            param
                            
                              V
                              T
                            
                          
                          }
                        
                        
                          
                            t
                            =
                            0
                          
                          ,
                          1
                        
                      
                      ,
                      
                        g
                        T
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    X
                    0
                  
                  :=
                  
                    
                      
                        (
                        
                          χ
                          
                            0
                            ,
                            i
                            ,
                            j
                          
                        
                        )
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        5
                      
                    
                    ⁢
                    
                      ←
                      U
                    
                    ⁢
                    
                      GL
                      ⁡
                      
                        (
                        
                          
                            N
                            0
                          
                          ,
                          
                            F
                            q
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  
                    X
                    1
                  
                  ⁢
                  
                    ←
                    U
                  
                  ⁢
                  
                    L
                    ⁡
                    
                      (
                      
                        6
                        ,
                        n
                        ,
                        
                          F
                          q
                        
                      
                      )
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                hereafter
              
              ⁢
              
                

              
              ⁢
              
                
                  
                    
                      {
                      
                        
                          μ
                          
                            i
                            ,
                            j
                          
                        
                        ,
                        
                          μ
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          ′
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      n
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  denotes
                  ⁢
                  
                    
                  
                  ⁢
                  non
                  ⁢
                  
                    -
                  
                  ⁢
                  zero
                  ⁢
                  
                    
                  
                  ⁢
                  entries
                  ⁢
                  
                    
                  
                  ⁢
                  of
                  ⁢
                  
                    
                  
                  ⁢
                  
                    X
                    1
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    b
                    
                      0
                      ,
                      i
                    
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            χ
                            
                              0
                              ,
                              i
                              ,
                              1
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                            
                          
                          ⁢
                          
                            χ
                            
                              0
                              ,
                              i
                              ,
                              5
                            
                          
                        
                        )
                      
                      A
                    
                    =
                    
                      
                        ∑
                        
                          j
                          =
                          1
                        
                        5
                      
                      ⁢
                      
                        
                          χ
                          
                            0
                            ,
                            i
                            ,
                            j
                          
                        
                        ⁢
                        
                          a
                          j
                        
                      
                    
                  
                
              
              ⁢
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  for
                  ⁢
                  
                    
                  
                  ⁢
                  i
                
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            5
            ,
            
              
                B
                0
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      5
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                B
                
                  i
                  .
                  j
                
              
              :=
              
                
                  μ
                  
                    i
                    ,
                    j
                  
                
                ⁢
                g
              
            
            ,
            
              
                B
                
                  i
                  ,
                  j
                  ,
                  L
                
                ′
              
              :=
              
                
                  μ
                  
                    i
                    ,
                    j
                    ,
                    L
                  
                  ′
                
                ⁢
                g
              
            
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            ,
            
              j
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                L
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            n
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                for
                ⁢
                
                  
                
                ⁢
                t
              
              =
              0
            
            ,
            
              
                1
                ⁢
                
                  
                
                ⁢
                
                  
                    (
                    
                      θ
                      
                        t
                        ,
                        i
                        ,
                        j
                      
                    
                    )
                  
                  
                    i
                    ,
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      N
                      t
                    
                  
                
              
              :=
              
                ψ
                ·
                
                  
                    (
                    
                      X
                      t
                      T
                    
                    )
                  
                  
                    -
                    1
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                b
                
                  t
                  ,
                  i
                
                *
              
              :=
              
                
                  
                    (
                    
                      
                        θ
                        
                          t
                          ,
                          i
                          ,
                          1
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                        
                      
                      ⁢
                      
                        θ
                        
                          t
                          ,
                          i
                          ,
                          
                            N
                            t
                          
                        
                      
                    
                    )
                  
                  A
                
                =
                
                  
                    ∑
                    
                      j
                      =
                      1
                    
                    
                      N
                      t
                    
                  
                  ⁢
                  
                    
                      θ
                      
                        t
                        ,
                        i
                        ,
                        j
                      
                    
                    ⁢
                    
                      a
                      j
                    
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                i
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              N
              t
            
            ,
            
              
                B
                t
                *
              
              :=
              
                (
                
                  
                    b
                    
                      t
                      ,
                      1
                    
                    *
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      t
                      ,
                      
                        N
                        t
                      
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              
                
                  (
                  
                    
                      param
                      n
                    
                    ,
                    
                      B
                      0
                    
                    ,
                    
                      B
                      0
                      *
                    
                    ,
                    
                      
                        {
                        
                          
                            B
                            
                              i
                              ,
                              j
                            
                          
                          ,
                          
                            B
                            
                              i
                              ,
                              j
                              ,
                              L
                            
                            ′
                          
                        
                        }
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          6
                          ;
                          
                            L
                            =
                            1
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        n
                      
                    
                    ,
                    
                      B
                      1
                      *
                    
                  
                  )
                
                .
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          136
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            Setup
            ⁢
            
              (
              
                
                  1
                  λ
                
                ,
                n
              
              )
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    B
                    0
                  
                  ,
                  
                    B
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          
                            i
                            ,
                            j
                          
                        
                        ,
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          ′
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      
                        ...
                        ⁢
                        
                          
                        
                        ⁢
                        n
                      
                    
                  
                  ,
                  
                    B
                    1
                    *
                  
                
                )
              
              ⁢
              
                ←
                R
              
              ⁢
              
                
                  G
                  ob
                  
                    ABE
                    ⁡
                    
                      (
                      1
                      )
                    
                  
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    n
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      5
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
                
                  B
                  ^
                
                1
              
              :=
              
                
                  (
                  
                    
                      b
                      
                        1
                        ,
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        n
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          
                            5
                            ⁢
                            n
                          
                          +
                          1
                        
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          6
                          ⁢
                          n
                        
                      
                    
                  
                  )
                
                =
                
                  
                    {
                    
                      
                        B
                        
                          i
                          ,
                          j
                        
                      
                      ,
                      
                        B
                        
                          i
                          ,
                          j
                          ,
                          L
                        
                        ′
                      
                    
                    }
                  
                  
                    
                      i
                      =
                      1
                    
                    ,
                    
                      6
                      ;
                      
                        j
                        =
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      6
                      ;
                      
                        L
                        =
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    n
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
                *
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      4
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                1
                *
              
              :=
              
                (
                
                  
                    
                      b
                      
                        1
                        ,
                        1
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                      
                      *
                    
                    ⁢
                    
                      b
                      
                        1
                        ,
                        n
                      
                      *
                    
                  
                  ,
                  
                    
                      b
                      
                        1
                        ,
                        
                          
                            3
                            ⁢
                            n
                          
                          +
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                      
                      *
                    
                    ⁢
                    
                      b
                      
                        1
                        ,
                        
                          5
                          ⁢
                          n
                        
                      
                      *
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              pk
              :=
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  
                    param
                    n
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        t
                      
                      }
                    
                    
                      
                        t
                        =
                        0
                      
                      ,
                      1
                    
                  
                
                )
              
            
            ,
            
              sk
              :=
              
                
                  {
                  
                    
                      B
                      ^
                    
                    t
                    *
                  
                  }
                
                
                  
                    t
                    =
                    0
                  
                  ,
                  1
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              pk
            
            ,
            
              sk
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          137
        
        ]
      
    
  




The public parameter is published, for example, via a network, and is made available for the encryption device 200 and the decryption device 300.
In S103, instead of generating a basis B1, the variable Bi,j is generated. If the basis B1 is to be generated, it is as indicated in Formula 138.




  
    
      
        
          
            (
            
              
                
                  
                    b
                    
                      1
                      ,
                      
                        
                          
                            (
                            
                              i
                              -
                              1
                            
                            )
                          
                          ⁢
                          n
                        
                        +
                        1
                      
                    
                  
                
              
              
                
                  ⋮
                
              
              
                
                  
                    b
                    
                      1
                      ,
                      in
                    
                  
                
              
            
            )
          
          :=
          
            (
            
              
                
                  
                    B
                    
                      i
                      ,
                      1
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      1
                      ,
                      1
                    
                    ′
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      6
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      6
                      ,
                      1
                    
                    ′
                  
                
              
              
                
                  
                    
                  
                
                
                  ⋱
                
                
                  
                    
                  
                
                
                  ⋮
                
                
                  ...
                
                
                  
                    
                  
                
                
                  ⋱
                
                
                  
                    
                  
                
                
                  ⋮
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      1
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      1
                      ,
                      
                        n
                        -
                        1
                      
                    
                    ′
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      6
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      6
                      ,
                      
                        n
                        -
                        1
                      
                    
                    ′
                  
                
              
              
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                      B
                      
                        i
                        ,
                        1
                        ,
                        n
                      
                      ′
                    
                    ⁢
                    
                      
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    
                  
                
                
                  
                    B
                    
                      i
                      ,
                      6
                      ,
                      n
                    
                    ′
                  
                
              
            
            )
          
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          6
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              B
              1
            
            :=
            
              (
              
                
                  b
                  
                    1
                    ,
                    1
                    ,
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  b
                  
                    1
                    ,
                    
                      6
                      ⁢
                      n
                    
                  
                
              
              )
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          138
        
        ]
      
    
  




A blank portion in the matrix of Formula 138 denotes that the value of the element is 0εG. The basis B1 is the orthonormal basis of the basis B*1. That is, e(b1,i, b*1,i)=gT, and e(b1,i,b*1,j)=1 for integers i and j of 1≦i≠j≦6n.
With reference to FIG. 10, the process of the KeyGen algorithm will be described.
(S201: Information Input Step)
With an input device, the information input part 130 takes as input an access structure S:=(M, ρ). Note that the matrix M of the access structure S is to be set according to the conditions of a system to be implemented. Note also that attribute information of a user of a decryption key skS is set in ρ of the access structure S, for example.
(S202: f Vector Generation Step)
With the processing device, the f vector generation part 141 randomly generates a vector {right arrow over (f)}, as indicated in Formula 139.




  
    
      
        
          f
          →
        
        ⁢
        
          ←
          U
        
        ⁢
        
          F
          q
          r
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          139
        
        ]
      
    
  




(S203: s Vector Generation Step)
With the processing device, the s vector generation part 142 generates a vector {right arrow over (s)}T:=(s1, . . . , sL)T, as indicated in Formula 140.

{right arrow over (s)}T:=(s1, . . . ,sL)T:=M·{right arrow over (f)}T  [Formula 140]

With the processing device, the s vector generation part 142 also generates a value so, as indicated in Formula 141.

s0:={right arrow over (1)}·{right arrow over (f)}T  [Formula 141]

(S204: Random Number Generation Step)
With the processing device, the random number generation part 143 generates random numbers, as indicated in Formula 142.




  
    
      
        
          
            η
            0
          
          ⁢
          
            ←
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                η
                →
              
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              
                F
                q
                
                  2
                  ⁢
                  n
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          

        
        ⁢
        
          
            
              θ
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              
                F
                q
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          142
        
        ]
      
    
  




(S205: Key Element Generation Step)
With the processing device, the key element generation part 144 generates an element k*0 of the decryption key skS, as indicated in Formula 143.

k0*:=(−s0,0,1,η0,0  [Formula 143]

With the processing device, the key element generation part 144 also generates an element k*i of the decryption key skS for each integer i=1, . . . , L, as indicated in Formula 144.




  
    
      
        
          
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          
            
              v
              →
            
            i
          
          :=
          
            (
            
              
                v
                i
                
                  n
                  -
                  1
                
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                v
                i
              
              ,
              1
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            v
            i
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              (
              
                
                  
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            e
                            →
                          
                          1
                        
                      
                      +
                      
                        
                          θ
                          i
                        
                        ⁢
                        
                          
                            v
                            →
                          
                          i
                        
                      
                    
                    ,
                  
                  
                    {
                    n
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        n
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        η
                        →
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    0
                    n
                  
                  
                    {
                    n
                  
                
              
              )
            
            
              B
              1
              *
            
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              v
              i
            
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              (
              
                
                  
                    
                      
                        s
                        i
                      
                      ⁢
                      
                        
                          v
                          →
                        
                        i
                      
                    
                    ,
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        n
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        η
                        →
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    0
                    n
                  
                  
                    {
                    n
                  
                
              
              )
            
            
              B
              1
              *
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          144
        
        ]
      
    
  




(S206: Key Transmission Step)
With a communication device and via the network, for example, the key transmission part 150 transmits the decryption key skS having, as elements, the access structure S inputted in (S201) and k*0, k*1, . . . , and k*L generated in (S205) to the decryption device 300 in secrecy. As a matter of course, the decryption key skS may be transmitted to the decryption device 300 by another method.
In brief, in (S201) through (S205), the key generation device 100 generates the decryption key skS by executing the KeyGen algorithm indicated in Formula 145. In (S206), the key generation device 100 transmits the generated decryption key skS to the decryption device 300.




  
    
      
        
          
            KeyGen
            ⁡
            
              (
              
                pk
                ,
                sk
                ,
                
                  S
                  =
                  
                    (
                    
                      M
                      ,
                      ρ
                    
                    )
                  
                
              
              )
            
          
          ⁢
          
            :
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              f
              →
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
              r
            
          
          ,
          
            

          
          ⁢
          
            
              
                s
                →
              
              T
            
            :=
            
              
                
                  (
                  
                    
                      s
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      s
                      L
                    
                  
                  )
                
                T
              
              :=
              
                M
                ·
                
                  
                    f
                    →
                  
                  T
                
              
            
          
          ,
          
            
              s
              0
            
            :=
            
              
                1
                →
              
              ·
              
                
                  f
                  →
                
                T
              
            
          
          ,
          
            

          
          ⁢
          
            
              η
              0
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              k
              0
              *
            
            :=
            
              
                (
                
                  
                    -
                    
                      s
                      0
                    
                  
                  ,
                  0
                  ,
                  1
                  ,
                  
                    η
                    0
                  
                  ,
                  0
                
                )
              
              
                B
                0
                *
              
            
          
          ,
          
            

          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            
              
                v
                →
              
              i
            
            :=
            
              (
              
                
                  v
                  i
                  
                    n
                    -
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  v
                  i
                
                ,
                1
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              
                η
                →
              
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
              
                2
                ⁢
                n
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              
                v
                i
              
              ∈
              
                F
                q
                ×
              
            
          
          ,
          
            
              θ
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              k
              i
              *
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            s
                            i
                          
                          ⁢
                          
                            
                              e
                              →
                            
                            1
                          
                        
                        +
                        
                          
                            θ
                            i
                          
                          ⁢
                          
                            
                              v
                              →
                            
                            i
                          
                        
                      
                      ,
                    
                    
                      {
                      n
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        0
                        
                          2
                          ⁢
                          n
                        
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          η
                          →
                        
                        i
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      0
                      n
                    
                    
                      {
                      n
                    
                  
                
                )
              
              
                B
                1
                *
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              ρ
              ⁢
              
                (
                i
                )
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              k
              i
              *
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            v
                            →
                          
                          i
                        
                      
                      ,
                    
                    
                      {
                      
                        n
                        t
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        0
                        
                          2
                          ⁢
                          n
                        
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          η
                          →
                        
                        i
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      0
                      n
                    
                    
                      {
                      n
                    
                  
                
                )
              
              
                B
                1
                *
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            sk
            S
          
          :=
          
            (
            
              S
              ,
              
                k
                0
                *
              
              ,
              
                k
                1
                *
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                k
                L
                *
              
            
            )
          
        
        ⁢
        
          

        
        ⁢
        
          return
          ⁢
          
            
          
          ⁢
          
            
              sk
              S
            
            .
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          145
        
        ]
      
    
  




The function and operation of the encryption device 200 will be described.
As illustrated in FIG. 7, the encryption device 200 includes a public parameter receiving part 210, an information input part 220, an encrypted data generation part 230, and a data transmission part 240. The encrypted data generation part 230 includes a random number generation part 231 and a cipher element generation part 232.
With reference to FIG. 11, the process of the Enc algorithm will be described.
(S301: Public Parameter Receiving Step)
With the communication device and via the network, for example, the public parameter receiving part 210 receives the public parameter pk generated by the key generation device 100.
(S302: Information Input Step)
With the input device, the information input part 220 takes as input a message m to be transmitted to the decryption device 300. With the input device, the information input part 220 also takes as input an attribute set Γ:={x1, . . . , xn′|xjεFqX, n′≦n−1}. Note that attribute information of a user capable of decryption is set in the attribute set Γ, for example.
(S303: Random Number Generation Step)
With the processing device, the random number generation part 231 generates random numbers, as indicated in Formula 146.




  
    
      
        ω
        ,
        
          φ
          0
        
        ,
        
          φ
          1
        
        ,
        
          ζ
          ⁢
          
            ←
            U
          
          ⁢
          
            F
            q
          
        
      
    
    
      
        [
        
          For
          ⁢
          
            
          
          ⁢
          mula
          ⁢
          
            
          
          ⁢
          146
        
        ]
      
    
  




(S304: Cipher Element Generation Step)
With the processing device, the cipher element generation part 232 generates an element c0 of a ciphertext ctΓ, as indicated in Formula 147.

c0:=(ω,0,ζ,0,φ0)  [Formula 147]

With the processing device, the cipher element generation part 232 also generates elements C1,j and C2,j of the ciphertext ctΓ, as indicated in Formula 148.
for j=1, . . . , 6

C1,j:=ωB1,j+η1B6,j,

C2,j:=ΣL=1nyL(ωB1,j,L′+φ1B6,j,L′)  [Formula 148]

where

{right arrow over (y)}:=(y1, . . . ,yn) such that Σj=0n-1yn-jzj=zn-1-n′·Πj=1n′(z−xj)

With the processing device, the cipher element generation part 232 also generates an element c3 of the ciphertext ctΓ, as indicated in Formula 149.

c3:=gTζm  [Formula 149]

(S305: Data Transmission Step)
With the communication device and via the network, for example, the data transmission part 240 transmits the ciphertext ctΓ having, as elements, the attribute set Γ inputted in (S302) and c0, C1,j, C2,j, and c3 generated in (S304) to the decryption device 300. As a matter of course, the ciphertext ctΓ may be transmitted to the decryption device 300 by another method.
In brief, in (S301) through (S304), the encryption device 200 generates the ciphertext ctΓ by executing the Enc algorithm indicated in Formula 150. In (S305), the encryption device 200 transmits the generated ciphertext ctΓ to the decryption device 300.




  
    
      
        
          
            
              Enc
              ⁡
              
                (
                
                  pk
                  ,
                  m
                  ,
                  
                    Γ
                    =
                    
                      {
                      
                        
                          x
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          
                            x
                            
                              n
                              ′
                            
                          
                          ❘
                          
                            
                              x
                              j
                            
                            ∈
                            
                              F
                              q
                              ×
                            
                          
                        
                        ,
                        
                          
                            n
                            ′
                          
                          ≤
                          
                            n
                            -
                            1
                          
                        
                      
                      }
                    
                  
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            ω
            ,
            
              φ
              0
            
            ,
            
              φ
              1
            
            ,
            
              ζ
              ⁢
              
                ←
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
                y
                →
              
              :=
              
                
                  
                    (
                    
                      
                        y
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        y
                        n
                      
                    
                    )
                  
                  ⁢
                  
                    
                  
                  ⁢
                  such
                  ⁢
                  
                    
                  
                  ⁢
                  that
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      ∑
                      
                        j
                        =
                        0
                      
                      
                        n
                        -
                        1
                      
                    
                    ⁢
                    
                      
                        y
                        
                          n
                          -
                          j
                        
                      
                      ⁢
                      
                        z
                        j
                      
                    
                  
                
                =
                
                  
                    z
                    
                      n
                      -
                      1
                      -
                      
                        n
                        ′
                      
                    
                  
                  ·
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      
                        n
                        ′
                      
                    
                    ⁢
                    
                      (
                      
                        z
                        -
                        
                          x
                          j
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                0
              
              :=
              
                
                  (
                  
                    ω
                    ,
                    0
                    ,
                    ζ
                    ,
                    0
                    ,
                    
                      φ
                      0
                    
                  
                  )
                
                
                  B
                  0
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                C
                
                  1
                  ,
                  j
                
              
              :=
              
                
                  ω
                  ⁢
                  
                    
                  
                  ⁢
                  
                    B
                    
                      1
                      ,
                      j
                    
                  
                
                +
                
                  
                    η
                    1
                  
                  ⁢
                  
                    B
                    
                      6
                      ⁢
                      j
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                C
                
                  2
                  ,
                  j
                
              
              :=
              
                
                  ∑
                  
                    L
                    =
                    1
                  
                  n
                
                ⁢
                
                  
                    y
                    L
                  
                  ⁡
                  
                    (
                    
                      
                        ω
                        ⁢
                        
                          
                        
                        ⁢
                        
                          B
                          
                            1
                            ,
                            j
                            ,
                            L
                          
                          ′
                        
                      
                      +
                      
                        
                          φ
                          1
                        
                        ⁢
                        
                          B
                          
                            6
                            ,
                            j
                            ,
                            L
                          
                          ′
                        
                      
                    
                    )
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            
              for
              ⁢
              
                
              
              ⁢
              j
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          6
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              c
              3
            
            :=
            
              
                g
                T
                ζ
              
              ⁢
              m
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              ct
              Γ
            
            :=
            
              (
              
                Γ
                ,
                
                  c
                  0
                
                ,
                
                  
                    {
                    
                      
                        C
                        
                          1
                          ,
                          j
                        
                      
                      ,
                      
                        C
                        
                          2
                          ,
                          j
                        
                      
                    
                    }
                  
                  
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    6
                  
                
                ,
                
                  c
                  3
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                ct
                Γ
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          150
        
        ]
      
    
  




The function and operation of the decryption device 300 will be described.
As illustrated in FIG. 8, the decryption device 300 includes a decryption key receiving part 310, a data receiving part 320, a span program computation part 330, a complementary coefficient computation part 340, and a decryption part 350.
With reference to FIG. 12, the process of the Dec algorithm will be described.
(S401: Decryption Key Receiving Step)
With the communication device and via the network, for example, the decryption key receiving part 310 receives the decryption key skS transmitted by the key generation device 100. The decryption key receiving part 310 also receives the public parameter pk generated by the key generation device 100.
(S402: Data Receiving Step)
With the communication device and via the network, for example, the data receiving part 320 receives the ciphertext ctΓ transmitted by the encryption device 200.
(S403: Span Program Computation Step)
With the processing device, the span program computation part 330 determines whether or not the access structure S included in the decryption key skS received in (S401) accepts F included in the ciphertext ctΓ received in (S402). The method for determining whether or not the access structure S accepts Γ is as described in “2. Concept for Implementing Cryptographic Scheme”.
If the access structure S accepts Γ (accept in S403), the span program computation part 330 advances the process to (S404). If the access structure S rejects Γ (reject in S403), the span program computation part 330 determines that the ciphertext ctΓ cannot be decrypted with the decryption key skS, and ends the process.
(S404: Complementary Coefficient Computation Step)
With the processing device, the complementary coefficient computation part 340 computes I and a constant (complementary coefficient) {αi}iεI such that Formula 151 is satisfied.




  
    
      
        
          
        
        ⁢
        
          
            
              1
              ->
            
            =
            
              
                ∑
                
                  i
                  ∈
                  I
                
              
              ⁢
              
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  M
                  i
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            and
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            I
            ⊆
            
              {
              
                
                  i
                  ∈
                  
                    {
                    
                      1
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      L
                    
                    }
                  
                
                ❘
                
                  
                
                ⁢
                
                  
                    [
                    
                      
                    
                    ⁢
                    
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                      =
                      
                        
                          
                            v
                            i
                          
                          ⋀
                          
                            v
                            i
                          
                        
                        ∈
                        Γ
                      
                    
                    ]
                  
                  ⋁
                  
                     
                    
                      [
                      
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                        =
                        
                          ⫬
                          
                            
                              
                                v
                                i
                              
                              ⋀
                              
                                v
                                i
                              
                            
                            ∉
                            Γ
                          
                        
                      
                      ]
                    
                    }
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          151
        
        ]
      
    
  




(S405: Decryption Element Generation Step)
With the processing device, the decryption part 350 generates decryption elements D*1, . . . , D6n, E*j, as indicated in Formula 152.




  
    
      
        
          
            (
            
              
                D
                1
                *
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                D
                
                  6
                  ⁢
                  n
                
                *
              
            
            )
          
          :=
          
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    v
                    i
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  k
                  i
                  *
                
              
            
            +
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    ⫬
                    
                      v
                      i
                    
                  
                
              
              ⁢
              
                
                  
                    α
                    i
                  
                  
                    
                      
                        v
                        ->
                      
                      i
                    
                    ·
                    
                      y
                      ->
                    
                  
                
                ⁢
                
                  k
                  i
                  *
                
              
            
          
        
        ,
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            E
            j
            *
          
          :=
          
            
              
                ∑
                
                  L
                  =
                  1
                
                
                  n
                  -
                  1
                
              
              ⁢
              
                
                  y
                  
                    L
                    -
                    1
                  
                
                ⁢
                
                  D
                  
                    
                      
                        (
                        
                          j
                          -
                          1
                        
                        )
                      
                      ⁢
                      n
                    
                    +
                    L
                  
                  *
                
                ⁢
                
                  
                
                ⁢
                for
                ⁢
                
                  
                
                ⁢
                j
              
            
            =
            1
          
        
        ,
        ...
        ⁢
        
          
        
        ,
        6
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          152
        
        ]
      
    
  




(S406: Pairing Operation Step)
With the processing device, the decryption part 350 computes Formula 153, and thereby generates a session key K=gTζ.

K:=e(c0,k0*)·Πj=16(e(C1,j,Ej*)·e(C2,j,Djn*))  [Formula 153]

(S407: Message Computation Step)
With the processing device, the decryption part 350 computes m′=c3/K, and thereby generates a message m′(=m).
In brief, in (S401) through (S407), the decryption device 300 generates the message m′(=m) by executing the Dec algorithm indicated in Formula 154.




  
    
      
        
          
        
        ⁢
        
          
            
              
                Dec
                (
                
                  pk
                  ,
                  
                    
                      sk
                      S
                    
                    :=
                    
                      (
                      
                        S
                        ,
                        
                          k
                          0
                          *
                        
                        ,
                        
                          k
                          1
                          *
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          k
                          L
                          *
                        
                      
                      )
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      ct
                      Γ
                    
                    :=
                    
                      (
                      
                        Γ
                        ,
                        
                          c
                          0
                        
                        ,
                        
                          
                            {
                            
                              
                                C
                                
                                  1
                                  ,
                                  j
                                
                              
                              ,
                              
                                C
                                
                                  2
                                  ,
                                  j
                                
                              
                            
                            }
                          
                          
                            
                              j
                              =
                              1
                            
                            ,
                            ...
                            ⁢
                            
                              
                            
                            ,
                            6
                          
                        
                        ,
                        
                          c
                          3
                        
                      
                      )
                    
                  
                
                )
              
              ⁢
              
                :
              
            
            ⁢
            
              

            
            ⁢
            
              
                If
                ⁢
                
                  
                
                ⁢
                S
                ⁢
                
                  
                
                ⁢
                accepts
                ⁢
                
                  
                
                ⁢
                Γ
              
              ,
              
                then
                ⁢
                
                  
                
                ⁢
                compute
                ⁢
                
                  
                
                ⁢
                I
                ⁢
                
                  
                
                ⁢
                and
                ⁢
                
                  
                
                ⁢
                
                  
                    {
                    
                      α
                      i
                    
                    }
                  
                  
                    i
                    ∈
                    I
                  
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  1
                  ->
                
                =
                
                  
                    ∑
                    
                      i
                      ∈
                      I
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      α
                      i
                    
                    ⁢
                    
                      M
                      i
                    
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            and
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            I
            ⊆
            
              {
              
                
                  
                    
                      i
                      ∈
                      
                        {
                        
                          1
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          L
                        
                        }
                      
                    
                    ❘
                    
                      
                    
                    ⁢
                    
                      
                        
                          [
                          
                            
                          
                          ⁢
                          
                            
                              ρ
                              ⁡
                              
                                (
                                i
                                )
                              
                            
                            =
                            
                              
                                
                                  v
                                  i
                                
                                ⋀
                                
                                  v
                                  i
                                
                              
                              ∈
                              Γ
                            
                          
                          ]
                        
                        ⋁
                        
                           
                          
                            [
                            
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                              =
                              
                                ⫬
                                
                                  
                                    
                                      v
                                      i
                                    
                                    ⋀
                                    
                                      v
                                      i
                                    
                                  
                                  ∉
                                  Γ
                                
                              
                            
                            ]
                          
                          }
                        
                      
                      ⁢
                      
                        

                      
                      ⁢
                      
                        y
                        ->
                      
                    
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            y
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            y
                            n
                          
                        
                        )
                      
                      ⁢
                      
                        
                      
                      ⁢
                      such
                      ⁢
                      
                        
                      
                      ⁢
                      that
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          ∑
                          
                            j
                            =
                            0
                          
                          
                            n
                            -
                            1
                          
                        
                        ⁢
                        
                          
                            y
                            
                              n
                              -
                              j
                            
                          
                          ⁢
                          
                            z
                            j
                          
                        
                      
                    
                    =
                    
                      
                        z
                        
                          n
                          -
                          1
                          -
                          
                            n
                            ′
                          
                        
                      
                      ·
                      
                        
                          ∏
                          
                            j
                            =
                            1
                          
                          
                            n
                            ′
                          
                        
                        ⁢
                        
                          (
                          
                            z
                            -
                            
                              x
                              j
                            
                          
                          )
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    (
                    
                      
                        D
                        1
                        *
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        D
                        
                          6
                          ⁢
                          n
                        
                        *
                      
                    
                    )
                  
                  :=
                  
                    
                      
                        ∑
                        
                          
                            i
                            ∈
                            
                              I
                              ⋀
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                            
                          
                          =
                          
                            v
                            i
                          
                        
                      
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          α
                          i
                        
                        ⁢
                        
                          k
                          i
                          *
                        
                      
                    
                    +
                    
                      
                        ∑
                        
                          
                            i
                            ∈
                            
                              I
                              ⋀
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                            
                          
                          =
                          
                            ⫬
                            
                              v
                              i
                            
                          
                        
                      
                      ⁢
                      
                        
                          
                            α
                            i
                          
                          
                            
                              
                                v
                                ->
                              
                              i
                            
                            ·
                            
                              y
                              ->
                            
                          
                        
                        ⁢
                        
                          k
                          i
                          *
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    E
                    j
                    *
                  
                  :=
                  
                    
                      
                        ∑
                        
                          L
                          =
                          1
                        
                        
                          n
                          -
                          1
                        
                      
                      ⁢
                      
                        
                          y
                          
                            L
                            -
                            1
                          
                        
                        ⁢
                        
                          D
                          
                            
                              
                                (
                                
                                  j
                                  -
                                  1
                                
                                )
                              
                              ⁢
                              n
                            
                            +
                            L
                          
                          *
                        
                        ⁢
                        
                          
                        
                        ⁢
                        for
                        ⁢
                        
                          
                        
                        ⁢
                        j
                      
                    
                    =
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                6
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  K
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          
                            c
                            0
                          
                          ,
                          
                            k
                            0
                            *
                          
                        
                        )
                      
                    
                    ·
                    
                      
                        ∏
                        
                          j
                          =
                          1
                        
                        6
                      
                      ⁢
                      
                        (
                        
                          
                            e
                            ⁡
                            
                              (
                              
                                
                                  C
                                  
                                    1
                                    ,
                                    j
                                  
                                
                                ,
                                
                                  E
                                  j
                                  *
                                
                              
                              )
                            
                          
                          ·
                          
                            e
                            ⁡
                            
                              (
                              
                                
                                  C
                                  
                                    2
                                    ,
                                    j
                                  
                                
                                ,
                                
                                  D
                                  jn
                                  *
                                
                              
                              )
                            
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    return
                    ⁢
                    
                      
                    
                    ⁢
                    
                      m
                      ′
                    
                  
                  :=
                  
                    
                      c
                      3
                    
                    /
                    
                      K
                      .
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          154
        
        ]
      
    
  




Based on Formula 138, B1:=(b1,1, . . . , b1,6n) is identified by {Bi,j, B′i,j,L}i,j=1, . . . , 6; L=1, . . . , n. {Bi,j, B′i,j,L}i=1,6; j=1, . . . , 6; L=1, . . . , included in the output of the Setup algorithm is identified by B^1:=(b1,1, . . . , b1,n, b1,5n+1, . . . , b1,6n).
Then, the Dec algorithm can be described as a Dec′ algorithm indicated in Formula 155.




  
    
      
        
          
        
        ⁢
        
          
            
              
                
                  Dec
                  ′
                
                ⁡
                
                  (
                  
                    pk
                    ,
                    
                      
                        sk
                        S
                      
                      :=
                      
                        (
                        
                          
                            v
                            ->
                          
                          ,
                          
                            k
                            0
                            *
                          
                          ,
                          
                            k
                            1
                            *
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            k
                            L
                            *
                          
                        
                        )
                      
                    
                    ,
                    
                      

                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        ct
                        Γ
                      
                      :=
                      
                        (
                        
                          Γ
                          ,
                          
                            c
                            0
                          
                          ,
                          
                            
                              {
                              
                                
                                  C
                                  
                                    1
                                    ,
                                    j
                                  
                                
                                ,
                                
                                  C
                                  
                                    2
                                    ,
                                    j
                                  
                                
                              
                              }
                            
                            
                              
                                j
                                =
                                1
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              6
                            
                          
                          ,
                          
                            c
                            3
                          
                        
                        )
                      
                    
                  
                  )
                
              
              ⁢
              
                :
              
            
            ⁢
            
              

            
            ⁢
            
              
                If
                ⁢
                
                  
                
                ⁢
                S
                ⁢
                
                  
                
                ⁢
                accepts
                ⁢
                
                  
                
                ⁢
                Γ
              
              ,
              
                then
                ⁢
                
                  
                
                ⁢
                compute
                ⁢
                
                  
                
                ⁢
                I
                ⁢
                
                  
                
                ⁢
                and
                ⁢
                
                  
                
                ⁢
                
                  
                    {
                    
                      α
                      i
                    
                    }
                  
                  
                    i
                    ∈
                    I
                  
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  1
                  ->
                
                =
                
                  
                    ∑
                    
                      i
                      ∈
                      I
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      α
                      i
                    
                    ⁢
                    
                      M
                      i
                    
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            and
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            I
            ⊆
            
              {
              
                
                  
                    
                      i
                      ∈
                      
                        {
                        
                          1
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          L
                        
                        }
                      
                    
                    ❘
                    
                      
                    
                    ⁢
                    
                      
                        
                          [
                          
                            
                          
                          ⁢
                          
                            
                              ρ
                              ⁡
                              
                                (
                                i
                                )
                              
                            
                            =
                            
                              
                                
                                  v
                                  i
                                
                                ⋀
                                
                                  v
                                  i
                                
                              
                              ∈
                              Γ
                            
                          
                          ]
                        
                        ⋁
                        
                           
                          
                            [
                            
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                              =
                              
                                ⫬
                                
                                  
                                    
                                      v
                                      i
                                    
                                    ⋀
                                    
                                      v
                                      i
                                    
                                  
                                  ∉
                                  Γ
                                
                              
                            
                            ]
                          
                          }
                        
                      
                      ⁢
                      
                        

                      
                      ⁢
                      
                        y
                        ->
                      
                    
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            y
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            y
                            n
                          
                        
                        )
                      
                      ⁢
                      
                        
                      
                      ⁢
                      such
                      ⁢
                      
                        
                      
                      ⁢
                      that
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          ∑
                          
                            j
                            =
                            0
                          
                          
                            n
                            -
                            1
                          
                        
                        ⁢
                        
                          
                            y
                            
                              n
                              -
                              j
                            
                          
                          ⁢
                          
                            z
                            j
                          
                        
                      
                    
                    =
                    
                      
                        z
                        
                          n
                          -
                          1
                          -
                          
                            n
                            ′
                          
                        
                      
                      ·
                      
                        
                          ∏
                          
                            j
                            =
                            1
                          
                          
                            n
                            ′
                          
                        
                        ⁢
                        
                          (
                          
                            z
                            -
                            
                              x
                              j
                            
                          
                          )
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    c
                    1
                  
                  =
                  
                    (
                    
                      
                        
                          
                            
                              
                                
                                  y
                                  1
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    1
                                  
                                
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                
                                  y
                                  
                                    n
                                    -
                                    1
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    1
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    2
                                    ,
                                    1
                                  
                                
                              
                              ,
                            
                            
                              {
                              n
                            
                          
                        
                      
                      
                        
                          
                            
                              
                                
                                  y
                                  1
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    2
                                  
                                
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                
                                  y
                                  
                                    n
                                    -
                                    1
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    2
                                  
                                
                              
                              ,
                              
                                C
                                
                                  2
                                  ,
                                  2
                                
                              
                            
                            
                              {
                              n
                            
                          
                        
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  ...
                  ⁢
                  
                    
                  
                  ⁢
                  
                    (
                    
                      
                        
                          
                            
                              
                                
                                  y
                                  1
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    5
                                  
                                
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                
                                  y
                                  
                                    n
                                    -
                                    1
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    5
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    2
                                    ,
                                    5
                                  
                                
                              
                              ,
                            
                            
                              {
                              n
                            
                          
                        
                      
                      
                        
                          
                            
                              
                                
                                  y
                                  1
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    6
                                  
                                
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                
                                  y
                                  
                                    n
                                    -
                                    1
                                  
                                
                                ⁢
                                
                                  C
                                  
                                    1
                                    ,
                                    6
                                  
                                
                              
                              ,
                              
                                C
                                
                                  2
                                  ,
                                  6
                                
                              
                            
                            
                              {
                              n
                            
                          
                        
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  that
                  ⁢
                  
                    
                  
                  ⁢
                  is
                
                ,
                
                  
                    c
                    1
                  
                  =
                  
                    
                      (
                      
                        
                          
                            
                              
                                ω
                                ⁢
                                
                                  
                                
                                ⁢
                                
                                  y
                                  ->
                                
                              
                              ,
                            
                            
                              {
                              n
                            
                          
                          ⁢
                          
                            
                              0
                              
                                2
                                ⁢
                                n
                              
                            
                            
                              {
                              
                                2
                                ⁢
                                n
                              
                            
                          
                        
                        ,
                        
                          
                            0
                            
                              2
                              ⁢
                              n
                            
                          
                          
                            {
                            
                              2
                              ⁢
                              n
                            
                          
                        
                        ,
                        
                          
                            
                              φ
                              1
                            
                            ⁢
                            
                              y
                              ->
                            
                          
                          
                            {
                            n
                          
                        
                      
                      )
                    
                    
                      B
                      1
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  K
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          
                            c
                            0
                          
                          ,
                          
                            k
                            0
                            *
                          
                        
                        )
                      
                    
                    ·
                    
                      e
                      (
                      
                        
                          c
                          1
                        
                        ,
                        
                          
                            
                              ∑
                              
                                
                                  i
                                  ∈
                                  
                                    I
                                    ⋀
                                    
                                      ρ
                                      ⁡
                                      
                                        (
                                        i
                                        )
                                      
                                    
                                  
                                
                                =
                                
                                  v
                                  i
                                
                              
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                α
                                i
                              
                              ⁢
                              
                                k
                                i
                                *
                              
                            
                          
                          +
                          
                            
                              ∑
                              
                                
                                  i
                                  ∈
                                  
                                    I
                                    ⋀
                                    
                                      ρ
                                      ⁡
                                      
                                        (
                                        i
                                        )
                                      
                                    
                                  
                                
                                =
                                
                                  ⫬
                                  
                                    v
                                    i
                                  
                                
                              
                            
                            ⁢
                            
                              
                                
                                  α
                                  i
                                
                                
                                  
                                    
                                      v
                                      ->
                                    
                                    i
                                  
                                  ·
                                  
                                    y
                                    ->
                                  
                                
                              
                              ⁢
                              
                                k
                                i
                                *
                              
                            
                          
                        
                      
                      )
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    return
                    ⁢
                    
                      
                    
                    ⁢
                    
                      m
                      ′
                    
                  
                  :=
                  
                    
                      c
                      3
                    
                    /
                    
                      K
                      .
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          155
        
        ]
      
    
  




As indicated in Formula 156, when the Dec′ algorithm is employed, K:=gζT is obtained. Therefore, the message m′ (=m) can be obtained by dividing c3=gζTm by K.




  
    
      
        
          
            e
            ⁡
            
              (
              
                
                  c
                  0
                
                ,
                
                  k
                  0
                  *
                
              
              )
            
          
          ·
          
            
              ∏
              
                
                  i
                  ∈
                  
                    I
                    ⋀
                    
                      ρ
                      ⁡
                      
                        (
                        i
                        )
                      
                    
                  
                
                =
                
                  v
                  i
                
              
            
            ⁢
            
              
            
            ⁢
            
              
                
                  e
                  ⁡
                  
                    (
                    
                      
                        c
                        1
                      
                      ,
                      
                        k
                        i
                        *
                      
                    
                    )
                  
                
                
                  α
                  i
                
              
              ·
              
                
                  ∏
                  
                    
                      i
                      ∈
                      
                        I
                        ⋀
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                      
                    
                    =
                    
                      ⫬
                      
                        v
                        i
                      
                    
                  
                
                ⁢
                
                  
                    e
                    ⁡
                    
                      (
                      
                        
                          c
                          1
                        
                        ,
                        
                          k
                          i
                          *
                        
                      
                      )
                    
                  
                  
                    
                      α
                      i
                    
                    /
                    
                      (
                      
                        
                          
                            v
                            →
                          
                          i
                        
                        ·
                        
                          y
                          →
                        
                      
                      )
                    
                  
                
              
            
          
        
        =
        
          
            
              g
              T
              
                
                  
                    -
                    ω
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    s
                    0
                  
                
                +
                ζ
              
            
            ⁢
            
              
                ∏
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    v
                    i
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  g
                  T
                  
                    
                      ωα
                      i
                    
                    ⁢
                    
                      s
                      i
                    
                  
                
                ⁢
                
                  
                    ∏
                    
                      
                        i
                        ∈
                        
                          I
                          ⋀
                          
                            ρ
                            ⁡
                            
                              (
                              i
                              )
                            
                          
                        
                      
                      =
                      
                        ⫬
                        
                          v
                          i
                        
                      
                    
                  
                  ⁢
                  
                    g
                    T
                    
                      
                        ωα
                        i
                      
                      ⁢
                      
                        
                          
                            s
                            i
                          
                          ⁡
                          
                            (
                            
                              
                                
                                  v
                                  →
                                
                                i
                              
                              ·
                              
                                y
                                →
                              
                            
                            )
                          
                        
                        /
                        
                          (
                          
                            
                              
                                v
                                →
                              
                              i
                            
                            ·
                            
                              y
                              →
                            
                          
                          )
                        
                      
                    
                  
                
              
            
          
          =
          
            
              g
              T
              
                
                  ω
                  ⁡
                  
                    (
                    
                      
                        -
                        
                          s
                          0
                        
                      
                      +
                      
                        
                          ∑
                          
                            i
                            ∈
                            I
                          
                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            α
                            i
                          
                          ⁢
                          
                            s
                            i
                          
                        
                      
                    
                    )
                  
                
                +
                ζ
              
            
            =
            
              
                g
                T
                ζ
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          156
        
        ]
      
    
  




In the KP-ABE scheme described in Embodiment 1, the ciphertext ctΓ consists of a total of 17 elements of G, which are five elements in the element c0, and 12 elements in the element C1,j and the element C2j for each integer j=1, . . . , 6, as well as one element of GT in the element c3. That is, the ciphertext ctΓ is constant-size in n.
In the KP-ABE scheme described in Embodiment 1, the decryption process (Dec algorithm) executes only a total of 17 pairing operations, which are five operations in e(c0, k*0) indicated in Formula 153 and 12 operations in Πj=16(e(C1,j, E*j)·e(C2,j, D*jn)). That is, the number of pairing operations required for the decryption process is small.
Embodiment 2
In Embodiment 2, a ciphertext-policy ABE (CP-ABE) scheme with a constant-size secret key will be described.
In Embodiment 2, description will be omitted for what is the same as in Embodiment 1, and differences from Embodiment 1 will be described.
First, a basic structure of a cryptographic scheme according to Embodiment 2 will be described.
Second, a configuration of a cryptographic system 10 that implements the cryptographic scheme according to Embodiment 2 will be described.
Third, the cryptographic scheme according to Embodiment 2 will be described in detail.
<1. Basic Structure of Cryptographic Scheme>
The structure of the CP-ABE scheme will be briefly described. Ciphertext-policy signifies that a policy, namely an access structure, is embedded in a ciphertext.
The CP-ABE scheme includes four algorithms: Setup, KeyGen, Enc, and Dec.
(Setup)
A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ and an upper limit n for of the number of attributes for a ciphertext, and outputs a public parameter pk and a master key sk.
(KeyGen)
A KeyGen algorithm is a probabilistic algorithm that takes as input the public parameter pk, the master key sk, and an attribute set Γ:={xj}1≦j≦n′, and outputs a decryption key skΓ.
(Enc)
An Enc algorithm is a probabilistic algorithm that takes as input the public parameter pk, a message m, and an access structure S:=(M, ρ), and outputs a ciphertext ctS.
(Dec)
A Dec algorithm is an algorithm that takes as input the public parameter pk, the decryption key skΓ, and the ciphertext ctS, and outputs the message m or a distinguished symbol ⊥.
<2. Configuration of Cryptographic System 10 that Implements CP-ABE Scheme>
FIG. 13 is a configuration diagram of the cryptographic system 10 that implements the CP-ABE scheme according to Embodiment 2.
The cryptographic system 10 includes a key generation device 100, an encryption device 200 (an example of the transmission device), and a decryption device 300 (an example of the reception device).
The key generation device 100 executes the Setup algorithm taking as input a security parameter λ and an upper limit n for the number of attributes for a ciphertext, and thereby generates a public parameter pk and a master key sk. Then, the key generation device 100 publishes the generated public parameter pk. The key generation device 100 also executes the KeyGen algorithm taking as input an attribute set Γ, thereby generates a decryption key skΓ, and transmits the decryption key skΓ to the decryption device 300 in secrecy.
The encryption device 200 executes the Enc algorithm taking as input the public parameter pk, a message m, and an access structure S, and thereby generates a ciphertext ctS. The encryption device 200 transmits the generated ciphertext ctS to the decryption device 300.
The decryption device 300 executes the Dec algorithm taking as input the public parameter pk, the decryption key skΓ, and the ciphertext ctS, and outputs the message m or a distinguished symbol ⊥.
<3. Cryptographic Scheme>
FIG. 14 is a configuration diagram of the key generation device 100 according to Embodiment 2. FIG. 15 is a configuration diagram of the encryption device 200 according to Embodiment 2. The configuration of the decryption device 300 is the same as the configuration of the decryption device 300 according to Embodiment 1 illustrated in FIG. 8.
FIG. 16 is a flowchart illustrating the process of the KeyGen algorithm according to Embodiment 2. FIG. 17 is a flowchart illustrating the process of the Enc algorithm according to Embodiment 2. The process of the Setup algorithm and the process of the Dec algorithm have the same flow as that of the process of the Setup algorithm and the process of the Dec algorithm according to Embodiment 1 indicated in FIG. 9 and FIG. 12, respectively.
The function and operation of the key generation device 100 will be described.
As illustrated in FIG. 14, the key generation device 100 includes a master key generation part 110, a master key storage part 120, an information input part 130, a decryption key generation part 140, and a key transmission part 150. The master key generation part 110 includes a space generation part 111, a matrix generation part 112, a basis generation part 113, and a key generation part 114. The decryption key generation part 140 includes a random number generation part 143 and a key element generation part 144.
With reference to FIG. 9, the process of the Setup algorithm will be described.
The process of (S101) through (S102) is the same as that in Embodiment 1.
(S103: Basis B Generation Step)
With the processing device, the basis generation part 113 generates a basis Do, a variable Di,j, and a variable D′i,j,L, as indicated in Formula 157, similarly to the basis B0, the variable Bi,j, and the variable B′i,j,L in Embodiment 1.

b0,i:=(χ0,i,1, . . . ,χ0,i,5=Σj=15χ0,i,jaj for i=1, . . . 5,

0:=(b0,1, . . . ,b0,5),

Di,j:=μi,jg,Di,j,L′:=μi,j,L′g for i,j=1, . . . ,6;L=1, . . . ,n  [Formula 157]

With the processing device, the basis generation part 113 also generates a basis D*0 and a basis D*1, as indicated in Formula 158, similarly to the basis B*0 and the basis B*1 in Embodiment 1.
for t=0, 1

(θt,i,j)i,j=1, . . . ,Nt:=ψ·(XtT)−1,

b*t,i:=(θt,i,1, . . . ,θt,i,Nt=Σj=1Ntθt,i,jaj for i=1, . . . Nt,

*t:=(b*t,1, . . . ,bt,Nt*)  [Formula 158]

Then, the basis generation part 113 sets the basis D*0 as a basis B0, the basis D0 as a basis B*0, and the basis D*1 as a basis B1. The basis generation part 113 also sets the variable Di,j as a variable B*i,j and the variable D′i,j,L as a variable B′*i,j,L for each integer i, j=1, . . . , 6 and each integer L=1, . . . , n.
(S104: Basis B^ Generation Step)
With the processing device, the key generation part 114 generates a basis B^0, a basis B^1, a basis B^*0, and a basis B^*1, as indicated in Formula 159.

0:=(b0,1,b0,3,b0,4),

1=(b1,1, . . . ,b1,n,b1,3n+1, . . . ,b1,5n),

0*:=(b0,1*,b0,3*,b0,5*),

1*:=(b1,1,. . . ,b1,n*,b1,5n+1*, . . . ,b1,6n*)={Di,j,Di,j,L}i=1,6;j=1, . . . ,6;L=1, . . . ,n  [Formula 159]

The process of (S105) is the same as that in Embodiment 1.
In brief, in (S101) through (S105), the key generation device 100 generates the public parameter pk and the master secret key sk by executing the Setup algorithm indicated in Formula 161, the Setup algorithm using an algorithm GABE(2)ob indicated in Formula 160. Note that the algorithm GCP-ABE(2)ob uses the algorithm GABE(1)ob indicated in Formula 136, as indicated in Formula 160.




  
    
      
        
          
        
        ⁢
        
          
            
              
                G
                ob
                
                  ABE
                  ⁡
                  
                    (
                    2
                    )
                  
                
              
              ⁡
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  6
                  ,
                  n
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    D
                    0
                  
                  ,
                  
                    D
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        
                          D
                          
                            i
                            ,
                            j
                          
                        
                        ,
                        
                          D
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          ′
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      n
                    
                  
                  ,
                  
                    D
                    1
                    *
                  
                
                )
              
              ⁢
              
                ←
                R
              
              ⁢
              
                
                  G
                  ob
                  
                    (
                    1
                    )
                  
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    n
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
                B
                0
              
              :=
              
                D
                0
                *
              
            
            ,
            
              
                B
                0
                *
              
              :=
              
                D
                0
              
            
            ,
            
              
                B
                1
              
              :=
              
                D
                1
                *
              
            
            ,
            
              
                B
                
                  i
                  ,
                  j
                
                *
              
              :=
              
                D
                
                  i
                  ,
                  j
                
              
            
            ,
            
              
                B
                
                  i
                  ,
                  j
                  ,
                  L
                
                
                  ′
                  *
                
              
              =
              
                D
                
                  i
                  ,
                  j
                  ,
                  L
                
                ′
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            ,
            
              j
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                L
                =
                1
              
            
            ,
            ...
            ,
            n
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              
                
                  (
                  
                    
                      param
                      n
                    
                    ,
                    
                      B
                      0
                    
                    ,
                    
                      

                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      B
                      0
                      *
                    
                    ,
                    
                      B
                      1
                    
                    ,
                    
                      
                        {
                        
                          
                            B
                            
                              i
                              ,
                              j
                            
                            *
                          
                          ,
                          
                            B
                            
                              i
                              ,
                              j
                              ,
                              L
                            
                            
                              ′
                              *
                            
                          
                        
                        }
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          6
                          ;
                          
                            L
                            =
                            1
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        n
                      
                    
                  
                  )
                
                .
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          160
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              Setup
              ⁡
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  n
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    B
                    0
                  
                  ,
                  
                    B
                    0
                    *
                  
                  ,
                  
                    B
                    1
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          
                            i
                            ,
                            j
                          
                          *
                        
                        ,
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          
                            ′
                            *
                          
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      n
                    
                  
                
                )
              
              ⁢
              
                ←
                R
              
              ⁢
              
                
                  G
                  ob
                  
                    ABE
                    ⁡
                    
                      (
                      2
                      )
                    
                  
                
                ⁢
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    n
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                  
                  ⁢
                  
                    b
                    
                      0
                      ,
                      3
                    
                  
                  ⁢
                  
                    b
                    
                      0
                      ,
                      4
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                1
              
              :=
              
                (
                
                  
                    b
                    
                      1
                      ,
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      n
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      3
                      ,
                      
                        n
                        +
                        1
                      
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        5
                        ⁢
                        n
                      
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
                *
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      5
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
                
                  B
                  ^
                
                1
                *
              
              :=
              
                
                  (
                  
                    
                      b
                      
                        1
                        ,
                        1
                      
                      *
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        n
                      
                      *
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          
                            5
                            ⁢
                            n
                          
                          +
                          1
                        
                      
                      *
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          6
                          ⁢
                          n
                        
                      
                      *
                    
                  
                  )
                
                =
                
                  
                    {
                    
                      
                        B
                        
                          i
                          ,
                          j
                        
                        *
                      
                      ,
                      
                        B
                        
                          i
                          ,
                          j
                          ,
                          L
                        
                        
                          ′
                          *
                        
                      
                    
                    }
                  
                  
                    
                      i
                      =
                      1
                    
                    ,
                    
                      6
                      ;
                      
                        j
                        =
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      6
                      ;
                      
                        L
                        =
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    n
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              pk
              :=
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  
                    param
                    n
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        t
                      
                      }
                    
                    
                      
                        t
                        =
                        0
                      
                      ,
                      1
                    
                  
                
                )
              
            
            ,
            
              sk
              :=
              
                
                  {
                  
                    
                      B
                      ^
                    
                    t
                    *
                  
                  }
                
                
                  
                    t
                    =
                    0
                  
                  ,
                  1
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              pk
            
            ,
            
              sk
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          161
        
        ]
      
    
  




The public parameter is published via the network, for example, and is made available for the encryption device 200 and the decryption device 300.
With reference to FIG. 16, the process of the KeyGen algorithm will be described.
(S501: Information Input Step)
With the input device, the information input part 130 takes as input an attribute set Γ:={x1, . . . , xn′|xjεFqX, n′≦n−1}. Note that attribute information of a user of a decryption key skΓ is set in the attribute set Γ, for example.
(S502: Random Number Generation Step)
With the processing device, the random number generation part 143 generates random numbers, as indicated in Formula 162.




  
    
      
        ω
        ,
        
          φ
          0
        
        ,
        
          
            φ
            1
          
          ⁢
          
            ←
            U
          
          ⁢
          
            F
            q
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          162
        
        ]
      
    
  




(S503: Key Element Generation Step)
With the processing device, the key element generation part 144 generates an element k*0 of the decryption key skΓ, as indicated in Formula 163.

k0*:=  [Formula 163]

With the processing device, the key element generation part 144 also generates elements K*1,j and K*2,j of the decryption key skΓ, as indicated in Formula 164.
for j=1, . . . , 6

ωB1,j*+φ1B6,j*,

K2,j:=ΣL=1nyL(ωB1,j,L′*+φ1B6,j,L′*)  [Formula 164]

where

{right arrow over (y)}:=(y1, . . . ,yn) such that Σj=0n-1yn-jzj=zn-1-n′·Πj=1n′(z−xj)

(S504: Key Transmission Step)
With the communication device and via the network, for example, the key transmission part 150 transmits the decryption key skΓ having, as elements, the attribute set Γ inputted in (S501) and k*0, K*i,j, and K*2,j generated in (S503) to the decryption device 300 in secrecy. As a matter of course, the decryption key skΓ may be transmitted to the decryption device 300 by another method.
In brief, in (S501) through (S503), the key generation device 100 generates the decryption key skΓ by executing the KeyGen algorithm indicated in Formula 165. In (S504), the key generation device 100 transmits the generated decryption key skΓ to the decryption device 300.




  
    
      
        
          
            
              KeyGen
              ⁡
              
                (
                
                  pk
                  ,
                  sk
                  ,
                  
                    Γ
                    =
                    
                      {
                      
                        
                          x
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          
                            x
                            n
                            ′
                          
                          ❘
                          
                            
                              x
                              j
                            
                            ∈
                            
                              F
                              q
                              ×
                            
                          
                        
                        ,
                        
                          
                            n
                            ′
                          
                          ≤
                          
                            n
                            -
                            1
                          
                        
                      
                      }
                    
                  
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            ω
            ,
            
              φ
              0
            
            ,
            
              
                φ
                1
              
              ⁢
              
                ←
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
                y
                ->
              
              :=
              
                
                  
                    (
                    
                      
                        y
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        y
                        n
                      
                    
                    )
                  
                  ⁢
                  
                    
                  
                  ⁢
                  such
                  ⁢
                  
                    
                  
                  ⁢
                  that
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      ∑
                      
                        j
                        =
                        0
                      
                      
                        n
                        -
                        1
                      
                    
                    ⁢
                    
                      
                        y
                        
                          n
                          -
                          j
                        
                      
                      ⁢
                      
                        z
                        j
                      
                    
                  
                
                =
                
                  
                    z
                    
                      n
                      -
                      1
                      -
                      
                        n
                        ′
                      
                    
                  
                  ·
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      
                        n
                        ′
                      
                    
                    ⁢
                    
                      (
                      
                        z
                        -
                        
                          x
                          j
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                k
                0
                *
              
              :=
              
                
                  (
                  
                    ω
                    ,
                    0
                    ,
                    1
                    ,
                    0
                    ,
                    
                      φ
                      0
                    
                  
                  )
                
                
                  B
                  0
                  *
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                K
                
                  1
                  ,
                  j
                
              
              :=
              
                
                  ω
                  ⁢
                  
                    
                  
                  ⁢
                  
                    B
                    
                      1
                      ,
                      j
                    
                    *
                  
                
                +
                
                  
                    φ
                    1
                  
                  ⁢
                  
                    B
                    
                      6
                      ,
                      j
                    
                    *
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                K
                
                  2
                  ,
                  j
                
              
              :=
              
                
                  ∑
                  
                    L
                    =
                    1
                  
                  n
                
                ⁢
                
                  
                    y
                    L
                  
                  ⁡
                  
                    (
                    
                      
                        ω
                        ⁢
                        
                          
                        
                        ⁢
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          
                            ′
                            *
                          
                        
                      
                      +
                      
                        
                          φ
                          1
                        
                        ⁢
                        
                          B
                          
                            6
                            ,
                            j
                            ,
                            L
                          
                          
                            ′
                            *
                          
                        
                      
                    
                    )
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            
              for
              ⁢
              
                
              
              ⁢
              j
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          6
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              sk
              Γ
            
            :=
            
              (
              
                Γ
                ,
                
                  k
                  0
                  *
                
                ,
                
                  
                    {
                    
                      
                        K
                        
                          1
                          ,
                          j
                        
                      
                      ,
                      
                        K
                        
                          2
                          ,
                          j
                        
                      
                    
                    }
                  
                  
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    6
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                sk
                Γ
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          165
        
        ]
      
    
  




The function and operation of the encryption device 200 will be described.
As illustrated in FIG. 15, the encryption device 200 includes a public parameter receiving part 210, an information input part 220, an encrypted data generation part 230, and a data transmission part 240. The encrypted data generation part 230 includes a random number generation part 231, a cipher element generation part 232, an f vector generation part 233, and an s vector generation part 234.
With reference to FIG. 17, the process of the Enc algorithm will be described.
The process of (S601) is the same as the process of (S301) indicated in FIG. 11.
(S602: Information Input Step)
With the input device, the information input part 220 takes as input an access structure S:=(M, ρ). Note that the access structure S is to be set according to the conditions of a system to be implemented. Note also that attribute information of a user capable of decryption is set in p of the access structure S, for example.
With the input device, the information input part 220 also takes as input a message m to be transmitted to the decryption device 300.
(S603: f Vector Generation Step)
With the processing device, the f vector generation part 233 randomly generates a vector {right arrow over (f)}, as indicated in Formula 166.




  
    
      
        
          f
          ->
        
        ⁢
        
          ←
          U
        
        ⁢
        
          F
          q
          r
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          166
        
        ]
      
    
  




(S604: s Vector Generation Step)
With the processing device, the s vector generation part 234 generates a vector {right arrow over (s)}T:=(s1, . . . ,sL)T, as indicated in Formula 167.

{right arrow over (s)}T:=(s1, . . . ,sL)T:=M·{right arrow over (f)}T  [Formula 167]

With the processing device, the s vector generation part 234 also generates a value s0, as indicated in Formula 168.

s0:={right arrow over (1)}·{right arrow over (f)}T  [Formula 168]

(S605: Random Number Generation Step)
With the processing device, the random number generation part 231 generates random numbers, as indicated in Formula 169.




  
    
      
        
          η
          0
        
        ,
        
          ζ
          ⁢
          
            ←
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                η
                ->
              
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              
                F
                q
                
                  2
                  ⁢
                  n
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          

        
        ⁢
        
          
            
              θ
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              
                F
                q
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          169
        
        ]
      
    
  




(S606: Cipher Element Generation Step)
With the processing device, the cipher element generation part 232 generates an element c0 of a ciphertext ctS, as indicated in Formula 170.

c0:=(−s0,0,ζ,η0,0)  [Formula 170]

With the processing device, the cipher element generation part 232 also generates an element ci of the ciphertext ctS for each integer i=1, . . . , L, as indicated in Formula 171.




  
    
      
        
          
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          
            
              v
              ->
            
            i
          
          :=
          
            (
            
              
                v
                i
                
                  n
                  -
                  1
                
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                v
                i
              
              ,
              1
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            v
            i
          
        
        ,
        
          

        
        ⁢
        
          
            c
            i
          
          :=
          
            
              (
              
                
                  
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            e
                            ->
                          
                          
                            t
                            ,
                            1
                          
                        
                      
                      +
                      
                        
                          θ
                          i
                        
                        ⁢
                        
                          
                            v
                            ->
                          
                          i
                        
                      
                    
                    ,
                  
                  
                    {
                    n
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        n
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        η
                        ->
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                    0
                    n
                  
                  
                    {
                    n
                  
                
              
              )
            
            
              B
              1
            
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              v
              i
            
          
        
        ,
        
          

        
        ⁢
        
          
            c
            i
          
          :=
          
            
              (
              
                
                  
                    
                      
                        s
                        i
                      
                      ⁢
                      
                        
                          v
                          →
                        
                        i
                      
                    
                    ,
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        n
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                    
                      
                        η
                        ->
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      n
                    
                  
                
                ⁢
                
                  
                    0
                    n
                  
                  
                    {
                    n
                  
                
              
              )
            
            
              B
              1
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          171
        
        ]
      
    
  




With the processing device, the cipher element generation part 232 also generates an element c3 of the ciphertext ctS, as indicated in Formula 172.

c3:=gTζm  [Formula 172]

(S607: Data Transmission Step)
With the communication device and via the network, for example, the data transmission part 240 transmits the ciphertext ctS having, as elements, the access structure S inputted in (S602) and c0, c1, . . . , cL, and c3 generated in (S606) to the decryption device 300. As a matter of course, the ciphertext ctS may be transmitted to the decryption device 300 by another method.
In brief, in (S601) through (S606), the encryption device 200 generates the ciphertext ctS by executing the Enc algorithm indicated in Formula 173. In (S607), the encryption device 200 transmits the generated ciphertext ctS to the decryption device 300.




  
    
      
        
          
            Enc
            ⁡
            
              (
              
                pk
                ,
                m
                ,
                
                  S
                  =
                  
                    (
                    
                      M
                      ,
                      ρ
                    
                    )
                  
                
              
              )
            
          
          ⁢
          
            :
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              f
              →
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
              r
            
          
          ,
          
            

          
          ⁢
          
            
              
                s
                →
              
              T
            
            :=
            
              
                
                  (
                  
                    
                      s
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      s
                      L
                    
                  
                  )
                
                T
              
              :=
              
                M
                ·
                
                  
                    f
                    →
                  
                  T
                
              
            
          
          ,
          
            
              s
              0
            
            :=
            
              
                1
                →
              
              ·
              
                
                  f
                  →
                
                T
              
            
          
          ,
          
            

          
          ⁢
          
            η
            0
          
          ,
          
            ζ
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              c
              0
            
            :=
            
              
                (
                
                  
                    -
                    
                      s
                      0
                    
                  
                  ,
                  0
                  ,
                  ζ
                  ,
                  
                    η
                    0
                  
                  ,
                  0
                
                )
              
              
                B
                0
              
            
          
          ,
          
            

          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            
              
                v
                →
              
              i
            
            :=
            
              (
              
                
                  v
                  i
                  
                    n
                    -
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  v
                  i
                
                ,
                1
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              
                η
                ->
              
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
              
                2
                ⁢
                n
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              
                v
                i
              
              ∈
              
                F
                q
                ×
              
            
          
          ,
          
            
              θ
              i
            
            ⁢
            
              ←
              U
            
            ⁢
            
              F
              q
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            s
                            i
                          
                          ⁢
                          
                            
                              e
                              ->
                            
                            
                              t
                              ,
                              1
                            
                          
                        
                        +
                        
                          
                            θ
                            i
                          
                          ⁢
                          
                            
                              v
                              ->
                            
                            i
                          
                        
                      
                      ,
                    
                    
                      {
                      n
                    
                  
                  ⁢
                  
                    
                      
                        0
                        
                          2
                          ⁢
                          n
                        
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          η
                          ->
                        
                        i
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                      0
                      n
                    
                    
                      {
                      n
                    
                  
                
                )
              
              
                B
                1
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            v
                            →
                          
                          i
                        
                      
                      ,
                    
                    
                      {
                      
                        n
                        t
                      
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        0
                        
                          2
                          ⁢
                          n
                        
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                      
                        
                          η
                          ->
                        
                        i
                      
                      ,
                    
                    
                      {
                      
                        2
                        ⁢
                        n
                      
                    
                  
                  ⁢
                  
                    
                      0
                      n
                    
                    
                      {
                      n
                    
                  
                
                )
              
              
                B
                1
              
            
          
          ,
          
            

          
          ⁢
          
            
              c
              3
            
            :=
            
              
                g
                T
                ζ
              
              ⁢
              m
            
          
          ,
          
            

          
          ⁢
          
            
              ct
              S
            
            :=
            
              (
              
                S
                ,
                
                  c
                  0
                
                ,
                
                  c
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  c
                  L
                
                ,
                
                  c
                  3
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                ct
                S
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          173
        
        ]
      
    
  




The function and operation of the decryption device 300 will be described.
With reference to FIG. 12, the process of the Dec algorithm will be described.
(S401: Decryption Key Receiving Step)
With the communication device and via the network, for example, the decryption key receiving part 310 receives the decryption key skΓ transmitted by the key generation device 100. The decryption key receiving part 310 also receives the public parameter pk generated by the key generation device 100.
(S402: Data Receiving Step)
With the communication device and via the network, for example, the data receiving part 320 receives the ciphertext ctS transmitted by the encryption device 200.
(S403: Span Program Computation Step)
With the processing device, the span program computation part 330 determines whether or not the access structure S included in the ciphertext ctS received in (S402) accepts Γ included in the decryption key skr received in (S401).
If the access structure S accepts Γ (accept in S403), the span program computation part 330 advances the process to (S404). If the access structure S rejects Γ (reject in S403), the span program computation part 330 determines that the ciphertext ctΓ cannot be decrypted with the decryption key skS, and ends the process.
The process of (S404) is the same as that in Embodiment 1.
(S405: Decryption Element Generation Step)
With the processing device, the decryption part 350 generates cipher elements D1, . . . , D*6n, and E*j, as indicated in Formula 174.




  
    
      
        
          
            (
            
              
                D
                1
                *
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                D
                
                  6
                  ⁢
                  n
                
                *
              
            
            )
          
          :=
          
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    v
                    i
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  c
                  i
                
              
            
            +
            
              
                ∑
                
                  
                    i
                    ∈
                    
                      I
                      ⋀
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                  
                  =
                  
                    ⫬
                    
                      v
                      i
                    
                  
                
              
              ⁢
              
                
                  
                    α
                    i
                  
                  
                    
                      
                        v
                        ->
                      
                      i
                    
                    ·
                    
                      y
                      ->
                    
                  
                
                ⁢
                
                  c
                  i
                
              
            
          
        
        ,
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            E
            j
            *
          
          :=
          
            
              
                ∑
                
                  L
                  =
                  1
                
                
                  n
                  -
                  1
                
              
              ⁢
              
                
                  y
                  
                    L
                    -
                    1
                  
                
                ⁢
                
                  D
                  
                    
                      
                        (
                        
                          j
                          -
                          1
                        
                        )
                      
                      ⁢
                      n
                    
                    +
                    L
                  
                  *
                
                ⁢
                
                  
                
                ⁢
                for
                ⁢
                
                  
                
                ⁢
                j
              
            
            =
            1
          
        
        ,
        ...
        ⁢
        
          
        
        ,
        6
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          174
        
        ]
      
    
  




(S406: Pairing Operation Step)
With the processing device, the decryption part 350 computes Formula 175, and thereby generates a session key K=gTζ.

K:=e(c0,k0*)·Πj=16(e(Ej*,K1,j)·e(Djn*,K2,j))  [Formula 175]

The process of (S407) is the same as that in Embodiment 1.
In brief, in (S401) through (S407), the decryption device 300 generates the message m′(=m) by executing the Dec algorithm indicated in Formula 176.




  
    
      
        
          
        
        ⁢
        
          
            
              
                Dec
                ⁡
                
                  (
                  
                    pk
                    ,
                    
                      
                        sk
                        Γ
                      
                      :=
                      
                        (
                        
                          Γ
                          ,
                          
                            k
                            0
                            *
                          
                          ,
                          
                            
                              {
                              
                                
                                  K
                                  
                                    1
                                    ,
                                    j
                                  
                                
                                ,
                                
                                  K
                                  
                                    2
                                    ,
                                    j
                                  
                                
                              
                              }
                            
                            
                              
                                j
                                =
                                1
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              6
                            
                          
                        
                        )
                      
                    
                    ,
                    
                      

                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        ct
                        S
                      
                      :=
                      
                        (
                        
                          S
                          ,
                          
                            c
                            0
                          
                          ,
                          
                            c
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            c
                            L
                          
                          ,
                          
                            c
                            3
                          
                        
                        )
                      
                    
                  
                  )
                
              
              :
              
                

              
              ⁢
              
                
              
              ⁢
              
                If
                ⁢
                
                  
                
                ⁢
                S
                ⁢
                
                  
                
                ⁢
                accepts
                ⁢
                
                  
                
                ⁢
                Γ
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              then
              ⁢
              
                
              
              ⁢
              compute
              ⁢
              
                
              
              ⁢
              I
              ⁢
              
                
              
              ⁢
              and
              ⁢
              
                
              
              ⁢
              
                
                  {
                  
                    α
                    i
                  
                  }
                
                
                  i
                  ∈
                  I
                
              
              ⁢
              
                
              
              ⁢
              such
              ⁢
              
                
              
              ⁢
              that
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                1
                ->
              
              =
              
                
                  ∑
                  
                    i
                    ∈
                    I
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    α
                    i
                  
                  ⁢
                  
                    M
                    i
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            and
          
          ⁢
          
            

          
          ⁢
          
            I
            ⊆
            
              {
              
                
                  
                    
                      i
                      ∈
                      
                        {
                        
                          1
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          L
                        
                        }
                      
                    
                    ❘
                    
                      
                    
                    ⁢
                    
                      
                        
                          [
                          
                            
                          
                          ⁢
                          
                            
                              ρ
                              ⁡
                              
                                (
                                i
                                )
                              
                            
                            =
                            
                              
                                
                                  v
                                  i
                                
                                ⋀
                                
                                  v
                                  i
                                
                              
                              ∈
                              Γ
                            
                          
                          ]
                        
                        ⋁
                        
                           
                          
                            [
                            
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                              =
                              
                                ⫬
                                
                                  
                                    
                                      v
                                      i
                                    
                                    ⋀
                                    
                                      v
                                      i
                                    
                                  
                                  ∉
                                  Γ
                                
                              
                            
                            ]
                          
                          }
                        
                      
                      ⁢
                      
                        

                      
                      ⁢
                      
                        y
                        ->
                      
                    
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            y
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            y
                            n
                          
                        
                        )
                      
                      ⁢
                      
                        
                      
                      ⁢
                      such
                      ⁢
                      
                        
                      
                      ⁢
                      that
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          ∑
                          
                            j
                            =
                            0
                          
                          
                            n
                            -
                            1
                          
                        
                        ⁢
                        
                          
                            y
                            
                              n
                              -
                              j
                            
                          
                          ⁢
                          
                            z
                            j
                          
                        
                      
                    
                    =
                    
                      
                        z
                        
                          n
                          -
                          1
                          -
                          
                            n
                            ′
                          
                        
                      
                      ·
                      
                        
                          ∏
                          
                            j
                            =
                            1
                          
                          
                            n
                            ′
                          
                        
                        ⁢
                        
                          (
                          
                            z
                            -
                            
                              x
                              j
                            
                          
                          )
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    (
                    
                      
                        D
                        1
                        *
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        D
                        
                          6
                          ⁢
                          n
                        
                        *
                      
                    
                    )
                  
                  :=
                  
                    
                      
                        ∑
                        
                          
                            i
                            ∈
                            
                              I
                              ⋀
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                            
                          
                          =
                          
                            v
                            i
                          
                        
                      
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          α
                          i
                        
                        ⁢
                        
                          c
                          i
                        
                      
                    
                    +
                    
                      
                        ∑
                        
                          
                            i
                            ∈
                            
                              I
                              ⋀
                              
                                ρ
                                ⁡
                                
                                  (
                                  i
                                  )
                                
                              
                            
                          
                          =
                          
                            ⫬
                            
                              v
                              i
                            
                          
                        
                      
                      ⁢
                      
                        
                          
                            α
                            i
                          
                          
                            
                              
                                v
                                ->
                              
                              i
                            
                            ·
                            
                              y
                              ->
                            
                          
                        
                        ⁢
                        
                          c
                          i
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    E
                    j
                    *
                  
                  :=
                  
                    
                      
                        ∑
                        
                          L
                          =
                          1
                        
                        
                          n
                          -
                          1
                        
                      
                      ⁢
                      
                        
                          y
                          
                            L
                            -
                            1
                          
                        
                        ⁢
                        
                          D
                          
                            
                              
                                (
                                
                                  j
                                  -
                                  1
                                
                                )
                              
                              ⁢
                              n
                            
                            +
                            L
                          
                          *
                        
                        ⁢
                        
                          
                        
                        ⁢
                        for
                        ⁢
                        
                          
                        
                        ⁢
                        j
                      
                    
                    =
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  
                    6
                    ⁢
                    
                      

                    
                    ⁢
                    
                      
                    
                    ⁢
                    K
                  
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          
                            c
                            0
                          
                          ,
                          
                            k
                            0
                            *
                          
                        
                        )
                      
                    
                    ·
                    
                      
                        ∏
                        
                          j
                          =
                          1
                        
                        6
                      
                      ⁢
                      
                        (
                        
                          
                            e
                            ⁡
                            
                              (
                              
                                
                                  E
                                  j
                                  *
                                
                                ,
                                
                                  K
                                  
                                    1
                                    ,
                                    j
                                  
                                
                              
                              )
                            
                          
                          ·
                          
                            e
                            ⁡
                            
                              (
                              
                                
                                  D
                                  jn
                                  *
                                
                                ,
                                
                                  K
                                  
                                    2
                                    ,
                                    j
                                  
                                
                              
                              )
                            
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    return
                    ⁢
                    
                      
                    
                    ⁢
                    
                      m
                      ′
                    
                  
                  :=
                  
                    
                      c
                      3
                    
                    /
                    
                      K
                      .
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          176
        
        ]
      
    
  




In the CP-ABE scheme described in Embodiment 2, the decryption key skΓ consists of a total of 17 elements of G, which are five elements in the element k0, and 12 elements in the element C1,j and the element C2,j for each integer j=1, . . . , 6. That is, the decryption key skΓ is constant-size in n.
In the CP-ABE scheme described in Embodiment 2, the decryption process (Dec algorithm) executes only a total of 17 pairing operations, similarly as in the KP-ABE scheme described in Embodiment 1. That is, the number of pairing operations required for the decryption process is small.
Embodiment 3
In Embodiment 3, an FE scheme to which the ABE scheme described in Embodiment 1 or 2 is applied will be described.
In Embodiment 3, description will be omitted for what is the same as in Embodiment 1 or 2, and differences from Embodiment 1 or 2 will be described.
A KP-FE scheme to which the KP-ABE scheme described in Embodiment 1 is applied will be described herein.
In the KP-ABE scheme described in Embodiment 1, the elements (C1,j, C2,j) of the ciphertext are associated with the elements {k*i}i=1, . . . , L of the decryption key. In the KP-FE scheme, elements (C1,j,t, C2,j,t) of a ciphertext and elements {k*i,t}i=1, . . . , L of a decryption key are generated for each category t. Then, the elements (C1,j,t, C2,j,t) of the ciphertext are associated with the elements {k*i,t}i=1, . . . , L of the decryption key.
The configurations of a key generation device 100, an encryption device 200, and a decryption device 300 are the same as the configurations of the key generation device 100, the encryption device 200, and the decryption device 300 according to Embodiment 1 illustrated in FIG. 6 to FIG. 8, respectively.
The process of each algorithm has the same flow as that of the process of each algorithm according to Embodiment 1 illustrated in FIG. 9 to FIG. 12.
With reference to FIG. 9, the process of the Setup algorithm will be described.
(S101: Space Generation Step)
The space generation part 111 generates a parameter paramG:=(q, G, GT, g, e), similarly as in Embodiment 1.
Further, the space generation part 111 sets N0:=5 and N1,t:=6nt for each integer t=1, . . . , d, where d is the value representing the number of attribute categories and an integer of 1 or greater, and nt is an integer of 1 or greater. Then, with the processing device, the space generation part 111 executes Gdpvs taking as input a security parameter 1λ, N0, and the parameter paramG of symmetric bilinear pairing groups, and thereby generates a parameter param v0:=(q, V0, GT, A, e) of dual pairing vector spaces. With the processing device, the space generation part 111 also executes Gdpvs taking as input the security parameter 1λ, N1,t, and the parameter paramG of symmetric bilinear pairing groups for each integer t=1, . . . , d, and thereby generates a parameter paramV1,t:=(q, V1,t, GT, A, e) of dual pairing vector spaces.
(S102: Linear Transformation Generation Step)
With the processing device, the matrix generation part 112 generates a linear transformation X0 and a linear transformation {X1,t}t=1, . . . , d.
The linear transformation X0 is the same as that in Embodiment 1. The linear transformation {X1,t}t−1, . . . , d is generated as indicated in Formula 177.




  
    
      
        
          
            
              X
              
                1
                ,
                t
              
            
            ⁢
            
              ←
              U
            
            ⁢
            
              
                L
                ⁡
                
                  (
                  
                    6
                    ,
                    
                      n
                      t
                    
                    ,
                    
                      F
                      q
                    
                  
                  )
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              t
            
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        d
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          177
        
        ]
      
    
  




In the following, {μi,j,t, μ′i,j,L,t}i,j=1, . . . , 6; L=1, . . . , n denotes non-zero elements in the linear transformation X1,t.
(S103: Basis B Generation Step)
With the processing device, the basis generation part 113 generates a basis B0, a variable Bi,j,t, and a variable B′i,j,L,t, as indicated in Formula 178.




  
    
      
        
          
            b
            
              0
              ,
              i
            
          
          :=
          
            
              
                (
                
                  
                    χ
                    
                      0
                      ,
                      i
                      ,
                      1
                      ,
                      
                        
                      
                      ⁢
                      ...
                      ⁢
                      
                        
                      
                      ,
                    
                  
                  ⁢
                  
                    χ
                    
                      0
                      ,
                      i
                      ,
                      5
                    
                  
                
                )
              
              A
            
            =
            
              
                ∑
                
                  j
                  =
                  1
                
                5
              
              ⁢
              
                
                  χ
                  
                    0
                    ,
                    i
                    ,
                    j
                  
                
                ⁢
                
                  a
                  j
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          5
          ,
          
            

          
          ⁢
          
            
              B
              0
            
            :=
            
              (
              
                
                  b
                  
                    0
                    ,
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  b
                  
                    0
                    ,
                    5
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              B
              
                i
                ,
                j
                ,
                t
              
            
            :=
            
              
                μ
                
                  i
                  ,
                  j
                  ,
                  t
                
              
              ⁢
              g
            
          
          ,
          
            
              B
              
                i
                ,
                j
                ,
                L
                ,
                t
              
              ′
            
            :=
            
              
                μ
                
                  i
                  ,
                  j
                  ,
                  L
                  ,
                  t
                
                ′
              
              ⁢
              g
              ⁢
              
                

              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
          
          ,
          
            j
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          
            6
            ;
            
              L
              =
              1
            
          
          ,
          ...
          ⁢
          
            
          
          ,
          
            
              n
              t
            
            ;
            
              t
              =
              1
            
          
          ,
          ...
          ⁢
          
            
          
          ,
          d
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          178
        
        ]
      
    
  




With the processing device, the basis generation part 113 generates a basis B*0 and a basis B*1,t, as indicated in Formula 179.

(θ0,i,j)i,j=1, . . . ,5:=ψ·(X0T)−1,

b0,i*:=(θ0,i,1, . . . ,θ0,i,5=Σj=15θ0,i,jaj for i=1, . . . ,5,

0*:=(b0,1*, . . . ,b0,5*),[Formula 179]

for t=1, . . . ,d, 

(θt,i,j)i,j=1, . . . ,N1,t:=ψ·(X1,tT)−1,

b1,i,t*:=(θ1,i,1,t, . . . ,θ1,i,N1,t,t=Σj=1N1,tθ1,i,j,taj for i=1, . . . ,N1,t,

1,t*:=(b1,1,t*, . . . ,b1,N1,t,t*)

(S104: Basis B^ Generation Step)
With the processing device, the key generation part 114 generates a basis B^0, a basis B^1,t, a basis B^*0, and a basis B^*1,t, as indicated in Formula 180.

0:=(b0,1,b0,3,b0,5),

for t=1, . . . ,d, 

1,t:=(b1,1,t, . . . b1,nt,t,b1,5nt+1,t, . . . ,b1,6nt,t)={Bi,j,t,Bi,j,L,t′}i=1,6;j=1, . . . ,L=1, . . . ,nt;t=1, . . . ,d,

0*:=(b0,1*,b0,3*,b0,4*),

for t=1, . . . ,d, 

1,t*:=(b1,1,t*, . . . ,b1,nt,t*,b1,3nt+1,t, . . . ,b1,5nt,t*)  [Formula 180]

(S105: Master Key Generation Step)
With the processing device, the key generation part 114 generates a public parameter pk:=(1λ, paramn, B^0, {B^1,t}t=1, . . . , d) and a master secret key sk:=(B^*0, {B^*1,t}t=1, . . . , d. Then, the key generation part 114 stores the public parameter pk and the master secret key sk in the master key storage part 120.

Note paramn:=(paramV0,{paramV1,t}t=1, . . . ,d,gT).

In brief, in (S101) through (S105), the key generation device 100 generates the public parameter pk and the master secret key sk by executing the Setup algorithm indicated in Formula 182, the Setup algorithm using an algorithm GFE(1)ob indicated in Formula 181.




  
    
      
        
          
            
              
            
            ⁢
            
              
                
                  
                    
                      
                        G
                        ob
                        
                          FE
                          ⁡
                          
                            (
                            1
                            )
                          
                        
                      
                      ⁡
                      
                        (
                        
                          
                            1
                            λ
                          
                          ,
                          6
                          ,
                          
                            n
                            t
                          
                        
                        )
                      
                    
                    ⁢
                    
                      :
                    
                  
                  ⁢
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      param
                      G
                    
                    :=
                    
                      
                        (
                        
                          q
                          ,
                          G
                          ,
                          
                            G
                            T
                          
                          ,
                          g
                          ,
                          e
                        
                        )
                      
                      ⁢
                      
                        ⟵
                        R
                      
                      ⁢
                      
                        
                          G
                          bpg
                        
                        ⁡
                        
                          (
                          
                            1
                            λ
                          
                          )
                        
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    N
                    0
                  
                  :=
                  5
                
                ,
                
                  
                    N
                    
                      1
                      ,
                      t
                    
                  
                  :=
                  
                    6
                    ⁢
                    
                      n
                      t
                    
                  
                
                ,
                
                  
                    for
                    ⁢
                    
                      
                    
                    ⁢
                    t
                  
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
                ,
                
                  

                
                ⁢
                
                  
                    param
                    
                      V
                      0
                    
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        
                          V
                          t
                        
                        ,
                        
                          G
                          T
                        
                        ,
                        A
                        ,
                        e
                      
                      )
                    
                    :=
                    
                      
                        G
                        dpvs
                      
                      ⁡
                      
                        (
                        
                          
                            1
                            λ
                          
                          ,
                          
                            N
                            0
                          
                          ,
                          
                            param
                            G
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    param
                    
                      V
                      
                        1
                        ,
                        t
                      
                    
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        
                          V
                          t
                        
                        ,
                        
                          G
                          T
                        
                        ,
                        A
                        ,
                        e
                      
                      )
                    
                    :=
                    
                      
                        
                          
                            G
                            dpvs
                          
                          ⁡
                          
                            (
                            
                              
                                1
                                λ
                              
                              ,
                              
                                N
                                
                                  1
                                  ,
                                  t
                                
                              
                              ,
                              
                                param
                                G
                              
                            
                            )
                          
                        
                        ⁢
                        
                          
                        
                        ⁢
                        for
                        ⁢
                        
                          
                        
                        ⁢
                        t
                      
                      =
                      1
                    
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
                ,
                
                  

                
                ⁢
                
                  ψ
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                    x
                  
                
                ,
                
                  
                    g
                    T
                  
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          g
                          ,
                          g
                        
                        )
                      
                    
                    ψ
                  
                
                ,
                
                  
                    param
                    n
                  
                  :=
                  
                    (
                    
                      
                        param
                        
                          V
                          0
                        
                      
                      ,
                      
                        
                          {
                          
                            param
                            
                              V
                              
                                1
                                ,
                                t
                              
                            
                          
                          }
                        
                        
                          
                            t
                            =
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          d
                        
                      
                      ,
                      
                        g
                        T
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    X
                    0
                  
                  :=
                  
                    
                      
                        (
                        
                          χ
                          
                            0
                            ,
                            i
                            ,
                            j
                          
                        
                        )
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ,
                        5
                      
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      GL
                      ⁡
                      
                        (
                        
                          
                            N
                            
                              0
                              ,
                            
                          
                          ⁢
                          
                            F
                            q
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        X
                        
                          1
                          ,
                          t
                        
                      
                      ⁢
                      
                        ⟵
                        U
                      
                      ⁢
                      
                        L
                        ⁡
                        
                          (
                          
                            6
                            ,
                            
                              n
                              t
                            
                            ,
                            
                              F
                              q
                            
                          
                          )
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    for
                    ⁢
                    
                      
                    
                    ⁢
                    t
                  
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                hereafter
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    {
                    
                      
                        μ
                        
                          i
                          ,
                          j
                          ,
                          t
                        
                      
                      ,
                      
                        μ
                        
                          i
                          ,
                          j
                          ,
                          L
                          ,
                          t
                        
                        ′
                      
                    
                    }
                  
                  
                    i
                    ,
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ,
                    
                      6
                      ;
                      
                        L
                        =
                        1
                      
                    
                    ,
                    ...
                    ,
                    
                      
                        n
                        t
                      
                      ;
                      
                        t
                        =
                        1
                      
                    
                    ,
                    ...d
                  
                
              
              ⁢
              
                
              
              ⁢
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  denotes
                  ⁢
                  
                    
                  
                  ⁢
                  non
                  ⁢
                  
                    -
                  
                  ⁢
                  zero
                  ⁢
                  
                    
                  
                  ⁢
                  entries
                  ⁢
                  
                    
                  
                  ⁢
                  of
                  ⁢
                  
                    
                  
                  ⁢
                  
                    X
                    
                      1
                      ,
                      t
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    b
                    
                      0
                      ,
                      i
                    
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            χ
                            
                              0
                              ,
                              i
                              ,
                              1
                              ,
                              ...
                              ,
                            
                          
                          ⁢
                          
                            χ
                            
                              0
                              ,
                              i
                              ,
                              5
                            
                          
                        
                        )
                      
                      A
                    
                    =
                    
                      
                        ∑
                        
                          j
                          =
                          1
                        
                        5
                      
                      ⁢
                      
                        
                          χ
                          
                            0
                            ,
                            i
                            ,
                            j
                          
                        
                        ⁢
                        
                          a
                          j
                        
                      
                    
                  
                
              
            
            ⁢
            
              
            
            ⁢
            
              

            
            ⁢
            
              
            
             
          
          ⁢
          
             
            
              
                
                  for
                  ⁢
                  
                    
                  
                  ⁢
                  i
                
                =
                1
              
              ,
              ...
              ⁢
              
                
              
              ,
              5
              ,
              
                
                  B
                  0
                
                :=
                
                  (
                  
                    
                      b
                      
                        0
                        ,
                        1
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        0
                        ,
                        5
                      
                    
                  
                  )
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  B
                  
                    i
                    ,
                    j
                    ,
                    t
                  
                
                :=
                
                  
                    μ
                    
                      i
                      ,
                      j
                      ,
                      t
                    
                  
                  ⁢
                  g
                
              
              ,
              
                
                  B
                  
                    i
                    ,
                    j
                    ,
                    L
                    ,
                    t
                  
                  ′
                
                :=
                
                  
                
                ⁢
                
                  
                    μ
                    
                      i
                      ,
                      j
                      ,
                      L
                      ,
                      t
                    
                    ′
                  
                  ⁢
                  g
                
              
            
            ⁢
            
              
            
             
          
        
        ⁢
        
          

        
        ⁢
        
           
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            ,
            
              j
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                L
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              
                n
                t
              
              ;
              
                t
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              
                
                  d
                  ⁢
                  
                    

                  
                  ⁢
                  
                    
                  
                  (
                  
                    θ
                    
                      0
                      ,
                      i
                      ,
                      j
                    
                  
                  )
                
                
                  i
                  ,
                  
                    j
                    =
                    1
                  
                  ,
                  ...
                  ,
                  5
                
              
              :=
              
                ψ
                ·
                
                  
                    (
                    
                      X
                      0
                      T
                    
                    )
                  
                  
                    -
                    1
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
                b
                
                  0
                  ,
                  i
                
                *
              
              :=
              
                
                  
                    (
                    
                      
                        θ
                        
                          0
                          ,
                          i
                          ,
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        θ
                        
                          0
                          ,
                          i
                          ,
                          5
                        
                      
                    
                    )
                  
                  A
                
                =
                
                  
                    ∑
                    
                      j
                      =
                      1
                    
                    5
                  
                  ⁢
                  
                    
                      θ
                      
                        0
                        ,
                        i
                        ,
                        j
                      
                    
                    ⁢
                    
                      a
                      j
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                       
                      
                        
                          
                            for
                            ⁢
                            
                              
                            
                            ⁢
                            i
                          
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        5
                        ,
                        
                          

                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            B
                            0
                            *
                          
                          :=
                          
                            (
                            
                              
                                b
                                
                                  0
                                  ,
                                  1
                                
                                *
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                b
                                
                                  0
                                  ,
                                  5
                                
                                *
                              
                            
                            )
                          
                        
                        ,
                        
                          

                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            for
                            ⁢
                            
                              
                            
                            ⁢
                            t
                          
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          
                            
                              d
                              ⁢
                              
                                

                              
                              ⁢
                              
                                
                              
                              (
                              
                                θ
                                
                                  t
                                  ,
                                  i
                                  ,
                                  j
                                
                              
                              )
                            
                            
                              i
                              ,
                              
                                j
                                =
                                1
                              
                              ,
                              ...
                              ,
                              
                                N
                                
                                  1
                                  ,
                                  t
                                
                              
                            
                          
                          :=
                          
                            ψ
                            ·
                            
                              
                                (
                                
                                  X
                                  
                                    1
                                    ,
                                    t
                                  
                                  T
                                
                                )
                              
                              
                                -
                                1
                              
                            
                          
                        
                        ,
                        
                          

                        
                        ⁢
                        
                          
                            b
                            
                              1
                              ,
                              i
                              ,
                              t
                            
                            *
                          
                          :=
                          
                            
                              
                                (
                                
                                  
                                    θ
                                    
                                      1
                                      ,
                                      i
                                      ,
                                      1
                                      ,
                                      t
                                    
                                  
                                  ,
                                  ...
                                  ⁢
                                  
                                    
                                  
                                  ,
                                  
                                    θ
                                    
                                      1
                                      ,
                                      i
                                      ,
                                      
                                        N
                                        
                                          1
                                          ,
                                          t
                                        
                                      
                                      ,
                                      t
                                    
                                  
                                
                                )
                              
                              A
                            
                            =
                            
                              
                                ∑
                                
                                  j
                                  =
                                  1
                                
                                
                                  N
                                  
                                    1
                                    ,
                                    t
                                  
                                
                              
                              ⁢
                              
                                
                                  θ
                                  
                                    1
                                    ,
                                    i
                                    ,
                                    j
                                    ,
                                    t
                                  
                                
                                ⁢
                                
                                  a
                                  j
                                
                              
                            
                          
                        
                      
                      ⁢
                      
                        
                      
                       
                    
                    ⁢
                    
                       
                      
                        
                          
                            for
                            ⁢
                            
                              
                            
                            ⁢
                            i
                          
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          N
                          
                            1
                            ,
                            t
                          
                        
                        ,
                        
                          

                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            B
                            
                              1
                              ,
                              i
                              ,
                              t
                            
                            *
                          
                          :=
                          
                            (
                            
                              
                                b
                                
                                  1
                                  ,
                                  1
                                  ,
                                  t
                                
                                *
                              
                              ,
                              ...
                              ⁢
                              
                                
                              
                              ,
                              
                                b
                                
                                  1
                                  ,
                                  
                                    N
                                    
                                      1
                                      ,
                                      t
                                    
                                  
                                  ,
                                  t
                                
                                *
                              
                            
                            )
                          
                        
                        ,
                        
                          

                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          return
                          ⁢
                          
                            
                          
                          ⁢
                          
                            
                              (
                              
                                
                                  param
                                  n
                                
                                ,
                                
                                  B
                                  0
                                
                                ,
                                
                                  B
                                  0
                                  *
                                
                                ,
                                
                                  

                                
                                ⁢
                                
                                  
                                
                                ⁢
                                
                                  
                                    {
                                    
                                      
                                        B
                                        
                                          i
                                          ,
                                          j
                                          ,
                                          t
                                        
                                      
                                      ,
                                      
                                        B
                                        
                                          i
                                          ,
                                          j
                                          ,
                                          L
                                          ,
                                          t
                                        
                                        ′
                                      
                                    
                                    }
                                  
                                  
                                    i
                                    ,
                                    
                                      j
                                      =
                                      1
                                    
                                    ,
                                    ...
                                    ,
                                    
                                      6
                                      ;
                                      
                                        
                                      
                                      ⁢
                                      
                                        L
                                        =
                                        1
                                      
                                    
                                    ,
                                    ...
                                    ,
                                    
                                      
                                        n
                                        t
                                      
                                      ;
                                      
                                        t
                                        =
                                        1
                                      
                                    
                                    ,
                                    ...
                                    ,
                                    d
                                  
                                
                                ,
                                
                                  
                                
                                ⁢
                                
                                  B
                                  
                                    1
                                    ,
                                    t
                                  
                                  *
                                
                              
                              ⁢
                              
                                
                              
                              )
                            
                            ⁢
                            
                              
                            
                            .
                          
                        
                      
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          181
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              Setup
              ⁡
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  
                    n
                    t
                  
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    B
                    0
                  
                  ,
                  
                    B
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            t
                          
                        
                        ,
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            L
                            ,
                            t
                          
                          ′
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      ...
                      ,
                      
                        
                          n
                          t
                        
                        ;
                        
                          t
                          =
                          1
                        
                      
                      ,
                      ...
                      ,
                      d
                    
                  
                  ,
                  
                    B
                    
                      1
                      ,
                      t
                    
                    *
                  
                
                )
              
              ⁢
              
                ⟵
                R
              
              ⁢
              
                
                  G
                  ob
                  
                    FE
                    ⁡
                    
                      (
                      1
                      )
                    
                  
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    
                      n
                      t
                    
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      5
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                for
                ⁢
                
                  
                
                ⁢
                t
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            d
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  
                    
                      
                        B
                        ^
                      
                      
                        1
                        ,
                        t
                      
                    
                    :=
                    
                    ⁢
                    
                      (
                      
                        
                          b
                          
                            1
                            ,
                            1
                            ,
                            t
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          b
                          
                            1
                            ,
                            
                              n
                              t
                            
                            ,
                            t
                          
                        
                        ,
                        
                          b
                          
                            1
                            ,
                            
                              
                                5
                                ⁢
                                
                                  n
                                  t
                                
                              
                              +
                              1
                            
                            ,
                            t
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          b
                          
                            1
                            ,
                            
                              6
                              ⁢
                              
                                n
                                t
                              
                            
                            ,
                            t
                          
                        
                      
                      )
                    
                  
                
              
              
                
                  
                    
                      =
                      
                      ⁢
                      
                        
                          {
                          
                            
                              B
                              
                                i
                                ,
                                j
                                ,
                                t
                              
                            
                            ,
                            
                              B
                              
                                i
                                ,
                                j
                                ,
                                L
                                ,
                                t
                              
                              ′
                            
                          
                          }
                        
                        
                          
                            i
                            =
                            1
                          
                          ,
                          
                            6
                            ;
                            
                              j
                              =
                              1
                            
                          
                          ,
                          ...
                          ,
                          
                            6
                            ;
                            
                              L
                              =
                              1
                            
                          
                          ,
                          ...
                          ,
                          
                            
                              n
                              t
                            
                            ;
                            
                              t
                              =
                              1
                            
                          
                          ,
                          ...
                          ,
                          d
                        
                      
                    
                    ,
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                
                  B
                  ^
                
                0
                *
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                    *
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      4
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                for
                ⁢
                
                  
                
                ⁢
                t
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            d
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                
                  1
                  ,
                  t
                
                *
              
              :=
              
                (
                
                  
                    b
                    
                      1
                      ,
                      1
                      ,
                      t
                    
                    *
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        n
                        t
                      
                      ,
                      t
                    
                    *
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        
                          3
                          ⁢
                          
                            n
                            t
                          
                        
                        +
                        1
                      
                      ,
                      t
                    
                    *
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        5
                        ⁢
                        
                          n
                          t
                        
                      
                      ,
                      t
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              pk
              :=
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  
                    param
                    n
                  
                  ,
                  
                    
                      
                        B
                        ^
                      
                      0
                    
                    ⁢
                    
                      
                        {
                        
                          
                            B
                            ^
                          
                          
                            1
                            ,
                            t
                          
                        
                        }
                      
                      
                        
                          t
                          =
                          1
                        
                        ,
                        ...
                        ,
                        d
                      
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              sk
              :=
              
                (
                
                  
                    
                      B
                      ^
                    
                    0
                  
                  ⁢
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        
                          1
                          ,
                          t
                        
                      
                      }
                    
                    
                      
                        t
                        =
                        1
                      
                      ,
                      ...
                      ,
                      d
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              pk
            
            ,
            
              sk
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          182
        
        ]
      
    
  




With reference to FIG. 10, the process of the KeyGen algorithm will be described.
The process of (S201) through (S202) is the same as that in Embodiment 1.
(S203: s Vector Generation Step)
With the processing device, the s vector generation part 142 generates a vector {right arrow over (s)}T:=(s1, . . . , sL)T, as indicated in Formula 183.

{right arrow over (s)}T:=(s1, . . . ,sL)T:=M·{right arrow over (f)}T  [Formula 183]

With the processing device, the s vector generation part 142 also generates a value s0, as indicated in Formula 184.

s0:={right arrow over (1)}·{right arrow over (f)}T  [Formula 184]

(S204: Random Number Generation Step)
With the processing device, the random number generation part 143 generates random numbers, as indicated in Formula 185.




  
    
      
        
          
            
              η
              0
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              
                
                  
                    η
                    ->
                  
                  i
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                  
                    2
                    ⁢
                    
                      n
                      t
                    
                  
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            

          
          ⁢
          
            
              
                
                  θ
                  i
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
        
        ⁢
        
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          185
        
        ]
      
    
  




(S205: Key Element Generation Step)
With the processing device, the key element generation part 144 generates an element k*0 of a decryption key skS, similarly as in Embodiment 1.
With the processing device, the key element generation part 144 also generates an element k*i of the decryption key skS for each integer i=1, . . . , L and an index t included in a set Ivi→, as indicated in Formula 186.




  
    
      
        
          
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            (
            
              t
              ,
              
                v
                i
              
            
            )
          
        
        ,
        
          
            
              v
              ->
            
            i
          
          :=
          
            (
            
              
                v
                i
                
                  
                    n
                    t
                  
                  -
                  1
                
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                v
                i
              
              ,
              1
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              (
              
                
                  
                    
                      
                        
                          s
                          i
                        
                        ⁢
                        
                          
                            e
                            ->
                          
                          
                            1
                            ,
                            t
                          
                        
                      
                      +
                      
                        
                          θ
                          i
                        
                        ⁢
                        
                          
                            v
                            ->
                          
                          i
                        
                      
                    
                    ,
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        
                          n
                          t
                        
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ⁢
                
                  
                    
                      
                        η
                        ->
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ⁢
                
                  
                    0
                    
                      n
                      t
                    
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
              
              )
            
            
              B
              
                1
                ,
                t
              
              *
            
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              (
              
                t
                ,
                
                  v
                  i
                
              
              )
            
          
        
        ,
        
          
            
              v
              ->
            
            i
          
          :=
          
            (
            
              
                v
                i
                
                  
                    n
                    t
                  
                  -
                  1
                
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                v
                i
              
              ,
              1
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              (
              
                
                  
                    
                      
                        s
                        i
                      
                      ⁢
                      
                        
                          v
                          ->
                        
                        i
                      
                    
                    ,
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
                ⁢
                
                  
                    
                      0
                      
                        2
                        ⁢
                        
                          n
                          t
                        
                      
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ⁢
                
                  
                    
                      
                        η
                        ->
                      
                      i
                    
                    ,
                  
                  
                    {
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ⁢
                
                  
                    0
                    
                      n
                      t
                    
                  
                  
                    {
                    
                      n
                      t
                    
                  
                
              
              )
            
            
              B
              
                1
                ,
                t
              
              *
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          186
        
        ]
      
    
  




The process of(S206) is the same as that in Embodiment 1.
In brief, in (S201) through (S205), the key generation device 100 generates the decryption key skS by executing the KeyGen algorithm indicated in Formula 187. In (S206), the key generation device 100 transmits the generated decryption key skS to the decryption device 300.




  
    
      
        
          
        
        ⁢
        
          
            
              
                
                  KeyGen
                  ⁡
                  
                    (
                    
                      pk
                      ,
                      sk
                      ,
                      
                        S
                        =
                        
                          (
                          
                            M
                            ,
                            ρ
                          
                          )
                        
                      
                    
                    )
                  
                
                ⁢
                
                  :
                
              
              ⁢
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  
                    f
                    ->
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                    r
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      s
                      ->
                    
                    T
                  
                  :=
                  
                    
                      
                        (
                        
                          
                            s
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            s
                            L
                          
                        
                        )
                      
                      T
                    
                    :=
                    
                      M
                      ·
                      
                        
                          f
                          ->
                        
                        T
                      
                    
                  
                
                ,
                
                  
                    s
                    0
                  
                  :=
                  
                    
                      1
                      ->
                    
                    ·
                    
                      
                        f
                        ->
                      
                      T
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    η
                    0
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    k
                    0
                    *
                  
                  :=
                  
                    
                      (
                      
                        
                          -
                          
                            s
                            0
                          
                        
                        ,
                        0
                        ,
                        1
                        ,
                        
                          η
                          0
                        
                        ,
                        0
                      
                      )
                    
                    
                      B
                      0
                      *
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    for
                    ⁢
                    
                      
                    
                    ⁢
                    i
                  
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                L
                ,
                
                  t
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    if
                    ⁢
                    
                      
                    
                    ⁢
                    
                      ρ
                      ⁡
                      
                        (
                        i
                        )
                      
                    
                  
                  =
                  
                    (
                    
                      t
                      ,
                      
                        v
                        i
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        
                          
                        
                        ⁢
                        v
                      
                      
                        
                          
                        
                        ->
                      
                    
                    i
                  
                  :=
                  
                    (
                    
                      
                        v
                        i
                        
                          
                            n
                            t
                          
                          -
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        v
                        i
                      
                      ,
                      1
                    
                    )
                  
                
                ,
                
                  
                    θ
                    i
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                  
                
                ,
                
                  
                    
                      η
                      ->
                    
                    i
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    k
                    i
                    *
                  
                  :=
                  
                    
                      (
                      
                        
                          
                            
                              
                                
                                  s
                                  i
                                
                                ⁢
                                
                                  
                                    e
                                    ->
                                  
                                  
                                    1
                                    ,
                                    t
                                  
                                
                              
                              +
                              
                                
                                  θ
                                  i
                                
                                ⁢
                                
                                  
                                    v
                                    ->
                                  
                                  i
                                
                              
                            
                            ,
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                        ⁢
                        
                          
                            
                              0
                              
                                2
                                ⁢
                                
                                  n
                                  t
                                
                              
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              
                                n
                                t
                              
                            
                          
                        
                        ⁢
                        
                          
                            
                              
                                η
                                ->
                              
                              i
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              
                                n
                                t
                              
                            
                          
                        
                        ⁢
                        
                          
                            0
                            
                              n
                              t
                            
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                      
                      )
                    
                    
                      B
                      
                        1
                        ,
                        t
                      
                      *
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    if
                    ⁢
                    
                      
                    
                    ⁢
                    ρ
                    ⁢
                    
                      (
                      i
                      )
                    
                  
                  =
                  
                    ⫬
                    
                      (
                      
                        t
                        ,
                        
                          v
                          i
                        
                      
                      )
                    
                  
                
                ,
                
                  
                    
                      v
                      ->
                    
                    i
                  
                  :=
                  
                    (
                    
                      
                        v
                        i
                        
                          
                            n
                            t
                          
                          -
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        v
                        i
                      
                      ,
                      1
                    
                    )
                  
                
                ,
                
                  
                    
                      η
                      ->
                    
                    i
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                    
                      2
                      ⁢
                      
                        n
                        t
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    k
                    i
                    *
                  
                  :=
                  
                    
                      (
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                i
                              
                            
                            ,
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                        ⁢
                        
                          
                            
                              0
                              
                                2
                                ⁢
                                
                                  n
                                  t
                                
                              
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              
                                n
                                t
                              
                            
                          
                        
                        ⁢
                        
                          
                            
                              
                                η
                                ->
                              
                              i
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              
                                n
                                t
                              
                            
                          
                        
                        ⁢
                        
                          
                            0
                            
                              n
                              t
                            
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                      
                      )
                    
                    
                      B
                      
                        1
                        ,
                        t
                      
                      *
                    
                  
                
              
            
            ⁢
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                sk
                S
              
              :=
              
                (
                
                  S
                  ,
                  
                    k
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        k
                        i
                        *
                      
                      }
                    
                    
                      
                        i
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      L
                    
                  
                
                )
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                sk
                S
              
              .
            
          
        
        ⁢
        
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          187
        
        ]
      
    
  




With reference to FIG. 11, the process of the Enc algorithm will be described.
The process of (S301) is the same as that in Embodiment 1.
(S302: Information Input Step)
With the input device, the information input part 220 takes as input a message m to be transmitted to the decryption device 300. With the input device, the information input part 220 also takes as input an attribute set Γt:={x1,t, . . . , xnt,t, nt′≦nt−1, t=1, . . . , d}.
(S303: Random Number Generation Step)
With the processing device, the random number generation part 231 generates random numbers, as indicated in Formula 188.




  
    
      
        ω
        ,
        
          φ
          0
        
        ,
        
          ζ
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                φ
                
                  1
                  ,
                  t
                
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ⁢
            
              
            
            ⁢
            t
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        d
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          188
        
        ]
      
    
  




(S304: Cipher Element Generation Step)
With the processing device, the cipher element generation part 232 generates an element c0 and an element c3 of a ciphertext ctΓ, similarly as in Embodiment 1.
With the processing device, the cipher element generation part 232 also generates elements C1,j,t and C2,j,t of the ciphertext ctΓ, as indicated in Formula 189.
for j=1, . . . , 6; t=1, . . . , d

C1,j,t:=ωB1,j,t+η1,tB6,j,t,

C2,j,t:=ΣL=1ntyL,t(ωB1,j,L,t′+φ1B6,j,L,t′)  [Formula 189]

where

{right arrow over (y)}t:=(y1,t, . . . ,ynt,t) such that Σj=0nt−1ynt-j,tzj=znt−1-jnt′·Πj=1nt′(z−xj,t)

The process of (S305) is the same as that in Embodiment 1.
In brief, in (S301) through (S304), the encryption device 200 generates the ciphertext ctF by executing the Enc algorithm indicated in Formula 190. In (S305), the encryption device 200 transmits the generated ciphertext ctΓ to the decryption device 300.




  
    
      
        
          
            Enc
            (
            
              pk
              ,
              
                
              
              ⁢
              m
              ,
              
                
              
              ⁢
              
                
                  Γ
                  t
                
                =
              
            
             
          
          ⁢
          
             
            
              {
              
                
                  x
                  
                    1
                    ,
                    t
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  
                    
                      x
                      
                        
                          n
                          t
                          ′
                        
                        ,
                        
                          
                        
                        ⁢
                        t
                        ,
                      
                    
                    ⁢
                    
                      n
                      t
                      ′
                    
                  
                  ≤
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ,
                
                  t
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
              
              }
            
            )
          
          ⁢
          
            :
          
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          ω
          ,
          
            φ
            0
          
          ,
          
            ζ
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            
              
                
                  φ
                  
                    1
                    ,
                    t
                  
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
              ⁢
              
                
              
              ⁢
              t
            
            =
            1
          
          ,
          ...
          ,
          ,
          d
          ,
          
            

          
          ⁢
          
            
              
                y
                ->
              
              t
            
            :=
            
              
                
                  (
                  
                    
                      y
                      
                        1
                        ,
                        t
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      y
                      
                        
                          n
                          t
                        
                        ,
                        t
                      
                    
                  
                  )
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
                ⁢
                
                  
                
                ⁢
                
                  
                    ∑
                    
                      j
                      =
                      0
                    
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      y
                      
                        
                          
                            n
                            t
                          
                          -
                          j
                        
                        ,
                        t
                      
                    
                    ⁢
                    
                      z
                      j
                    
                  
                
              
              =
              
                
                  z
                  
                    
                      n
                      t
                    
                    -
                    1
                    -
                    
                      n
                      t
                      ′
                    
                  
                
                ·
                
                  
                    ∏
                    
                      j
                      =
                      1
                    
                    
                      n
                      t
                      ′
                    
                  
                  ⁢
                  
                    (
                    
                      z
                      -
                      
                        x
                        
                          j
                          ,
                          t
                        
                      
                    
                    )
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              c
              0
            
            :=
            
              
                (
                
                  ω
                  ,
                  0
                  ,
                  ζ
                  ,
                  0
                  ,
                  
                    φ
                    0
                  
                
                )
              
              
                B
                0
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              j
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          
            6
            ;
            
              t
              =
              1
            
          
          ,
          ...
          ⁢
          
            
          
          ,
          d
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          
            
              C
              
                1
                ,
                j
                ,
                t
              
            
            :=
            
              
                ω
                ⁢
                
                  
                
                ⁢
                
                  B
                  
                    1
                    ,
                    j
                    ,
                    t
                  
                
              
              +
              
                
                  η
                  
                    1
                    ,
                    t
                  
                
                ⁢
                
                  B
                  
                    6
                    ,
                    j
                    ,
                    t
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              C
              
                2
                ,
                j
                ,
                t
              
            
            :=
            
              
                ∑
                
                  L
                  =
                  1
                
                
                  n
                  t
                
              
              ⁢
              
                
                  y
                  
                    L
                    ,
                    t
                  
                
                ⁡
                
                  (
                  
                    
                      ω
                      ⁢
                      
                        
                      
                      ⁢
                      
                        B
                        
                          1
                          ,
                          j
                          ,
                          L
                          ,
                          t
                        
                        ′
                      
                    
                    +
                    
                      
                        φ
                        1
                      
                      ⁢
                      
                        B
                        
                          6
                          ,
                          j
                          ,
                          L
                          ,
                          t
                        
                        ′
                      
                    
                  
                  )
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              c
              3
            
            :=
            
              
                g
                T
                ζ
              
              ⁢
              m
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              ct
              Γ
            
            :=
            
              (
              
                
                  Γ
                  t
                
                ,
                
                  c
                  0
                
                ,
                
                  
                    {
                    
                      
                        C
                        
                          1
                          ,
                          j
                          ,
                          t
                        
                      
                      ,
                      
                        C
                        
                          2
                          ,
                          j
                          ,
                          t
                        
                      
                    
                    }
                  
                  
                    
                      j
                      =
                      1
                    
                    ,
                    
                      
                    
                    ⁢
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      6
                      ;
                      
                        t
                        =
                        1
                      
                    
                    ,
                    
                      
                    
                    ⁢
                    ...
                    ⁢
                    
                      
                    
                    ,
                    d
                  
                
                ,
                
                  c
                  3
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                ct
                Γ
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          190
        
        ]
      
    
  




With reference to FIG. 12, the process of the Dec algorithm will be described.
The process of (S401) through (S404) is the same as that in Embodiment 1.
(S405: Decryption Element Generation Step)
With the processing device, the decryption part 350 generates decryption elements D*1,t, . . . , D*6n,t, and E*j,t, as indicated in Formula 191.




  
    
      
        
          
            
              
                (
                
                  
                    D
                    
                      1
                      ,
                      t
                    
                    *
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    D
                    
                      
                        6
                        ⁢
                        
                          n
                          t
                        
                      
                      ,
                      t
                    
                    *
                  
                
                )
              
              :=
              
                
                  
                    ∑
                    
                      
                        
                          i
                          ∈
                          
                            I
                            t
                          
                        
                        ⩓
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                      
                      =
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                    
                  
                  ⁢
                  
                    
                      α
                      i
                    
                    ⁢
                    
                      k
                      i
                      *
                    
                  
                
                +
                
                  
                    ∑
                    
                      
                        
                          i
                          ∈
                          
                            I
                            t
                          
                        
                        ⩓
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                      
                      =
                      
                        ⫬
                        
                          (
                          
                            t
                            ,
                            
                              v
                              i
                            
                          
                          )
                        
                      
                    
                  
                  ⁢
                  
                    
                      
                        α
                        i
                      
                      
                        
                          
                            v
                            ->
                          
                          i
                        
                        ·
                        
                          
                            y
                            ->
                          
                          t
                        
                      
                    
                    ⁢
                    
                      k
                      i
                      *
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                E
                
                  j
                  ,
                  t
                
                *
              
              :=
              
                
                  ∑
                  
                    L
                    =
                    1
                  
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    y
                    
                      
                        L
                        -
                        1
                      
                      ,
                      t
                    
                  
                  ⁢
                  
                    D
                    
                      
                        
                          
                            (
                            
                              j
                              -
                              1
                            
                            )
                          
                          ⁢
                          
                            n
                            t
                          
                        
                        +
                        L
                      
                      ,
                      t
                    
                    *
                  
                
              
            
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                j
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                t
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            d
          
        
        ⁢
        
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          191
        
        ]
      
    
  




(S406: Pairing Operation Step)
With the processing device, the decryption part 350 computes Formula 192, and thereby generates a session key K=gTζ.

K:=e(c0,k0*)·Πt=1dΠj=16(e(C1,j,t,Ej,t*)·e(C2,j,t,Djnt,t*))  [Formula 192]

The process of (S407) is the same as that in Embodiment 1.
In brief, in (S401) through (S407), the decryption device 300 generates the message m′ (=m) by executing the Dec algorithm indicated in Formula 193.




  
    
      
        
          
            
              
                
                  
                    
                      
                    
                    ⁢
                    
                      
                        
                          
                            
                              Dec
                              ⁡
                              
                                (
                                
                                  pk
                                  ,
                                  
                                    
                                      sk
                                      S
                                    
                                    :=
                                    
                                      (
                                      
                                        S
                                        ,
                                        
                                          k
                                          0
                                          *
                                        
                                        ,
                                        
                                          k
                                          1
                                          *
                                        
                                        ,
                                        ...
                                        ⁢
                                        
                                          
                                        
                                        ,
                                        
                                          k
                                          L
                                          *
                                        
                                      
                                      )
                                    
                                  
                                  ,
                                  
                                    

                                  
                                  ⁢
                                  
                                    
                                      ct
                                      Γ
                                    
                                    :=
                                    
                                      (
                                      
                                        
                                          Γ
                                          t
                                        
                                        ,
                                        
                                          c
                                          0
                                        
                                        ,
                                        
                                          
                                            {
                                            
                                              
                                                C
                                                
                                                  1
                                                  ,
                                                  j
                                                  ,
                                                  t
                                                
                                              
                                              ,
                                              
                                                C
                                                
                                                  2
                                                  ,
                                                  j
                                                  ,
                                                  t
                                                
                                              
                                            
                                            }
                                          
                                          
                                            
                                              j
                                              =
                                              1
                                            
                                            ,
                                            ...
                                            ⁢
                                            
                                              
                                            
                                            ,
                                            
                                              6
                                              ;
                                              
                                                t
                                                =
                                                1
                                              
                                            
                                            ,
                                            ...
                                            ⁢
                                            
                                              
                                            
                                            ,
                                            d
                                          
                                        
                                        ,
                                        
                                          c
                                          3
                                        
                                      
                                      )
                                    
                                  
                                
                                )
                              
                            
                            ⁢
                            
                              :
                            
                          
                          ⁢
                          
                            

                          
                          ⁢
                          
                            
                              If
                              ⁢
                              
                                
                              
                              ⁢
                              S
                              ⁢
                              
                                
                              
                              ⁢
                              accepts
                              ⁢
                              
                                
                              
                              ⁢
                              Γ
                            
                            ,
                            
                              then
                              ⁢
                              
                                
                              
                              ⁢
                              compute
                              ⁢
                              
                                
                              
                              ⁢
                              I
                              ⁢
                              
                                
                              
                              ⁢
                              and
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  {
                                  
                                    α
                                    i
                                  
                                  }
                                
                                
                                  i
                                  ∈
                                  I
                                
                              
                              ⁢
                              
                                
                              
                              ⁢
                              such
                              ⁢
                              
                                
                              
                              ⁢
                              that
                            
                            ,
                            
                              

                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                1
                                ->
                              
                              =
                              
                                
                                  ∑
                                  
                                    i
                                    ∈
                                    I
                                  
                                
                                ⁢
                                
                                  
                                    α
                                    i
                                  
                                  ⁢
                                  
                                    M
                                    i
                                  
                                
                              
                            
                          
                          ⁢
                          
                            

                          
                          ⁢
                          
                            
                          
                          ⁢
                          where
                          ⁢
                          
                            
                          
                          ⁢
                          
                            M
                            i
                          
                          ⁢
                          
                            
                          
                          ⁢
                          is
                          ⁢
                          
                            
                          
                          ⁢
                          the
                          ⁢
                          
                            
                          
                          ⁢
                          i
                          ⁢
                          
                            -
                          
                          ⁢
                          th
                          ⁢
                          
                            
                          
                          ⁢
                          row
                          ⁢
                          
                            
                          
                          ⁢
                          of
                          ⁢
                          
                            
                          
                          ⁢
                          M
                        
                        ,
                        and
                      
                      ⁢
                      
                        

                      
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          I
                          ⊆
                          
                            {
                            
                              
                                i
                                ∈
                                
                                  {
                                  
                                    1
                                    ,
                                    ...
                                    ⁢
                                    
                                      
                                    
                                    ,
                                    L
                                  
                                  }
                                
                              
                              |
                              
                                
                                  
                                    [
                                    
                                      
                                        ρ
                                        ⁡
                                        
                                          (
                                          i
                                          )
                                        
                                      
                                      =
                                    
                                     
                                  
                                  ⁢
                                  
                                    (
                                    
                                      t
                                      ,
                                      
                                        v
                                        i
                                      
                                    
                                    )
                                  
                                
                                ⩓
                                
                                  
                                    v
                                    i
                                  
                                  ∈
                                  
                                    Γ
                                    t
                                  
                                
                              
                            
                            ]
                          
                        
                        ⩔
                        
                           
                           
                        
                      
                    
                     
                  
                   
                
                [
                
                  
                
                ⁢
                
                  
                    ρ
                    ⁡
                    
                      (
                      i
                      )
                    
                  
                  =
                  
                    
                      ⫬
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                    
                    ⩓
                    
                      
                        v
                        i
                      
                      ∉
                      
                        Γ
                        t
                      
                    
                  
                
                ]
              
              }
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                I
                t
              
              ⊆
              
                {
                
                  
                    
                      i
                      ∈
                      I
                    
                    |
                    
                      ρ
                      ⁡
                      
                        (
                        i
                        )
                      
                    
                  
                  =
                  
                    
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                      ⩔
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      ⫬
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                    
                  
                
                }
              
            
            ,
            
              

            
            ⁢
            
              
                
                  y
                  ->
                
                t
              
              :=
              
                
                  
                    (
                    
                      
                        y
                        
                          1
                          ,
                          t
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        y
                        
                          
                            n
                            t
                          
                          ,
                          t
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                  
                  ⁢
                  such
                  ⁢
                  
                    
                  
                  ⁢
                  that
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      ∑
                      
                        j
                        =
                        0
                      
                      
                        
                          n
                          t
                        
                        -
                        1
                      
                    
                    ⁢
                    
                      
                        y
                        
                          
                            
                              n
                              t
                            
                            -
                            j
                          
                          ,
                          t
                        
                      
                      ⁢
                      
                        z
                        j
                      
                    
                  
                
                =
                
                  
                    z
                    
                      
                        n
                        t
                      
                      -
                      1
                      -
                      
                        n
                        t
                        ′
                      
                    
                  
                  ·
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      
                        n
                        t
                        ′
                      
                    
                    ⁢
                    
                      (
                      
                        z
                        -
                        
                          x
                          
                            j
                            ,
                            t
                          
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
                (
                
                  
                    D
                    
                      1
                      ,
                      t
                    
                    *
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    D
                    
                      
                        6
                        ⁢
                        
                          n
                          t
                        
                      
                      ,
                      t
                    
                    *
                  
                
                )
              
              :=
              
                
                  
                    ∑
                    
                      
                        
                          i
                          ∈
                          
                            I
                            t
                          
                        
                        ⩓
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                      
                      =
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                    
                  
                  ⁢
                  
                    
                      α
                      i
                    
                    ⁢
                    
                      k
                      i
                      *
                    
                  
                
                +
                
                  
                    ∑
                    
                      
                        
                          i
                          ∈
                          
                            I
                            t
                          
                        
                        ⩓
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                      
                      =
                      
                        ⫬
                        
                          (
                          
                            t
                            ,
                            
                              v
                              i
                            
                          
                          )
                        
                      
                    
                  
                  ⁢
                  
                    
                      
                        α
                        i
                      
                      
                        
                          
                            v
                            ->
                          
                          i
                        
                        ·
                        
                          
                            y
                            ->
                          
                          t
                        
                      
                    
                    ⁢
                    
                      k
                      i
                      *
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                E
                
                  j
                  ,
                  t
                
                *
              
              :=
              
                
                  ∑
                  
                    L
                    =
                    1
                  
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    y
                    
                      
                        L
                        -
                        1
                      
                      ,
                      t
                    
                  
                  ⁢
                  
                    D
                    
                      
                        
                          
                            (
                            
                              j
                              -
                              1
                            
                            )
                          
                          ⁢
                          
                            n
                            t
                          
                        
                        +
                        L
                      
                      ,
                      t
                    
                    *
                  
                
              
            
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                j
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                t
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            d
            ,
            
              

            
            ⁢
            
              K
              :=
              
                
                  e
                  ⁡
                  
                    (
                    
                      
                        c
                        0
                      
                      ,
                      
                        k
                        0
                        *
                      
                    
                    )
                  
                
                ·
                
                  
                    ∏
                    
                      t
                      =
                      1
                    
                    d
                  
                  ⁢
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      6
                    
                    ⁢
                    
                      (
                      
                        
                          e
                          ⁡
                          
                            (
                            
                              
                                C
                                
                                  1
                                  ,
                                  j
                                  ,
                                  t
                                
                              
                              ,
                              
                                E
                                
                                  j
                                  ,
                                  t
                                
                                *
                              
                            
                            )
                          
                        
                        ·
                        
                          
                        
                        ⁢
                        
                          e
                          ⁡
                          
                            (
                            
                              
                                C
                                
                                  2
                                  ,
                                  j
                                  ,
                                  t
                                
                              
                              ,
                              
                                D
                                
                                  
                                    jn
                                    t
                                  
                                  ,
                                  t
                                
                                *
                              
                            
                            )
                          
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                return
                ⁢
                
                  
                
                ⁢
                
                  m
                  ′
                
              
              :=
              
                
              
              ⁢
              
                
                  c
                  3
                
                /
                
                  K
                  .
                
              
            
          
        
        ⁢
        
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          193
        
        ]
      
    
  




The KP-FE scheme to which the KP-ABE scheme described in Embodiment 1 is applied has been described herein. A CP-FE scheme to which the CP-ABE scheme described in Embodiment 2 is applied can also be constructed in a similar manner. Each algorithm of the CP-FE scheme to which the CP-ABE scheme described in Embodiment 2 is applied is as indicated in Formula 194 through Formula 198.




  
    
      
        
          
            
              
                
                  G
                  ob
                  
                    FE
                    ⁡
                    
                      (
                      2
                      )
                    
                  
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    
                      n
                      t
                    
                  
                  )
                
              
              ⁢
              
                :
              
            
            ⁢
            
              

            
            ⁢
            
              
                
                  (
                  
                    
                      param
                      n
                    
                    ,
                    
                      D
                      0
                    
                    ,
                    
                      D
                      0
                      *
                    
                    ,
                    
                      
                        {
                        
                          
                            D
                            
                              i
                              ,
                              j
                              ,
                              t
                            
                          
                          ,
                          
                            D
                            
                              i
                              ,
                              j
                              ,
                              L
                              ,
                              t
                            
                            ′
                          
                        
                        }
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ,
                        
                          6
                          ;
                          
                            L
                            =
                            1
                          
                        
                        ,
                        ...
                        ,
                        
                          
                            n
                            t
                          
                          ;
                          
                            t
                            =
                            1
                          
                        
                        ,
                        ...
                        ,
                        d
                      
                    
                    ,
                    
                      D
                      
                        1
                        ,
                        t
                      
                      *
                    
                  
                  )
                
                ⁢
                
                  ⟵
                  R
                
                ⁢
                
                  
                    G
                    ob
                    
                      (
                      1
                      )
                    
                  
                  ⁡
                  
                    (
                    
                      
                        1
                        λ
                      
                      ,
                      6
                      ,
                      
                        n
                        t
                      
                    
                    )
                  
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  B
                  0
                
                :=
                
                  D
                  0
                  *
                
              
              ,
              
                
                  B
                  0
                  *
                
                :=
                
                  D
                  0
                
              
              ,
              
                
                  B
                  
                    1
                    ,
                    t
                  
                
                :=
                
                  D
                  
                    1
                    ,
                    t
                  
                  *
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  B
                  
                    i
                    ,
                    j
                    ,
                    t
                  
                  *
                
                :=
                
                  
                    
                      D
                      
                        i
                        ,
                        j
                        ,
                        t
                        ,
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      B
                      
                        i
                        ,
                        j
                        ,
                        L
                        ,
                        t
                      
                      
                        ′
                        *
                      
                    
                  
                  =
                  
                    D
                    
                      i
                      ,
                      j
                      ,
                      L
                      ,
                      t
                    
                    ′
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
           
        
        ⁢
        
           
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            ,
            
              j
              =
              1
            
            ,
            
              
                ...
                ⁢
                
                  
                
                ⁢
                6
              
              ;
              
                L
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              n
              t
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              
                
                  (
                  
                    
                      param
                      n
                    
                    ,
                    
                      B
                      0
                    
                    ,
                    
                      B
                      0
                      *
                    
                    ,
                    
                      

                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        {
                        
                          
                            B
                            
                              1
                              ,
                              t
                            
                          
                          ,
                          
                            
                              {
                              
                                
                                  B
                                  
                                    i
                                    ,
                                    j
                                    ,
                                    t
                                  
                                  *
                                
                                ,
                                
                                  B
                                  
                                    i
                                    ,
                                    j
                                    ,
                                    L
                                    ,
                                    t
                                  
                                  
                                    ′
                                    *
                                  
                                
                              
                              }
                            
                            
                              i
                              ,
                              
                                j
                                =
                                1
                              
                              ,
                              ...
                              ,
                              
                                6
                                ;
                                
                                  L
                                  =
                                  1
                                
                              
                              ,
                              ...
                              ,
                              
                                n
                                t
                              
                            
                          
                        
                        }
                      
                      
                        
                          t
                          =
                          1
                        
                        ,
                        ...
                        ,
                        d
                      
                    
                  
                  )
                
                .
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          194
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              
                Setup
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    n
                  
                  )
                
              
              ⁢
              
                :
              
            
            ⁢
            
              

            
            ⁢
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    B
                    0
                  
                  ,
                  
                    B
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          
                            1
                            ,
                            t
                          
                        
                        ,
                        
                          
                            {
                            
                              
                                B
                                
                                  i
                                  ,
                                  j
                                  ,
                                  t
                                
                                ′
                              
                              ,
                              
                                B
                                
                                  i
                                  ,
                                  j
                                  ,
                                  L
                                  ,
                                  t
                                
                                
                                  ′
                                  *
                                
                              
                            
                            }
                          
                          
                            i
                            ,
                            
                              j
                              =
                              1
                            
                            ,
                            ...
                            ,
                            
                              6
                              ;
                              
                                L
                                =
                                1
                              
                            
                            ,
                            ...
                            ,
                            
                              n
                              t
                            
                          
                        
                      
                      }
                    
                    
                      
                        t
                        =
                        1
                      
                      ,
                      ...
                      ,
                      d
                    
                  
                
                )
              
              ⁢
              
                ⟵
                R
              
              ⁢
              
                
                  G
                  ob
                  
                    (
                    2
                    )
                  
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    
                      n
                      t
                    
                  
                  )
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                B
                ^
              
              0
            
            :=
            
              (
              
                
                  b
                  
                    0
                    ,
                    1
                  
                
                ,
                
                  b
                  
                    0
                    ,
                    3
                  
                
                ,
                
                  b
                  
                    0
                    ,
                    4
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              
                B
                ^
              
              
                1
                ,
                t
              
            
            :=
            
              (
              
                
                  b
                  
                    1
                    ,
                    1
                    ,
                    t
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  b
                  
                    1
                    ,
                    
                      n
                      t
                    
                    ,
                    t
                  
                
                ,
                
                  b
                  
                    1
                    ,
                    
                      
                        3
                        ⁢
                        
                          n
                          t
                        
                      
                      +
                      1
                    
                    ,
                    t
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  b
                  
                    1
                    ,
                    
                      5
                      ⁢
                      
                        n
                        t
                      
                    
                    ,
                    t
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                B
                ^
              
              0
              *
            
            :=
            
              (
              
                
                  b
                  
                    0
                    ,
                    1
                  
                  *
                
                ,
                
                  b
                  
                    0
                    ,
                    3
                  
                  *
                
                ,
                
                  b
                  
                    0
                    ,
                    5
                  
                  *
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              
                
                  
                    
                      
                        
                          B
                          ^
                        
                        
                          1
                          ,
                          t
                        
                        *
                      
                      :=
                      
                      ⁢
                      
                        (
                        
                          
                            b
                            
                              1
                              ,
                              1
                              ,
                              t
                            
                            *
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            b
                            
                              1
                              ,
                              
                                n
                                t
                              
                              ,
                              t
                            
                            *
                          
                          ,
                          
                            b
                            
                              1
                              ,
                              
                                
                                  5
                                  ⁢
                                  
                                    n
                                    t
                                  
                                
                                +
                                1
                              
                              ,
                              t
                            
                            *
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            b
                            
                              1
                              ,
                              
                                6
                                ⁢
                                
                                  n
                                  t
                                
                              
                              ,
                              t
                            
                            *
                          
                        
                        )
                      
                    
                  
                
                
                  
                    
                      
                        =
                        
                        ⁢
                        
                          
                            {
                            
                              
                                B
                                
                                  i
                                  ,
                                  j
                                  ,
                                  t
                                
                                ′
                              
                              ,
                              
                                B
                                
                                  i
                                  ,
                                  j
                                  ,
                                  L
                                  ,
                                  t
                                
                                
                                  ′
                                  *
                                
                              
                            
                            }
                          
                          
                            
                              i
                              =
                              1
                            
                            ,
                            
                              6
                              ;
                              
                                j
                                =
                                1
                              
                            
                            ,
                            ...
                            ,
                            
                              6
                              ;
                              
                                L
                                =
                                1
                              
                            
                            ,
                            ...
                            ,
                            
                              
                                n
                                t
                              
                              ;
                              
                                t
                                =
                                1
                              
                            
                            ,
                            ...
                            ,
                            d
                          
                        
                      
                      ,
                    
                  
                
              
              ⁢
              
                

              
              ⁢
              
                
              
              ⁢
              pk
            
            :=
            
              (
              
                
                  1
                  λ
                
                ,
                
                  param
                  n
                
                ,
                
                  
                    
                      B
                      ^
                    
                    0
                  
                  ⁢
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        
                          1
                          ,
                          t
                        
                      
                      }
                    
                    
                      
                        t
                        =
                        1
                      
                      ,
                      ...
                      ,
                      d
                    
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            sk
            :=
            
              (
              
                
                  
                    B
                    ^
                  
                  0
                
                ⁢
                
                  
                    {
                    
                      
                        B
                        ^
                      
                      
                        1
                        ,
                        t
                      
                    
                    }
                  
                  
                    
                      t
                      =
                      1
                    
                    ,
                    ...
                    ,
                    d
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            pk
          
          ,
          
            sk
            .
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          195
        
        ]
      
    
  
  
    
      
        
          
            
              
            
            ⁢
            
              KeyGen
              (
              
                pk
                ,
                sk
                ,
                
                  
                
                ⁢
                
                  
                    Γ
                    t
                  
                  =
                  
                    x
                    
                      1
                      ,
                      t
                    
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  x
                  
                    
                      n
                      t
                      ′
                    
                    ,
                    t
                  
                
                ,
                
                  
                
                ⁢
                
                  
                
                ⁢
                
                  
                    n
                    t
                    ′
                  
                  ≤
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ,
                
                  t
                  =
                  1
                
                ,
                ...
                ⁢
                
                  
                
                ,
                d
              
              }
            
            )
          
          ⁢
          
            :
          
        
        ⁢
        
          

        
        ⁢
        
          
        
        ⁢
        
          ω
          ,
          
            
              φ
              0
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            
              
                
                  φ
                  
                    1
                    ,
                    t
                  
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
              ⁢
              
                
              
              ⁢
              t
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          d
          ,
          
            

          
          ⁢
          
            
              
                y
                ->
              
              t
            
            :=
            
              
                
                  (
                  
                    
                      y
                      
                        1
                        ,
                        t
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      y
                      
                        
                          n
                          t
                        
                        ,
                        t
                      
                    
                  
                  )
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
                ⁢
                
                  
                
                ⁢
                
                  
                    ∑
                    
                      j
                      =
                      0
                    
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      y
                      
                        
                          
                            n
                            t
                          
                          -
                          j
                        
                        ,
                        t
                      
                    
                    ⁢
                    
                      z
                      j
                    
                  
                
              
              =
              
                
                  z
                  
                    
                      n
                      t
                    
                    -
                    1
                    -
                    
                      n
                      t
                      ′
                    
                  
                
                ·
                
                  
                    ∏
                    
                      j
                      =
                      1
                    
                    
                      n
                      t
                      ′
                    
                  
                  ⁢
                  
                    (
                    
                      z
                      -
                      
                        x
                        
                          j
                          ,
                          t
                        
                      
                    
                    )
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              k
              0
              *
            
            :=
            
              
                (
                
                  ω
                  ,
                  0
                  ,
                  1
                  ,
                  0
                  ,
                  
                    φ
                    0
                  
                
                )
              
              
                B
                0
                *
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              j
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          6
          ,
          
            
          
          ⁢
          
            t
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          d
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              K
              
                1
                ,
                j
                ,
                t
              
            
            :=
            
              
                ω
                ⁢
                
                  
                
                ⁢
                
                  B
                  
                    1
                    ,
                    j
                    ,
                    t
                  
                
              
              +
              
                
                  φ
                  
                    1
                    ,
                    t
                  
                
                ⁢
                
                  B
                  
                    6
                    ,
                    j
                    ,
                    t
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              K
              
                2
                ,
                j
                ,
                t
              
            
            :=
            
              
                ∑
                
                  L
                  =
                  1
                
                
                  n
                  t
                
              
              ⁢
              
                
                  y
                  
                    L
                    ,
                    t
                  
                
                ⁡
                
                  (
                  
                    
                      ω
                      ⁢
                      
                        
                      
                      ⁢
                      
                        B
                        
                          1
                          ,
                          j
                          ,
                          L
                          ,
                          t
                        
                        ′
                      
                    
                    +
                    
                      
                        φ
                        
                          1
                          ,
                          t
                        
                      
                      ⁢
                      
                        B
                        
                          6
                          ,
                          j
                          ,
                          L
                          ,
                          t
                        
                        ′
                      
                    
                  
                  )
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              sk
              Γ
            
            :=
            
              (
              
                
                  Γ
                  t
                
                ,
                
                  k
                  0
                  *
                
                ,
                
                  
                    {
                    
                      
                        K
                        
                          1
                          ,
                          j
                          ,
                          t
                        
                      
                      ,
                      
                        K
                        
                          2
                          ,
                          j
                          ,
                          t
                        
                      
                    
                    }
                  
                  
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ,
                    
                      6
                      ;
                      
                        t
                        =
                        1
                      
                    
                    ,
                    ...
                    ,
                    d
                  
                
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            return
            ⁢
            
              
            
            ⁢
            
              
                sk
                Γ
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          196
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              Enc
              ⁡
              
                (
                
                  pk
                  ,
                  m
                  ,
                  
                    S
                    =
                    
                      (
                      
                        M
                        ,
                        ρ
                      
                      )
                    
                  
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                f
                ->
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                r
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  s
                  ->
                
                T
              
              :=
              
                
                  
                    (
                    
                      
                        s
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        s
                        L
                      
                    
                    )
                  
                  T
                
                :=
                
                  M
                  ·
                  
                    
                      f
                      ->
                    
                    T
                  
                
              
            
            ,
            
              
                s
                0
              
              :=
              
                
                  1
                  ->
                
                ·
                
                  
                    f
                    ->
                  
                  T
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              η
              0
            
            ,
            
              ζ
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                0
              
              :=
              
                
                  (
                  
                    
                      -
                      
                        s
                        0
                      
                    
                    ,
                    0
                    ,
                    ζ
                    ,
                    
                      η
                      0
                    
                    ,
                    0
                  
                  )
                
                
                  B
                  0
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                for
                ⁢
                
                  
                
                ⁢
                i
              
              =
            
          
          ⁣
          
            1
            ,
            ...
            ⁢
            
              
            
            ,
            L
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                (
                
                  t
                  ,
                  
                    v
                    i
                  
                
                )
              
            
            ,
            
              
                
                  v
                  ->
                
                i
              
              :=
              
                (
                
                  
                    v
                    i
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                θ
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              
                
                  η
                  ->
                
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                
                  2
                  ⁢
                  
                    n
                    t
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                                e
                                ->
                              
                              
                                1
                                ,
                                t
                              
                            
                          
                          +
                          
                            
                              θ
                              i
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        ,
                      
                      
                        {
                        
                          n
                          t
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          0
                          
                            2
                            ⁢
                            
                              n
                              t
                            
                          
                        
                        ,
                      
                      
                        {
                        
                          2
                          ⁢
                          
                            n
                            t
                          
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          
                            η
                            ->
                          
                          i
                        
                        ,
                      
                      
                        {
                        
                          2
                          ⁢
                          
                            n
                            t
                          
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        0
                        
                          n
                          t
                        
                      
                      
                        {
                        
                          n
                          t
                        
                      
                    
                  
                  ⁢
                  
                    
                  
                  )
                
                
                  B
                  
                    1
                    ,
                    t
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                ⫬
                
                  (
                  
                    t
                    ,
                    
                      v
                      i
                    
                  
                  )
                
              
            
            ,
            
              
                
                  v
                  ->
                
                i
              
              :=
              
                (
                
                  
                    v
                    i
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
            
            ,
            
              
                
                  η
                  ->
                
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                
                  2
                  ⁢
                  
                    n
                    t
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            s
                            i
                          
                          ⁢
                          
                            
                              v
                              ->
                            
                            i
                          
                        
                        ,
                      
                      
                        {
                        
                          n
                          t
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          0
                          
                            2
                            ⁢
                            
                              n
                              t
                            
                          
                        
                        ,
                      
                      
                        {
                        
                          2
                          ⁢
                          
                            n
                            t
                          
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          
                            η
                            ->
                          
                          i
                        
                        ,
                      
                      
                        {
                        
                          2
                          ⁢
                          
                            n
                            t
                          
                        
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        0
                        
                          n
                          t
                        
                      
                      
                        {
                        
                          n
                          t
                        
                      
                    
                  
                  ⁢
                  
                    
                  
                  )
                
                
                  B
                  
                    1
                    ,
                    t
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                3
              
              :=
              
                
                  g
                  T
                  ζ
                
                ⁢
                m
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                ct
                S
              
              :=
              
                (
                
                  S
                  ,
                  
                    c
                    0
                  
                  ,
                  
                    
                      {
                      
                        c
                        i
                      
                      }
                    
                    
                      
                        i
                        =
                        1
                      
                      ,
                      ...
                      ,
                      L
                    
                  
                  ,
                  
                    c
                    3
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              
                
                  ct
                  S
                
                .
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          197
        
        ]
      
    
  
  
    
      
        
          
            
              
                
                  
                    
                      
                        Dec
                        (
                        
                          pk
                          ,
                          
                            
                              sk
                              Γ
                            
                            :=
                            
                              

                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              (
                              
                                
                                  Γ
                                  t
                                
                                ,
                                
                                  k
                                  0
                                  *
                                
                                ,
                                
                                  
                                    {
                                    
                                      
                                        K
                                        
                                          1
                                          ,
                                          j
                                          ,
                                          t
                                        
                                      
                                      ,
                                      
                                        K
                                        
                                          2
                                          ,
                                          j
                                          ,
                                          t
                                        
                                      
                                    
                                    }
                                  
                                  
                                    
                                      j
                                      =
                                      1
                                    
                                    ,
                                    ...
                                    ,
                                    
                                      6
                                      ;
                                      
                                        t
                                        =
                                        1
                                      
                                    
                                    ,
                                    ...
                                    ,
                                    d
                                  
                                
                              
                              )
                            
                          
                          ,
                          
                            

                          
                          ⁢
                          
                            
                          
                          ⁢
                          
                            
                              ct
                              S
                            
                            :=
                            
                              (
                              
                                S
                                ,
                                
                                  c
                                  0
                                
                                ,
                                
                                  
                                    {
                                    
                                      c
                                      i
                                    
                                    }
                                  
                                  
                                    
                                      i
                                      =
                                      1
                                    
                                    ,
                                    ...
                                    ⁢
                                    
                                      
                                    
                                    ,
                                    L
                                  
                                
                                ,
                                
                                  c
                                  3
                                
                              
                              )
                            
                          
                        
                        )
                      
                      ⁢
                      
                        :
                      
                    
                    ⁢
                    
                      

                    
                    ⁢
                    
                      
                        If
                        ⁢
                        
                          
                        
                        ⁢
                        S
                        ⁢
                        
                          
                        
                        ⁢
                        accepts
                        ⁢
                        
                          
                        
                        ⁢
                        Γ
                      
                      ,
                      
                        then
                        ⁢
                        
                          
                        
                        ⁢
                        compute
                        ⁢
                        
                          
                        
                        ⁢
                        I
                        ⁢
                        
                          
                        
                        ⁢
                        and
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            {
                            
                              α
                              i
                            
                            }
                          
                          
                            i
                            ∈
                            I
                          
                        
                        ⁢
                        
                          
                        
                        ⁢
                        such
                        ⁢
                        
                          
                        
                        ⁢
                        that
                      
                      ,
                      
                        

                      
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          1
                          ->
                        
                        =
                        
                          
                            ∑
                            
                              i
                              ∈
                              I
                            
                          
                          ⁢
                          
                            
                              α
                              i
                            
                            ⁢
                            
                              M
                              i
                            
                            ⁢
                            
                              

                            
                            ⁢
                            
                              
                            
                            ⁢
                            where
                            ⁢
                            
                              
                            
                            ⁢
                            
                              M
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            is
                            ⁢
                            
                              
                            
                            ⁢
                            the
                            ⁢
                            
                              
                            
                            ⁢
                            i
                            ⁢
                            
                              -
                            
                            ⁢
                            th
                            ⁢
                            
                              
                            
                            ⁢
                            row
                            ⁢
                            
                              
                            
                            ⁢
                            of
                            ⁢
                            
                              
                            
                            ⁢
                            M
                          
                        
                      
                      ,
                      and
                    
                    ⁢
                    
                      

                    
                    ⁢
                    
                      
                        I
                        ⊆
                        
                          {
                          
                            
                              i
                              ∈
                              
                                {
                                
                                  1
                                  ,
                                  ...
                                  ⁢
                                  
                                    
                                  
                                  ,
                                  L
                                
                                }
                              
                            
                            |
                            
                              
                                
                                  [
                                  
                                    
                                      ρ
                                      ⁡
                                      
                                        (
                                        i
                                        )
                                      
                                    
                                    =
                                  
                                   
                                
                                ⁢
                                
                                  (
                                  
                                    t
                                    ,
                                    
                                      v
                                      i
                                    
                                  
                                  )
                                
                              
                              ⩓
                              
                                
                                  v
                                  i
                                
                                ∈
                                
                                  Γ
                                  t
                                
                              
                            
                          
                          ]
                        
                      
                      ⩔
                    
                  
                   
                
                 
              
              [
              
                
              
              ⁢
              
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
                =
                
                  
                    ⫬
                    
                      (
                      
                        t
                        ,
                        
                          v
                          i
                        
                      
                      )
                    
                  
                  ⩓
                  
                    
                      v
                      i
                    
                    ∉
                    
                      Γ
                      t
                    
                  
                
              
              ]
            
            }
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              I
              t
            
            ⊆
            
              {
              
                
                  
                    i
                    ∈
                    I
                  
                  |
                  
                    ρ
                    ⁡
                    
                      (
                      i
                      )
                    
                  
                
                =
                
                  
                    
                      (
                      
                        t
                        ,
                        
                          v
                          i
                        
                      
                      )
                    
                    ⩔
                    
                      ρ
                      ⁡
                      
                        (
                        i
                        )
                      
                    
                  
                  =
                  
                    ⫬
                    
                      (
                      
                        t
                        ,
                        
                          v
                          i
                        
                      
                      )
                    
                  
                
              
              }
            
          
          ,
          
            

          
          ⁢
          
            
              
                y
                ->
              
              t
            
            :=
            
              
                
                  (
                  
                    
                      y
                      
                        1
                        ,
                        t
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      y
                      
                        
                          n
                          t
                        
                        ,
                        t
                      
                    
                  
                  )
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
                ⁢
                
                  
                
                ⁢
                
                  
                    ∑
                    
                      j
                      =
                      0
                    
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      y
                      
                        
                          
                            n
                            t
                          
                          -
                          j
                        
                        ,
                        t
                      
                    
                    ⁢
                    
                      z
                      j
                    
                  
                
              
              =
              
                
                  z
                  
                    
                      n
                      t
                    
                    -
                    1
                    -
                    
                      n
                      t
                      ′
                    
                  
                
                ·
                
                  
                    ∏
                    
                      j
                      =
                      1
                    
                    
                      n
                      t
                      ′
                    
                  
                  ⁢
                  
                    (
                    
                      z
                      -
                      
                        x
                        
                          j
                          ,
                          t
                        
                      
                    
                    )
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
              (
              
                
                  D
                  
                    1
                    ,
                    t
                  
                  *
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  D
                  
                    
                      6
                      ⁢
                      
                        n
                        t
                      
                    
                    ,
                    t
                  
                  *
                
              
              )
            
            :=
            
              
                
                  ∑
                  
                    
                      
                        i
                        ∈
                        
                          I
                          t
                        
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      (
                      
                        t
                        ,
                        
                          v
                          i
                        
                      
                      )
                    
                  
                
                ⁢
                
                  
                    α
                    i
                  
                  ⁢
                  
                    c
                    i
                  
                
              
              +
              
                
                  ∑
                  
                    
                      
                        i
                        ∈
                        
                          I
                          t
                        
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      ⫬
                      
                        (
                        
                          t
                          ,
                          
                            v
                            i
                          
                        
                        )
                      
                    
                  
                
                ⁢
                
                  
                    
                      α
                      i
                    
                    
                      
                        
                          v
                          ->
                        
                        i
                      
                      ·
                      
                        
                          y
                          ->
                        
                        t
                      
                    
                  
                  ⁢
                  
                    c
                    i
                  
                
              
            
          
          ,
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              E
              
                j
                ,
                t
              
              *
            
            :=
            
              
                ∑
                
                  L
                  =
                  1
                
                
                  
                    n
                    t
                  
                  -
                  1
                
              
              ⁢
              
                
                  y
                  
                    
                      L
                      -
                      1
                    
                    ,
                    t
                  
                
                ⁢
                
                  D
                  
                    
                      
                        
                          (
                          
                            j
                            -
                            1
                          
                          )
                        
                        ⁢
                        
                          n
                          t
                        
                      
                      +
                      L
                    
                    ,
                    t
                  
                  *
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
           
          
            
          
          ⁢
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                j
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                t
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            d
            ,
            
              

            
            ⁢
            
              K
              :=
              
                
                  e
                  ⁡
                  
                    (
                    
                      
                        c
                        0
                      
                      ,
                      
                        k
                        0
                        *
                      
                    
                    )
                  
                
                ·
                
                  
                    ∏
                    
                      t
                      =
                      1
                    
                    d
                  
                  ⁢
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      6
                    
                    ⁢
                    
                      (
                      
                        
                          e
                          ⁡
                          
                            (
                            
                              
                                E
                                
                                  j
                                  ,
                                  t
                                
                                *
                              
                              ,
                              
                                K
                                
                                  1
                                  ,
                                  j
                                  ,
                                  t
                                
                              
                            
                            )
                          
                        
                        ·
                        
                          
                        
                        ⁢
                        
                          e
                          ⁡
                          
                            (
                            
                              
                                D
                                
                                  
                                    jn
                                    t
                                  
                                  ,
                                  t
                                
                                *
                              
                              ,
                              
                                K
                                
                                  2
                                  ,
                                  j
                                  ,
                                  t
                                
                              
                            
                            )
                          
                        
                      
                      )
                    
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                return
                ⁢
                
                  
                
                ⁢
                
                  m
                  ′
                
              
              :=
              
                
              
              ⁢
              
                
                  c
                  3
                
                /
                
                  K
                  .
                
              
            
          
          ⁢
          
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          198
        
        ]
      
    
  




As described above, it is possible to construct the FE scheme by applying the ABE scheme according to Embodiment 1 or 2.
Embodiment 4
In Embodiment 4, an attribute-based signature (ABS) scheme to which the CP-ABE scheme described in Embodiment 2 is applied will be described.
In Embodiment 4, description will be omitted for what is the same as in Embodiment 2, and differences from Embodiment 2 will be described.
First, a basic structure of the signature scheme according to Embodiment 4 will be described.
Second, a configuration of a cryptographic system 10 that implements the signature scheme according to Embodiment 4 will be described.
Third, the signature scheme according to Embodiment 4 will be described in detail.
<1. Basic Structure of Cryptographic Scheme>
The structure of the ABS scheme will be briefly described. The ABS scheme includes four algorithms: Setup, KeyGen, Sig, and Ver.
(Setup)
A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ and an upper limit n for the number of attributes for a ciphertext, and outputs a public parameter pk and a master key sk.
(KeyGen)
A KeyGen algorithm is a probabilistic algorithm that takes as input the public parameter pk, the master key sk, and an attribute set Γ:={xj}1≦j≦n′, and outputs a signature key skΓ.
(Sig)
A Sig algorithm is a probabilistic algorithm that takes as input the public parameter pk, a message m, an access structure S:=(M, ρ), and the signature key skΓ, and outputs a signature σ.
(Ver)
A Ver algorithm is an algorithm that takes as input the public parameter pk, the message m, the access structure S:=(M, ρ), and the signature σ, and outputs a value “1” indicating that the verification of the signature has succeeded, or a value “0” indicating that the verification of the signature has failed.
<2. Configuration of Cryptographic System 10 that Implements ABS Scheme>
FIG. 18 is a configuration diagram of the cryptographic system 10 that implements the ABS scheme according to Embodiment 4.
The cryptographic system 10 includes a key generation device 100, a signature device 400 (an example of the transmission device), and a verification device 500 (an example of the reception device).
The key generation device 100 executes the Setup algorithm taking as input a security parameter λ and an upper limit n for the number of attributes for a ciphertext, and thereby generates a public parameter pk and a master key sk. Then, the key generation device 100 publishes the generated public parameter pk. The key generation device 100 also executes the KeyGen algorithm taking as input an attribute set Γ, and thereby generates a signature key skΓ, and transmits the signature key skΓ to the signature device 400 in secrecy.
The signature device 400 executes the Sig algorithm taking as input the public parameter pk, a message m, the access structure S, and the signature key skΓ, and thereby generates a signature σ. The signature device 400 transmits the generated signature σ, the message m, and the access structure S to the verification device 500.
The verification device 500 executes the Ver algorithm taking as input the public parameter pk, the message m, the access structure S, and the signature σ, and outputs a value “1” or a value “0”.
<3. Signature Scheme>
FIG. 19 is a configuration diagram of the key generation device 100 according to Embodiment 4. FIG. 20 is a configuration diagram of the signature device 400 according to Embodiment 4. FIG. 21 is a configuration diagram of the verification device 500 according to Embodiment 4.
FIG. 22 and FIG. 23 are flowcharts illustrating the operation of the key generation device 100 according to Embodiment 4. FIG. 22 is a flowchart illustrating the process of the Setup algorithm according to Embodiment 4, and FIG. 23 is a flowchart illustrating the process of the KeyGen algorithm according to Embodiment 4. FIG. 24 is a flowchart illustrating the operation of the signature device 400 according to Embodiment 4, and illustrating the process of the Sig algorithm according to Embodiment 4. FIG. 25 is a flowchart illustrating the operation of the verification device 500 according to Embodiment 4, and illustrating the process of the Ver algorithm according to Embodiment 4.
In the following description, H:=(KHλ, Hhkλ,D) is a collision-resistant hash function. A collision-resistant hash function is a hash function for which it is difficult to find two inputs that hash to the same output.
Specifically, the following two items apply to a collision-resistant hash function family H associated with the algorithm Gbpg and a polynomial poly(λ).
1. A family of key spaces is indexed by λ. Each such key space is a probability space on bit strings denoted by KHλ. There exists a probabilistic polynomial-time algorithm whose output distribution on input 1λ is equal to KHλ.
2. A family of hash functions is indexed by λ, hk randomly selected from KHλ, and D:={0, 1}poly(λ), where each such function Hhkλ,D maps an element of D to Fqx with q being the first element of output paramG of algorithm Gbpg(1λ). There exists a deterministic polynomial-time algorithm that outputs Hhkλ,D(d) on input 1λ, hk, and dεD.
The function and operation of the key generation device 100 will be described.
As illustrated in FIG. 19, the key generation device 100 includes a master key generation part 110, a master key storage part 120, an information input part 130, a decryption key generation part 140, and a key transmission part 150. The master key generation part 110 includes a space generation part 111, a matrix generation part 112, a basis generation part 113, and a key generation part 114. The decryption key generation part 140 includes a random number generation part 143 and a key element generation part 144.
With reference to FIG. 22, the process of the Setup algorithm will be described.
(S701: Space Generation Step)
The space generation part 111 generates a parameter paramG:=(q, G, GT, g, e), similarly as in (S101) of FIG. 9.
Further, the space generation part 111 sets N0:=4, N1:=6n, and N2:=7. Then, with the processing device and for each integer t=0, 1, 2, the space generation part 111 executes Gdpvs taking as input the security parameter 1λ, Nt, and the parameter paramG of symmetric bilinear pairing groups, and thereby generates a parameter param vt:=(q, Vt, GT, A, e) of dual pairing vector spaces.
(S702: Linear Transformation Generation Step)
With the processing device, the matrix generation part 112 generates a linear transformation Xt for each integer t=0, 2, as indicated in Formula 199.




  
    
      
        
          
            X
            t
          
          :=
          
            
              
                
                  
                    (
                    
                      χ
                      
                        t
                        ,
                        i
                        ,
                        j
                      
                    
                    )
                  
                  
                    i
                    ,
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      N
                      t
                    
                  
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  GL
                  ⁡
                  
                    (
                    
                      
                        N
                        t
                      
                      ,
                      
                        F
                        q
                      
                    
                    )
                  
                
              
              ⁢
              
                
              
              ⁢
              for
              ⁢
              
                
              
              ⁢
              t
            
            =
            0
          
        
        ,
        2.
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          199
        
        ]
      
    
  




With the processing device, the matrix generation part 112 also generates a linear transformation X1, as indicated in Formula 200.




  
    
      
        
          X
          1
        
        ⁢
        
          ⟵
          U
        
        ⁢
        
          L
          ⁡
          
            (
            
              6
              ,
              n
              ,
              
                F
                q
              
            
            )
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          200
        
        ]
      
    
  




In the following, {μi,j, μ′i,j,L}i,j=1, . . . , 6; L=1, . . . , n denotes non-zero elements in the linear transformation X1.
(S703: Basis B Generation Step)
With the processing device, the basis generation part 113 generates a basis B*0, a basis B*2, a variable B*i,j, and a variable B′*i,j,L, as indicated in Formula 201.
for t=0, 2,

bt,i=(χt,i,1, . . . ,χt,i,Nt=Σj=1Ntχt,i,jaj for i=1, . . . ,Nt,

t:=(bt,1, . . . ,bt,Nt)  [Formula 201]

for i, j=1, . . . , 6; L=1, . . . , n,

B*i,j:=μi,jg,B′*i,j,L:=μ′i,j,Lg 

With the processing device, the basis generation part 113 also generates a basis B0, a basis B1, and a basis B2, as indicated in Formula 202.

for t=0, 1, 2,

(θt,i,j)i,j=1, . . . ,Nt:=ψ·(XtT)−1,

b*t,i:=(θt,i,1, . . . θt,i,Nt=Σj=1Ntθt,i,jaj for i=1, . . . ,Nt,

*t:=(b*t,1, . . . ,bt,Nt)  [Formula 202]

(S704: Basis B^ Generation Step)
With the processing device, the key generation part 114 generates a basis B^0, a basis B^1, a basis B^2, basis B^*0, a basis B^*1, and a basis B^*2, as indicated in Formula 203.

0:=(b0,1,b0,4),

1:=(b1,1, . . . ,b1,n,b1,4n+1, . . . ,b1,6n),

2:=(b2,1,b2,2,b2,7),

1*:=(b1,1*, . . . ,b1,n*,b1,3n+1, . . . ,b1,4n*)={Bi,j*,Bi,j,L*}i=1,4;j=1, . . . ,6;L=1, . . . ,n,

0*:=(b2,1*,b2,2*,b2,5*,b2,6*)  [Formula 203]

(S705: Hash Key Generation Step)
With the processing device, the master key generation part 110 computes Formula 204, and thereby randomly generates a hash key hk.




  
    
      
        hk
        ⁢
        
          ⟵
          R
        
        ⁢
        
          KH
          λ
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          204
        
        ]
      
    
  




(S706: Master Key Generation Step)
With the processing device, the key generation part 114 generates a public parameter pk:=(1λ, hk, paramn, {B^t}t=0,1,2, {B^*t}t=1,2, b*0,3) and a master secret key sk:=b*0,1. Then, the key generation part 114 stores the public parameter pk and the master secret key sk in the master key storage part 120.

Note that paramn:=({paramVt}t=0,1,2,gT:=e(g,g)φ).

In brief, in (S701) through (S706), the key generation device 100 generates the public parameter pk and the master secret key sk by executing the Setup algorithm indicated in Formula 206, the Setup algorithm using an algorithm GABSob indicated in Formula 205.




  
    
      
        
          
            
          
          ⁢
          
            
              
                
                  
                    G
                    ob
                    ABS
                  
                  ⁡
                  
                    (
                    
                      
                        1
                        λ
                      
                      ,
                      6
                      ,
                      n
                    
                    )
                  
                
                ⁢
                
                  :
                
              
              ⁢
              
                

              
              ⁢
              
                
                  
                    param
                    G
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        G
                        ,
                        
                          G
                          T
                        
                        ,
                        g
                        ,
                        e
                      
                      )
                    
                    ⁢
                    
                      ⟵
                      R
                    
                    ⁢
                    
                      
                        G
                        bpg
                      
                      ⁡
                      
                        (
                        
                          1
                          λ
                        
                        )
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    N
                    0
                  
                  :=
                  4
                
                ,
                
                  
                    N
                    1
                  
                  :=
                  
                    6
                    ⁢
                    n
                  
                
                ,
                
                  
                    N
                    2
                  
                  :=
                  7
                
                ,
                
                  

                
                ⁢
                
                  
                    param
                    
                      V
                      t
                    
                  
                  :=
                  
                    
                      (
                      
                        q
                        ,
                        
                          V
                          t
                        
                        ,
                        
                          G
                          T
                        
                        ,
                        A
                        ,
                        e
                      
                      )
                    
                    :=
                    
                      
                        
                          
                            G
                            dpvs
                          
                          ⁡
                          
                            (
                            
                              
                                1
                                λ
                              
                              ,
                              
                                N
                                t
                              
                              ,
                              
                                param
                                G
                              
                            
                            )
                          
                        
                        ⁢
                        
                          
                        
                        ⁢
                        for
                        ⁢
                        
                          
                        
                        ⁢
                        t
                      
                      =
                      0
                    
                  
                
                ,
                1
                ,
                2
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  ψ
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    F
                    q
                    x
                  
                
                ,
                
                  
                    g
                    T
                  
                  :=
                  
                    
                      e
                      ⁡
                      
                        (
                        
                          g
                          ,
                          g
                        
                        )
                      
                    
                    ψ
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    param
                    n
                  
                  :=
                  
                    (
                    
                      
                        
                          {
                          
                            param
                            
                              V
                              t
                            
                          
                          }
                        
                        
                          
                            t
                            =
                            0
                          
                          ,
                          1
                          ,
                          2
                        
                      
                      ,
                      
                        g
                        T
                      
                    
                    )
                  
                
                ,
                
                  

                
                ⁢
                
                  
                    X
                    t
                  
                  :=
                  
                    
                      
                        (
                        
                          χ
                          
                            t
                            ,
                            i
                            ,
                            j
                          
                        
                        )
                      
                      
                        i
                        ,
                        
                          j
                          =
                          1
                        
                        ,
                        ...
                        ,
                        
                          N
                          t
                        
                      
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      GL
                      ⁡
                      
                        (
                        
                          
                            N
                            
                              t
                              ,
                            
                          
                          ⁢
                          
                            F
                            q
                          
                        
                        )
                      
                    
                  
                
                ,
                
                  
                    for
                    ⁢
                    
                      
                    
                    ⁢
                    t
                  
                  =
                  0
                
                ,
                2
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    X
                    1
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    L
                    ⁡
                    
                      (
                      
                        6
                        ,
                        n
                        ,
                        
                          F
                          q
                        
                      
                      )
                    
                  
                
                ,
                
                  
                
                ⁢
                hereafter
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    {
                    
                      
                        μ
                        
                          i
                          ,
                          j
                        
                      
                      ,
                      
                        μ
                        
                          i
                          ,
                          j
                          ,
                          L
                        
                        ′
                      
                    
                    }
                  
                  
                    i
                    ,
                    
                      j
                      =
                      1
                    
                    ,
                    ...
                    ,
                    
                      6
                      ;
                      
                        L
                        =
                        1
                      
                    
                    ,
                    ...
                    ,
                    n
                  
                
              
            
            ⁢
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                denotes
                ⁢
                
                  
                
                ⁢
                non
                ⁢
                
                  -
                
                ⁢
                zero
                ⁢
                
                  
                
                ⁢
                entries
                ⁢
                
                  
                
                ⁢
                of
                ⁢
                
                  
                
                ⁢
                
                  X
                  1
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  for
                  ⁢
                  
                    
                  
                  ⁢
                  t
                
                =
                0
              
              ,
              2
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  b
                  
                    t
                    ,
                    i
                  
                
                :=
                
                  
                    
                      (
                      
                        
                          χ
                          
                            t
                            ,
                            i
                            ,
                            1
                            ,
                            ...
                            ,
                          
                        
                        ⁢
                        
                          χ
                          
                            t
                            ,
                            i
                            ,
                            
                              N
                              t
                            
                          
                        
                      
                      )
                    
                    A
                  
                  =
                  
                    
                      ∑
                      
                        j
                        =
                        1
                      
                      
                        N
                        t
                      
                    
                    ⁢
                    
                      
                        χ
                        
                          t
                          ,
                          i
                          ,
                          j
                        
                      
                      ⁢
                      
                        a
                        j
                      
                    
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
           
        
        ⁢
        
           
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                i
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              N
              t
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                B
                t
              
              :=
              
                (
                
                  
                    b
                    
                      t
                      ,
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      t
                      ,
                      
                        N
                        t
                      
                    
                  
                
                )
              
            
            ,
          
          ⁢
          
            

          
           
        
        ⁢
        
           
          
            
          
          ⁢
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            ,
            
              j
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              6
              ;
              
                L
                =
                1
              
            
            ,
            ...
            ⁢
            
              
            
            ,
            n
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                B
                
                  i
                  ,
                  j
                
                *
              
              :=
              
                
                  μ
                  
                    i
                    ,
                    j
                  
                
                ⁢
                g
              
            
            ,
            
              
                B
                
                  i
                  ,
                  j
                  ,
                  L
                
                ′
              
              :=
              
                
                  
                    μ
                    
                      i
                      ,
                      j
                      ,
                      L
                    
                    ′
                  
                  ⁢
                  g
                  ⁢
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  for
                  ⁢
                  
                    
                  
                  ⁢
                  t
                
                =
                0
              
            
            ,
            1
            ,
            2
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  (
                  
                    θ
                    
                      t
                      ,
                      i
                      ,
                      j
                    
                  
                  )
                
                
                  i
                  ,
                  
                    j
                    =
                    1
                  
                  ,
                  ...
                  ,
                  
                    N
                    t
                  
                
              
              :=
              
                ψ
                ·
                
                  
                    (
                    
                      X
                      t
                      T
                    
                    )
                  
                  
                    -
                    1
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
                b
                
                  t
                  ,
                  i
                
                *
              
              :=
              
                
                  
                    (
                    
                      
                        θ
                        
                          t
                          ,
                          i
                          ,
                          1
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        θ
                        
                          t
                          ,
                          i
                          ,
                          
                            N
                            t
                          
                        
                      
                    
                    )
                  
                  A
                
                =
                
                  
                    ∑
                    
                      j
                      =
                      1
                    
                    
                      N
                      t
                    
                  
                  ⁢
                  
                    
                      θ
                      
                        t
                        ,
                        i
                        ,
                        j
                      
                    
                    ⁢
                    
                      a
                      j
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                       
                      
                        
                          
                            for
                            ⁢
                            
                              
                            
                            ⁢
                            i
                          
                          =
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          N
                          t
                        
                        ,
                        
                          

                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          
                            B
                            t
                            *
                          
                          :=
                          
                            
                              (
                              
                                
                                  b
                                  
                                    t
                                    ,
                                    1
                                  
                                  *
                                
                                ,
                                ...
                                ⁢
                                
                                  
                                
                                ,
                                
                                  b
                                  
                                    t
                                    ,
                                    
                                      N
                                      t
                                    
                                  
                                  *
                                
                              
                              )
                            
                            ⁢
                            
                              

                            
                            ⁢
                            
                              
                            
                            ⁢
                            return
                            ⁢
                            
                              
                            
                            ⁢
                            
                              (
                              
                                
                                  param
                                  n
                                
                                ,
                                
                                  B
                                  0
                                
                                ,
                                
                                  B
                                  0
                                  *
                                
                                ,
                                
                                  

                                
                                ⁢
                                
                                  
                                
                                ⁢
                                
                                  
                                    {
                                    
                                      
                                        B
                                        
                                          i
                                          ,
                                          j
                                        
                                      
                                      ,
                                      
                                        B
                                        
                                          i
                                          ,
                                          j
                                          ,
                                          L
                                        
                                        ′
                                      
                                    
                                    }
                                  
                                  
                                    i
                                    ,
                                    
                                      j
                                      =
                                      1
                                    
                                    ,
                                    ...
                                    ,
                                    
                                      6
                                      ;
                                      
                                        L
                                        =
                                        1
                                      
                                    
                                    ,
                                    ...
                                    ,
                                    n
                                  
                                
                                ,
                                
                                  
                                     
                                    
                                      
                                    
                                    ⁢
                                    
                                      

                                    
                                    ⁢
                                    
                                      
                                    
                                    ⁢
                                    
                                      
                                        B
                                        1
                                        *
                                      
                                      ,
                                      
                                        
                                      
                                      ⁢
                                      
                                        B
                                        2
                                      
                                      ,
                                      
                                        B
                                        2
                                        *
                                      
                                    
                                    )
                                  
                                  .
                                
                              
                              ⁢
                              
                                
                              
                            
                          
                        
                      
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          205
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              Setup
              ⁡
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  n
                
                )
              
            
            ⁢
            
              :
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              hk
              ⁢
              
                ⟵
                R
              
              ⁢
              
                KH
                λ
              
            
            ,
            
              

            
            ⁢
            
              
                (
                
                  
                    param
                    n
                  
                  ,
                  
                    B
                    0
                  
                  ,
                  
                    B
                    0
                    *
                  
                  ,
                  
                    B
                    1
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          
                            i
                            ,
                            j
                          
                          *
                        
                        ,
                        
                          B
                          
                            i
                            ,
                            j
                            ,
                            L
                          
                          
                            ′
                            *
                          
                        
                      
                      }
                    
                    
                      i
                      ,
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ,
                      
                        6
                        ;
                        
                          L
                          =
                          1
                        
                      
                      ,
                      ...
                      ,
                      n
                    
                  
                
                )
              
              ⁢
              
                ⟵
                R
              
              ⁢
              
                
                  G
                  ob
                  ABS
                
                ⁡
                
                  (
                  
                    
                      1
                      λ
                    
                    ,
                    6
                    ,
                    n
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
              
              :=
              
                (
                
                  
                    b
                    
                      0
                      ,
                      1
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      4
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
                
                  B
                  ^
                
                1
              
              :=
              
                (
                
                  
                    b
                    
                      1
                      ,
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      n
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        
                          4
                          ⁢
                          n
                        
                        +
                        1
                      
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    b
                    
                      1
                      ,
                      
                        6
                        ⁢
                        n
                      
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                2
              
              :=
              
                (
                
                  
                    b
                    
                      2
                      ,
                      1
                    
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      2
                    
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      7
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
                
                  B
                  ^
                
                1
                *
              
              :=
              
                
                  (
                  
                    
                      b
                      
                        1
                        ,
                        1
                      
                      *
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        n
                      
                      *
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          
                            3
                            ⁢
                            n
                          
                          +
                          1
                        
                      
                      *
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      b
                      
                        1
                        ,
                        
                          4
                          ⁢
                          n
                        
                      
                      *
                    
                  
                  )
                
                =
                
                  
                    {
                    
                      
                        B
                        
                          i
                          ,
                          j
                        
                        *
                      
                      ,
                      
                        B
                        
                          i
                          ,
                          j
                          ,
                          L
                        
                        
                          ′
                          *
                        
                      
                    
                    }
                  
                  
                    
                      i
                      =
                      1
                    
                    ,
                    
                      4
                      ;
                      
                        j
                        =
                        1
                      
                    
                    ,
                    ...
                    ,
                    
                      6
                      ;
                      
                        L
                        =
                        1
                      
                    
                    ,
                    ...
                    ,
                    n
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  B
                  ^
                
                0
                *
              
              :=
              
                (
                
                  
                    b
                    
                      2
                      ,
                      1
                    
                    *
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      2
                    
                    *
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      5
                    
                    *
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      6
                    
                    *
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              pk
              :=
              
                (
                
                  
                    1
                    λ
                  
                  ,
                  hk
                  ,
                  
                    param
                    n
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        t
                      
                      }
                    
                    
                      
                        t
                        =
                        0
                      
                      ,
                      1
                      ,
                      2
                    
                  
                  ,
                  
                    
                      {
                      
                        
                          B
                          ^
                        
                        t
                        *
                      
                      }
                    
                    
                      
                        t
                        =
                        1
                      
                      ,
                      2
                    
                  
                  ,
                  
                    b
                    
                      0
                      ,
                      3
                    
                    *
                  
                
                )
              
            
            ,
            
              sk
              :=
              
                b
                
                  0
                  ,
                  1
                
                *
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              pk
            
            ,
            
              sk
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          206
        
        ]
      
    
  




With reference to FIG. 23, the process of the KeyGen algorithm will be described.
The process of (S801) is the same as the process of (S501) in FIG. 16. However, attribute information of a user of a signature key skΓ is set in p of the access structure S, for example.
(S802: Random Number Generation Step)
With the processing device, the random number generation part 143 generates random numbers, as indicated in Formula 207.




  
    
      
        ω
        ,
        
          φ
          0
        
        ,
        
          φ
          1
        
        ,
        
          φ
          
            2
            ,
            1
            ,
            1
          
        
        ,
        
          
            φ
            
              2
              ,
              1
              ,
              2
            
          
          ⁢
          
            φ
            
              2
              ,
              2
              ,
              1
            
          
          ⁢
          
            
              φ
              
                2
                ,
                2
                ,
                2
              
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          207
        
        ]
      
    
  




(S803: Key Element Generation Step)
With the processing device, the key element generation part 144 generates an element k*o of the signature key skΓ, as indicated in Formula 208.

k0*:=(ω,0,φ0,0)*0  [Formula 208]

With the processing device, the key element generation part 144 generates elements L*1,j and L*2,j of the signature key sky, as indicated in Formula 209.
for j=1, . . . , 6

L1,j:=ωB1,j*+φ1B4,j*,

L2,j:=ΣL=1nyL(ωB1,j,L′*+φ1B4,j,L′*)

where

{right arrow over (y)}:=(y1, . . . ,yn) such that Σj=0n-1yn-jzj=n-1-n′·Πj=1n′(z−xj)  [Formula 209]

With the processing device, the key element generation part 144 also generates elements k*2,1 and k*2,2 of the signature key sky, as indicated in Formula 210.

k2,1*:=(ω(1,0),0,0,φ2,1,1,φ2,1,2,0)*2,

k2,2*:=(ω(0,1),0,0,φ2,2,1,φ2,2,2,0)*2  [Formula 210]

(S804: Key Transmission Step)
With the communication device and via the network, for example, the key transmission part 150 transmits the signature key skΓ having, as elements, the attribute set Γ inputted in (S801) and k*0, L*1,j, L*2,j, k*2,1, and k*2,2 generated in (S803) to the signature device 400 in secrecy. As a matter of course, the signature key skΓ may be transmitted to the signature device 400 by another method.
In brief, in (S801) through (S803), the key generation device 100 generates the signature key skΓ by executing the KeyGen algorithm indicated in Formula 211. In (S804), the key generation device 100 transmits the generated signature key skΓ to the decryption device 300.




  
    
      
        
          
        
        ⁢
        
          
            
              
                KeyGen
                ⁡
                
                  (
                  
                    pk
                    ,
                    sk
                    ,
                    
                      Γ
                      =
                      
                        {
                        
                          
                            x
                            1
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            
                              x
                              
                                n
                                ′
                              
                            
                            |
                            
                              
                                x
                                j
                              
                              ∈
                              
                                F
                                q
                                x
                              
                            
                          
                        
                        }
                      
                    
                  
                  )
                
              
              ⁢
              
                :
              
            
            ⁢
            
              

            
            ⁢
            
              
            
            ⁢
            
              ω
              ,
              
                φ
                0
              
              ,
              
                φ
                1
              
              ,
              
                φ
                
                  2
                  ,
                  1
                  ,
                  1
                
              
              ,
              
                φ
                
                  2
                  ,
                  1
                  ,
                  2
                
              
              ,
              
                φ
                
                  2
                  ,
                  2
                  ,
                  1
                
              
              ,
              
                
                  φ
                  
                    2
                    ,
                    2
                    ,
                    2
                  
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
              ,
              
                

              
              ⁢
              
                
                  y
                  ->
                
                :=
                
                  
                    
                      (
                      
                        
                          y
                          1
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          y
                          n
                        
                      
                      )
                    
                    ⁢
                    
                      
                    
                    ⁢
                    such
                    ⁢
                    
                      
                    
                    ⁢
                    that
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        ∑
                        
                          j
                          =
                          0
                        
                        
                          n
                          -
                          1
                        
                      
                      ⁢
                      
                        
                          y
                          
                            n
                            -
                            j
                          
                        
                        ⁢
                        
                          z
                          j
                        
                      
                    
                  
                  =
                  
                    
                      z
                      
                        n
                        -
                        1
                        -
                        
                          n
                          ′
                        
                      
                    
                    ·
                    
                      
                        ∏
                        
                          j
                          =
                          1
                        
                        
                          n
                          ′
                        
                      
                      ⁢
                      
                        (
                        
                          z
                          -
                          
                            x
                            j
                          
                        
                        )
                      
                    
                  
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  k
                  0
                  *
                
                :=
                
                  
                    (
                    
                      ω
                      ,
                      0
                      ,
                      
                        φ
                        0
                      
                      ,
                      0
                    
                    )
                  
                  
                    B
                    0
                    *
                  
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  L
                  
                    1
                    ,
                    j
                  
                
                :=
                
                  
                    ω
                    ⁢
                    
                      
                    
                    ⁢
                    
                      B
                      
                        1
                        ,
                        j
                      
                      *
                    
                  
                  +
                  
                    
                      φ
                      1
                    
                    ⁢
                    
                      B
                      
                        4
                        ,
                        j
                      
                      *
                    
                  
                
              
              ,
              
                

              
              ⁢
              
                
              
              ⁢
              
                
                  L
                  
                    2
                    ,
                    j
                  
                
                :=
                
                  
                    ∑
                    
                      L
                      =
                      1
                    
                    n
                  
                  ⁢
                  
                    
                      y
                      L
                    
                    ⁡
                    
                      (
                      
                        
                          ω
                          ⁢
                          
                            
                          
                          ⁢
                          
                            B
                            
                              1
                              ,
                              j
                              ,
                              L
                            
                            
                              ′
                              *
                            
                          
                        
                        +
                        
                          
                            φ
                            1
                          
                          ⁢
                          
                            B
                            
                              4
                              ,
                              j
                              ,
                              L
                            
                            
                              ′
                              *
                            
                          
                        
                      
                      )
                    
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                j
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            6
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                k
                
                  2
                  ,
                  1
                
                *
              
              :=
              
                
                  (
                  
                    
                      ω
                      ⁡
                      
                        (
                        
                          1
                          ,
                          0
                        
                        )
                      
                    
                    ,
                    0
                    ,
                    0
                    ,
                    
                      φ
                      
                        2
                        ,
                        1
                        ,
                        1
                      
                    
                    ,
                    
                      φ
                      
                        2
                        ,
                        1
                        ,
                        2
                      
                    
                    ,
                    0
                  
                  )
                
                
                  B
                  2
                  *
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                k
                
                  2
                  ,
                  2
                
                *
              
              :=
              
                
                  (
                  
                    
                      ω
                      ⁡
                      
                        (
                        
                          0
                          ,
                          1
                        
                        )
                      
                    
                    ,
                    0
                    ,
                    0
                    ,
                    
                      φ
                      
                        2
                        ,
                        2
                        ,
                        1
                      
                    
                    ,
                    
                      φ
                      
                        2
                        ,
                        2
                        ,
                        2
                      
                    
                    ,
                    0
                  
                  )
                
                
                  B
                  2
                  *
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                sk
                Γ
              
              :=
              
                (
                
                  Γ
                  ,
                  
                    k
                    0
                    *
                  
                  ,
                  
                    
                      {
                      
                        
                          L
                          
                            1
                            ,
                            j
                          
                        
                        ,
                        
                          L
                          
                            2
                            ,
                            j
                          
                        
                      
                      }
                    
                    
                      
                        j
                        =
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      6
                    
                  
                  ,
                  
                    
                      {
                      
                        k
                        
                          2
                          ,
                          t
                        
                        *
                      
                      }
                    
                    
                      
                        t
                        =
                        1
                      
                      ,
                      2
                    
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              return
              ⁢
              
                
              
              ⁢
              
                
                  sk
                  Γ
                
                .
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          211
        
        ]
      
    
  




Note that the element k*1 is defined as indicated in Formula 212, based on {L*1,j, L*2,j}j=1, . . . , 6 and the vector {right arrow over (y)}.




  
    
      
        
          
            k
            1
            *
          
          :=
          
            (
            
              
            
            ⁢
            
              
                
                  
                    
                      y
                      1
                    
                    ⁢
                    
                      L
                      
                        1
                        ,
                        1
                      
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    
                      y
                      
                        n
                        -
                        1
                      
                    
                    ⁢
                    
                      L
                      
                        1
                        ,
                        1
                      
                    
                  
                  ,
                  
                    L
                    
                      2
                      ,
                      1
                    
                  
                  ,
                
                
                  {
                  n
                
              
              ⁢
              
                
                  
                    
                      
                        y
                        1
                      
                      ⁢
                      
                        L
                        
                          1
                          ,
                          2
                        
                      
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      
                        y
                        
                          n
                          -
                          1
                        
                      
                      ⁢
                      
                        L
                        
                          1
                          ,
                          2
                        
                      
                    
                    ,
                    
                      L
                      
                        2
                        ,
                        2
                      
                    
                  
                  ⁢
                  
                    
                  
                
                
                  {
                  n
                
              
            
            )
          
        
        ,
        
          ...
          ⁢
          
             
            
              
                
                  (
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            y
                            1
                          
                          ⁢
                          
                            L
                            
                              1
                              ,
                              5
                            
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          
                            y
                            
                              n
                              -
                              1
                            
                          
                          ⁢
                          
                            L
                            
                              1
                              ,
                              5
                            
                          
                        
                        ,
                        
                          L
                          
                            2
                            ,
                            5
                          
                        
                        ,
                      
                      
                        {
                        n
                      
                    
                    ⁢
                    
                      
                        
                          
                        
                        ⁢
                        
                          
                            
                              y
                              1
                            
                            ⁢
                            
                              L
                              
                                1
                                ,
                                6
                              
                            
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            
                              y
                              
                                n
                                -
                                1
                              
                            
                            ⁢
                            
                              L
                              
                                1
                                ,
                                6
                              
                            
                          
                          ,
                          
                            L
                            
                              2
                              ,
                              6
                            
                          
                        
                        ⁢
                        
                          
                        
                      
                      
                        {
                        n
                      
                    
                  
                  )
                
                ⁢
                
                  
                
                ⁢
                
                  

                
                ⁢
                
                  
                
                ⁢
                that
                ⁢
                
                  
                
                ⁢
                is
              
              ,
              
                
              
              ⁢
              
                
                  k
                  1
                  *
                
                =
                
                  
                    (
                    
                      
                        
                          
                            ω
                            ⁢
                            
                              
                            
                            ⁢
                            
                              y
                              ->
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                      ⁢
                      
                        
                          
                            0
                            
                              2
                              ⁢
                              n
                            
                          
                          ,
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                      ⁢
                      
                        
                          
                            
                              φ
                              1
                            
                            ⁢
                            
                              y
                              ->
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                      ⁢
                      
                        
                          0
                          
                            2
                            ⁢
                            n
                          
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                    
                    )
                  
                  
                    B
                    1
                    *
                  
                
              
              ,
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          212
        
        ]
      
    
  




The function and operation of the signature device 400 will be described.
As illustrated in FIG. 20, the signature device 400 includes a signature key receiving part 410, an information input part 420, a complementary coefficient computation part 430, a signature data generation part 440, and a data transmission part 450. The signature data generation part 440 includes a random number generation part 441 and a signature element generation part 442.
With reference to FIG. 24, the process of the Sig algorithm will be described.
(S901: Signature Key Receiving Step)
With the communication device and via the network, for example, the signature key receiving part 410 receives the signature key skΓ generated by the key generation device 100. The signature key receiving part 410 also receives the public parameter pk generated by the key generation device 100.
(S902: Information Input Step)
With the input device, the information input part 420 takes as input an access structure S:=(M, ρ). With the input device, the information input part 420 also takes as input a message m to which a signature is to be appended.
(S903: Span Program Computation Step)
With the processing device, the complementary coefficient computation part 430 determines whether or not the access structure S inputted in (S902) accepts the attribute set Γ included in the signature key skΓ received in (S901).
If the access structure S accepts the attribute set Γ (accept in S903), the complementary coefficient computation part 430 advances the process to (S904). If the access structure S rejects the attribute set Γ (rejects in S903), the complementary coefficient computation part 430 ends the process.
(S904: Complementary Coefficient Computation Step)
With the processing device, the complementary coefficient computation part 430 computes a vector {right arrow over (y)} such that Formula 213 is satisfied, I such that Formula 214 is satisfied, and a constant (complementary coefficient) αi for each integer i included in I.

{right arrow over (y)}:=(y1, . . . ,yn) such that Σj=0n-1yn-jzj=n-1-n′·Πj=1n′(z−xj)  [Formula 213]





  
    
      
        
          
        
        ⁢
        
          
            
              1
              ->
            
            =
            
              
                ∑
                
                  i
                  ∈
                  I
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  M
                  i
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            and
          
          ⁢
          
            
          
          ⁢
          
            

          
          ⁢
          
            I
            ⊆
            
              {
              
                
                  i
                  ∈
                  
                    {
                    
                      1
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      L
                    
                    }
                  
                
                |
                
                  
                    [
                    
                      
                    
                    ⁢
                    
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                      =
                      
                        
                          v
                          i
                        
                        ⩓
                        
                          
                            v
                            i
                          
                          ∈
                          Γ
                        
                      
                    
                    ]
                  
                  ⩔
                  
                     
                    
                      [
                      
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                        =
                        
                          
                            ⫬
                            
                              v
                              i
                            
                          
                          ⩓
                          
                            
                              v
                              i
                            
                            ∉
                            Γ
                          
                        
                      
                      ]
                    
                    }
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          214
        
        ]
      
    
  




(S905: Random Number Generation Step)
With the processing device, the random number generation part 441 generates random numbers, as indicated in Formula 215.




  
    
      
        
          ξ
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
            x
          
        
        ,
        
          

        
        ⁢
        
          
            (
            
              β
              i
            
            )
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            {
            
              
                
                  (
                  
                    
                      β
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      β
                      L
                    
                  
                  )
                
                |
                
                  
                    ∑
                    
                      i
                      =
                      1
                    
                    L
                  
                  ⁢
                  
                    
                      β
                      i
                    
                    ⁢
                    
                      M
                      i
                    
                  
                
              
              =
              
                0
                ->
              
            
            }
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          215
        
        ]
      
    
  




(S906: Signature Element Generation Step)
With the processing device, the signature element generation part 442 generates an element s*0 of a signature σ, as indicated in Formula 216.

s0*:=ξk0*+r0*  [Formula 216]

Note that r*0 is as indicated in Formula 217.





  
    
      
        
          
            r
            0
            *
          
          ⁢
          
            ⟵
            U
          
          ⁢
          span
        
        ⁢
        
          〈
          
            b
            
              0
              ,
              3
            
            *
          
          〉
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          217
        
        ]
      
    
  




With the processing device, the signature element generation part 442 also generates an element s*i of the signature σ for each integer i=1, . . . , L, as indicated in Formula 218.

si*:=γi·ξk1*+Σt=1nui,l·b1,l*+ri*, for i=1, . . . ,L  [Formula 218]

Note that r*i is as indicated in Formula 219.




  
    
      
        
          
            r
            i
            *
          
          ⁢
          
            ⟵
            U
          
          ⁢
          span
        
        ⁢
        
          〈
          
            
              b
              
                1
                ,
                
                  
                    3
                    ⁢
                    n
                  
                  +
                  1
                
              
              *
            
            ,
            ...
            ⁢
            
              
            
            ,
            
              b
              
                1
                ,
                
                  4
                  ⁢
                  n
                
              
              *
            
          
          〉
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          219
        
        ]
      
    
  




Note also that γi and {right arrow over (u)}i′:=(ui,i′(i′=1, . . . , n) are as indicated in Formula 220.




  
    
      
        
          
            γ
            i
          
          ,
          
            
              
                u
                ->
              
              i
            
            :=
            
              
                (
                
                  
                    u
                    
                      i
                      ,
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    u
                    
                      i
                      ,
                      n
                    
                  
                
                )
              
              ⁢
              
                
              
              ⁢
              are
              ⁢
              
                
              
              ⁢
              defined
              ⁢
              
                
              
              ⁢
              as
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              
                if
                ⁢
                
                  
                
                ⁢
                i
              
              ∈
              I
            
            ⩓
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            
              v
              ->
            
            i
          
        
        ,
        
          

        
        ⁢
        
          
            γ
            i
          
          :=
          
            α
            i
          
        
        ,
        
          

        
        ⁢
        
          
            
              u
              ->
            
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            {
            
              
                
                  
                    u
                    ->
                  
                  i
                
                |
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  ·
                  
                    
                      v
                      ->
                    
                    i
                  
                
              
              =
              
                
                  0
                  ⩓
                  
                    u
                    
                      i
                      ,
                      1
                    
                  
                
                =
                
                  β
                  i
                
              
            
            }
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                if
                ⁢
                
                  
                
                ⁢
                i
              
              ∈
              I
            
            ⩓
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              
                v
                ->
              
              i
            
          
        
        ,
        
          

        
        ⁢
        
          
            γ
            i
          
          :=
          
            
              α
              i
            
            
              
                
                  v
                  ->
                
                i
              
              ·
              
                y
                ->
              
            
          
        
        ,
        
          

        
        ⁢
        
          
            
              u
              ->
            
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            {
            
              
                
                  
                    u
                    ->
                  
                  i
                
                |
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  ·
                  
                    
                      v
                      ->
                    
                    i
                  
                
              
              =
              
                β
                i
              
            
            }
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                if
                ⁢
                
                  
                
                ⁢
                i
              
              ∉
              I
            
            ⩓
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            
              v
              ->
            
            i
          
        
        ,
        
          

        
        ⁢
        
          
            γ
            i
          
          :=
          0
        
        ,
        
          

        
        ⁢
        
          
            
              u
              ->
            
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            {
            
              
                
                  
                    u
                    ->
                  
                  i
                
                |
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  ·
                  
                    
                      v
                      ->
                    
                    i
                  
                
              
              =
              
                
                  0
                  ⩓
                  
                    
                      u
                      ->
                    
                    
                      i
                      ,
                      1
                    
                  
                
                =
                
                  β
                  i
                
              
            
            }
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                if
                ⁢
                
                  
                
                ⁢
                i
              
              ∉
              I
            
            ⩓
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              
                v
                ->
              
              i
            
          
        
        ,
        
          

        
        ⁢
        
          
            γ
            i
          
          :=
          0
        
        ,
        
          

        
        ⁢
        
          
            
              u
              ->
            
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            {
            
              
                
                  
                    u
                    ->
                  
                  i
                
                |
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  ·
                  
                    
                      v
                      ->
                    
                    i
                  
                
              
              =
              
                β
                i
              
            
            }
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          220
        
        ]
      
    
  




With the processing device, the signature element generation part 442 also generates an element S*L+1 of the signature σ, as indicated in Formula 221.

sL+1*:=ξ(k2,1*+Hhkλ,D(m∥)·k2,2*)+rL+1*  [Formula 221]

Note that r*L+1 is as indicated in Formula 222.





  
    
      
        
          
            r
            
              L
              +
              1
            
            *
          
          ⁢
          
            ⟵
            U
          
          ⁢
          span
        
        ⁢
        
          〈
          
            
              b
              
                2
                ,
                5
              
              *
            
            ,
            
              b
              
                2
                ,
                6
              
              *
            
          
          〉
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          222
        
        ]
      
    
  




(S907: Data Transmission Step)
With the communication device and via the network, for example, the data transmission part 450 transmits the signature σ including the element s*0, s*i, and s*L+1, the message m, and the access structure S:=(M, ρ) to the verification device 500. As a matter of course, the signature σ may be transmitted to the verification device 500 by another method.
In brief, in (S901) through (S906), the signature device 400 generates the signature σ by executing the Sig algorithm indicated in Formula 223. In (S907), the signature device 400 transmits the generated signature σ to the verification device 500.




  
    
      
        
          
        
        ⁢
        
          
            
              
                Sig
                ⁡
                
                  (
                  
                    pk
                    ,
                    
                      sk
                      Γ
                    
                    ,
                    m
                    ,
                    
                      S
                      :=
                      
                        (
                        
                          M
                          ,
                          ρ
                        
                        )
                      
                    
                  
                  )
                
              
              :
              
                

              
              ⁢
              
                
              
              ⁢
              
                If
                ⁢
                
                  
                
                ⁢
                S
                ⁢
                
                  
                
                ⁢
                accepts
                ⁢
                
                  
                
                ⁢
                Γ
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              then
              ⁢
              
                
              
              ⁢
              compute
            
          
          ⁢
          
            

          
          ⁢
          
            
              y
              ->
            
            :=
            
              
                
                  (
                  
                    
                      y
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      y
                      n
                    
                  
                  )
                
                ⁢
                
                  
                
                ⁢
                such
                ⁢
                
                  
                
                ⁢
                that
                ⁢
                
                  
                
                ⁢
                
                  
                    ∑
                    
                      j
                      =
                      0
                    
                    
                      n
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      y
                      
                        n
                        -
                        j
                      
                    
                    ⁢
                    
                      z
                      j
                    
                  
                
              
              =
              
                
                  z
                  
                    n
                    -
                    1
                    -
                    
                      n
                      ′
                    
                  
                
                ·
                
                  
                    ∏
                    
                      j
                      =
                      1
                    
                    
                      n
                      ′
                    
                  
                  ⁢
                  
                    (
                    
                      z
                      -
                      
                        x
                        j
                      
                    
                    )
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            I
            ⁢
            
              
            
            ⁢
            and
            ⁢
            
              
            
            ⁢
            
              
                {
                
                  α
                  i
                
                }
              
              
                i
                ∈
                I
              
            
            ⁢
            
              
            
            ⁢
            such
            ⁢
            
              
            
            ⁢
            that
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              1
              ->
            
            =
            
              
                ∑
                
                  i
                  ∈
                  I
                
              
              ⁢
              
                
                  α
                  i
                
                ⁢
                
                  M
                  i
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                M
                i
              
              ⁢
              
                
              
              ⁢
              is
              ⁢
              
                
              
              ⁢
              the
              ⁢
              
                
              
              ⁢
              i
              ⁢
              
                -
              
              ⁢
              th
              ⁢
              
                
              
              ⁢
              row
              ⁢
              
                
              
              ⁢
              of
              ⁢
              
                
              
              ⁢
              M
            
            ,
            and
          
          ⁢
          
            

          
          ⁢
          
            I
            ⁢
            
              
            
            ⊆
            
              {
              
                
                  
                    i
                    ∈
                    
                      {
                      
                        1
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        L
                      
                      }
                    
                  
                  |
                  
                    
                      [
                      
                        
                          ρ
                          ⁡
                          
                            (
                            i
                            )
                          
                        
                        =
                        
                          
                            v
                            i
                          
                          ⩓
                          
                            
                              v
                              i
                            
                            ∈
                            Γ
                          
                        
                      
                      ]
                    
                    ⩔
                    
                      
                         
                        
                          [
                          
                            
                              ρ
                              ⁡
                              
                                (
                                i
                                )
                              
                            
                            =
                            
                              
                                ⫬
                                
                                  v
                                  i
                                
                              
                              ⩓
                              
                                
                                  v
                                  i
                                
                                ∉
                                Γ
                              
                            
                          
                          ]
                        
                        }
                      
                      ⁢
                      
                        

                      
                      ⁢
                      
                        ξ
                        ⁢
                        
                          ⟵
                          U
                        
                        ⁢
                        
                          F
                          q
                          x
                        
                      
                    
                  
                
                ,
                
                  
                
                ⁢
                
                  
                    (
                    
                      β
                      i
                    
                    )
                  
                  ⁢
                  
                    ⟵
                    U
                  
                  ⁢
                  
                    {
                    
                      
                        
                          (
                          
                            
                              β
                              1
                            
                            ,
                            ...
                            ⁢
                            
                              
                            
                            ,
                            
                              β
                              L
                            
                          
                          )
                        
                        |
                        
                          
                            ∑
                            
                              i
                              =
                              1
                            
                            L
                          
                          ⁢
                          
                            
                              β
                              i
                            
                            ⁢
                            
                              M
                              i
                            
                          
                        
                      
                      =
                      
                        0
                        ->
                      
                    
                    }
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    s
                    0
                    *
                  
                  :=
                  
                    
                      ξ
                      ⁢
                      
                        
                      
                      ⁢
                      
                        k
                        0
                        *
                      
                    
                    +
                    
                      r
                      0
                      *
                    
                  
                
                ,
                
                  
                
                ⁢
                
                  where
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      r
                      0
                      *
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    span
                  
                  ⁢
                  
                    〈
                    
                      b
                      
                        0
                        ,
                        3
                      
                      *
                    
                    〉
                  
                
                ,
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          223
          ⁢
          
            -
          
          ⁢
          1
        
        ]
      
    
  
  
    
      
        
          
            
              
                
                  
                    
                      s
                      i
                      *
                    
                    :=
                    
                      
                        
                          
                            γ
                            i
                          
                          ·
                          ξ
                        
                        ⁢
                        
                          
                        
                        ⁢
                        
                          k
                          1
                          *
                        
                      
                      +
                      
                        
                          ∑
                          
                            t
                            =
                            1
                          
                          n
                        
                        ⁢
                        
                          
                            u
                            
                              i
                              ,
                              t
                            
                          
                          ·
                          
                            b
                            
                              1
                              ,
                              t
                            
                            *
                          
                        
                      
                      +
                      
                        r
                        i
                        *
                      
                    
                  
                  ,
                  
                    
                      
                        v
                        ->
                      
                      i
                    
                    :=
                    
                      (
                      
                        
                          v
                          i
                          
                            n
                            -
                            1
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          v
                          i
                        
                        ,
                        1
                      
                      )
                    
                  
                  ,
                  
                    
                  
                  ⁢
                  
                    
                      for
                      ⁢
                      
                        
                      
                      ⁢
                      i
                    
                    =
                    1
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  L
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    where
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        r
                        i
                        *
                      
                      ⁢
                      
                        ⟵
                        U
                      
                      ⁢
                      span
                    
                    ⁢
                    
                      〈
                      
                        
                          b
                          
                            1
                            ,
                            
                              
                                3
                                ⁢
                                n
                              
                              +
                              1
                            
                          
                          *
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          b
                          
                            1
                            ,
                            
                              4
                              ⁢
                              n
                            
                          
                          *
                        
                      
                      〉
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    γ
                    i
                  
                  ,
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    :=
                    
                      
                        (
                        
                          
                            u
                            
                              i
                              ,
                              1
                            
                          
                          ,
                          ...
                          ⁢
                          
                            
                          
                          ,
                          
                            u
                            
                              i
                              ,
                              n
                            
                          
                        
                        )
                      
                      ⁢
                      
                        
                      
                      ⁢
                      are
                      ⁢
                      
                        
                      
                      ⁢
                      defined
                      ⁢
                      
                        
                      
                      ⁢
                      as
                    
                  
                
                ⁢
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      
                        
                          if
                          ⁢
                          
                            
                          
                          ⁢
                          i
                        
                        ∈
                        I
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      γ
                      i
                    
                    :=
                    
                      α
                      i
                    
                  
                  ,
                  
                    
                  
                  ⁢
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      {
                      
                        
                          
                            
                              u
                              ->
                            
                            i
                          
                          |
                          
                            
                              
                                u
                                ->
                              
                              i
                            
                            ·
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        =
                        
                          
                            0
                            ⩓
                            
                              u
                              
                                i
                                ,
                                1
                              
                            
                          
                          =
                          
                            β
                            i
                          
                        
                      
                      }
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          if
                          ⁢
                          
                            
                          
                          ⁢
                          i
                        
                        ∈
                        I
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      ⫬
                      
                        
                          v
                          ->
                        
                        i
                      
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      γ
                      i
                    
                    :=
                    
                      
                        α
                        i
                      
                      
                        
                          
                            v
                            ->
                          
                          i
                        
                        ·
                        
                          y
                          ->
                        
                      
                    
                  
                  ,
                  
                    
                  
                  ⁢
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      {
                      
                        
                          
                            
                              u
                              ->
                            
                            i
                          
                          |
                          
                            
                              
                                u
                                ->
                              
                              i
                            
                            ·
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        =
                        
                          β
                          i
                        
                      
                      }
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          if
                          ⁢
                          
                            
                          
                          ⁢
                          i
                        
                        ∉
                        I
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      γ
                      i
                    
                    :=
                    0
                  
                  ,
                  
                    
                  
                  ⁢
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      {
                      
                        
                          
                            
                              u
                              ->
                            
                            i
                          
                          |
                          
                            
                              
                                u
                                ->
                              
                              i
                            
                            ·
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        =
                        
                          
                            0
                            ⩓
                            
                              
                                u
                                ->
                              
                              
                                i
                                ,
                                1
                              
                            
                          
                          =
                          
                            β
                            i
                          
                        
                      
                      }
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        
                          if
                          ⁢
                          
                            
                          
                          ⁢
                          i
                        
                        ∉
                        I
                      
                      ⩓
                      
                        ρ
                        ⁡
                        
                          (
                          i
                          )
                        
                      
                    
                    =
                    
                      ⫬
                      
                        
                          v
                          ->
                        
                        i
                      
                    
                  
                  ,
                  
                    

                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      γ
                      i
                    
                    :=
                    0
                  
                  ,
                  
                    
                  
                  ⁢
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ⁢
                    
                      ⟵
                      U
                    
                    ⁢
                    
                      {
                      
                        
                          
                            
                              u
                              ->
                            
                            i
                          
                          |
                          
                            
                              
                                u
                                ->
                              
                              i
                            
                            ·
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        =
                        
                          β
                          i
                        
                      
                      }
                    
                  
                
                ⁢
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    s
                    
                      L
                      +
                      1
                    
                    *
                  
                  :=
                  
                    
                      ξ
                      ⁡
                      
                        (
                        
                          
                            k
                            
                              2
                              ,
                              1
                            
                            *
                          
                          +
                          
                            
                              
                                H
                                hk
                                
                                  λ
                                  ,
                                  D
                                
                              
                              (
                              m
                              
                            
                            ⁢
                            S
                          
                        
                        )
                      
                    
                    ·
                    
                      k
                      
                        2
                        ,
                        2
                      
                      *
                    
                  
                
              
              )
            
            +
            
              r
              
                L
                +
                1
              
              *
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              where
              ⁢
              
                
              
              ⁢
              
                
                  r
                  
                    L
                    +
                    1
                  
                  *
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                span
              
              ⁢
              
                〈
                
                  
                    b
                    
                      2
                      ,
                      5
                    
                    *
                  
                  ,
                  
                    b
                    
                      2
                      ,
                      6
                    
                    *
                  
                
                〉
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                return
                ⁢
                
                  
                
                ⁢
                σ
              
              :=
              
                
                  (
                  
                    
                      s
                      0
                      *
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      s
                      
                        L
                        +
                        1
                      
                      *
                    
                  
                  )
                
                .
              
            
          
        
        ⁢
        
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          223
          ⁢
          
            -
          
          ⁢
          2
        
        ]
      
    
  




The function and operation of the verification device 500 will be described.
As illustrated in FIG. 21, the verification device 500 includes a public parameter receiving part 510, a data receiving part 520, a verification data generation part 530, and a verification part 540. The verification data generation part 530 includes an f vector generation part 531, an s vector generation part 532, a random number generation part 533, and a verification element generation part 534.
With reference to FIG. 25, the process of the Ver algorithm will be described.
(S1001: Public Parameter Receiving Step)
With the communication device and via the network, for example, the public parameter receiving part 510 receives the public parameter pk generated by the key generation device 100.
(S1002: Signature Receiving Step)
With the communication device and via the network, for example, the data receiving part 520 receives the signature c transmitted by the signature device 400.
(S1003: f Vector Generation Step)
With the processing device, the f vector generation part 531 randomly generates a vector {right arrow over (f)}, as indicated in Formula 224.




  
    
      
        
          f
          ->
        
        ⁢
        
          ⟵
          U
        
        ⁢
        
          F
          q
          r
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          224
        
        ]
      
    
  




(S1004: s Vector Generation Step)
With the processing device, the s vector generation part 532 generates a vector {right arrow over (s)}T:=(s1, . . . , sL)T, as indicated in Formula 225.

{right arrow over (s)}T:=(s1, . . . ,sL)T:=M·{right arrow over (f)}T  [Formula 225]

With the processing device, the s vector generation part 532 also generates a value so, as indicated in Formula 226.

s0:={right arrow over (1)}·{right arrow over (f)}T  [Formula 226]

(S1005: Random Number Generation Step)
With the processing device, the random number generation part 533 generates random numbers, as indicated in Formula 227.




  
    
      
        
          η
          0
        
        ,
        
          η
          
            L
            +
            1
          
        
        ,
        
          θ
          
            L
            +
            1
          
        
        ,
        
          
            s
            
              L
              +
              1
            
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              
                
                  η
                  ->
                
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                
                  2
                  ⁢
                  n
                
              
            
            ⁢
            
              
            
            ⁢
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          

        
        ⁢
        
          
            
              
                θ
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ⁢
            
              
            
            ⁢
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          227
        
        ]
      
    
  




(S1006: Verification Element Generation Step)
With the processing device, the verification element generation part 534 generates an element c0 of a verification key, as indicated in Formula 228.

c0:=(−s0−sL+1,0,0,η0)0  [Formula 228]

With the processing device, the verification element generation part 534 also generates an element ci of the verification key for each integer i=1, . . . , L, as indicated in Formula 229.




  
    
      
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            
              
                v
                ->
              
              i
            
            :=
            
              (
              
                
                  v
                  i
                  
                    n
                    -
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  v
                  i
                
                ,
                1
              
              )
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              v
              i
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  e
                                  ->
                                
                                1
                              
                            
                            +
                            
                              
                                θ
                                i
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                t
                              
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      
                        
                          
                            0
                            
                              2
                              ⁢
                              n
                            
                          
                          ,
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                    
                    
                      
                        
                          
                            0
                            n
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      
                        
                          
                            η
                            ->
                          
                          i
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                    
                  
                
                )
              
              
                B
                1
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              t
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      
                        
                          
                            0
                            
                              2
                              ⁢
                              n
                            
                          
                          ,
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                    
                    
                      
                        
                          
                            0
                            n
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      
                        
                          
                            η
                            ->
                          
                          i
                        
                        
                          {
                          
                            2
                            ⁢
                            n
                          
                        
                      
                    
                  
                
                )
              
              
                B
                1
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          229
        
        ]
      
    
  




With the processing device, the verification element generation part 534 also generates an element cL+1 of the verification key, as indicated in Formula 230.

cL+1:=(sL+1−θL+1Hhkλ,D(m∥),θL+1,0,0,0,0,ηL+1) 2  [Formula 230]

(S1007: First Pairing Operation Step)
With the processing device, the verification part 540 computes a pairing operation e (b0,1, s*0).
If the result of computing the pairing operation e (b0,1, s*0) is a value 1, the verification part 540 outputs a value 0 indicating that the verification of the signature has failed, and ends the process. If the result of computing the pairing operation e (b0,1, s*0) is not a value 1, the verification part 540 advances the process to S1008.
(S1008: Second Pairing Operation Step)
With the processing device, the verification part 540 computes a pairing operation indicated in Formula 231.

Πi=0L+1e(ci,si*)  [Formula 231]

If the result of computing the pairing operation indicated in Formula 231 is a value 1, the verification part 540 outputs a value 1 indicating that the verification of the signature has succeeded. If the result is other than a value 1, the verification part 540 outputs a value 0 indicating that the verification of the signature has failed.
In brief, in (S1001) through (S1008), the verification device 500 verifies the signature σ by executing the Ver algorithm indicated in Formula 232.




  
    
      
        
          
        
        ⁢
        
          
            Ver
            ⁡
            
              (
              
                pk
                ,
                m
                ,
                
                  S
                  :=
                  
                    (
                    
                      M
                      ,
                      ρ
                    
                    )
                  
                
                ,
                σ
              
              )
            
          
          ⁢
          
            

          
          ⁢
          
            
              
                f
                ->
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                r
              
            
            ,
            
              
                
                  s
                  ->
                
                T
              
              :=
              
                
                  
                    (
                    
                      
                        s
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        s
                        L
                      
                    
                    )
                  
                  T
                
                :=
                
                  M
                  ·
                  
                    
                      f
                      ->
                    
                    T
                  
                
              
            
            ,
            
              
                s
                0
              
              :=
              
                
                  1
                  ->
                
                ·
                
                  
                    f
                    ->
                  
                  T
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              η
              0
            
            ,
            
              η
              
                L
                +
                1
              
            
            ,
            
              θ
              
                L
                +
                1
              
            
            ,
            
              
                s
                
                  L
                  +
                  1
                
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                0
              
              :=
              
                
                  (
                  
                    
                      
                        -
                        
                          s
                          0
                        
                      
                      -
                      
                        s
                        
                          L
                          +
                          1
                        
                      
                    
                    ,
                    0
                    ,
                    0
                    ,
                    
                      η
                      0
                    
                  
                  )
                
                
                  B
                  0
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                for
                ⁢
                
                  
                
                ⁢
                i
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            L
            ,
            
              
                
                  v
                  ->
                
                i
              
              :=
              
                (
                
                  
                    v
                    i
                    
                      n
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                ρ
                ⁢
                
                  (
                  i
                  )
                
              
              =
              
                v
                i
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  s
                  i
                  *
                
              
              ∉
              
                V
                1
              
            
            ,
            
              return
              ⁢
              
                
              
              ⁢
              0
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              else
              ⁢
              
                
              
              ⁢
              
                
                  θ
                  i
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
            
            ,
            
              
                
                  η
                  ->
                
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                
                  2
                  ⁢
                  n
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                      
                        
                          
                            
                              
                                
                                  s
                                  i
                                
                                ⁢
                                
                                  
                                
                                ⁢
                                
                                  
                                    e
                                    ->
                                  
                                  
                                    t
                                    ,
                                    1
                                  
                                
                              
                              +
                              
                                
                                  θ
                                  i
                                
                                ⁢
                                
                                  
                                    v
                                    ->
                                  
                                  t
                                
                              
                            
                            ,
                          
                          
                            {
                            n
                          
                        
                      
                      
                        
                          
                            
                              0
                              
                                2
                                ⁢
                                n
                              
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              n
                            
                          
                        
                      
                      
                        
                          
                            
                              0
                              n
                            
                            ,
                          
                          
                            {
                            n
                          
                        
                      
                      
                        
                          
                            
                              η
                              ->
                            
                            i
                          
                          
                            {
                            
                              2
                              ⁢
                              n
                            
                          
                        
                      
                    
                  
                  )
                
                
                  B
                  1
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                ⫬
                
                  v
                  i
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  s
                  i
                  *
                
              
              ∉
              
                V
                1
              
            
            ,
            
              return
              ⁢
              
                
              
              ⁢
              0
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              else
              ⁢
              
                
              
              ⁢
              
                
                  θ
                  i
                
                ⁢
                
                  ⟵
                  U
                
                ⁢
                
                  F
                  q
                
              
            
            ,
            
              
                
                  η
                  ->
                
                i
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                
                  2
                  ⁢
                  n
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                t
                              
                            
                            ,
                          
                          
                            {
                            n
                          
                        
                      
                      
                        
                          
                            
                              0
                              
                                2
                                ⁢
                                n
                              
                            
                            ,
                          
                          
                            {
                            
                              2
                              ⁢
                              n
                            
                          
                        
                      
                      
                        
                          
                            
                              0
                              n
                            
                            ,
                          
                          
                            {
                            n
                          
                        
                      
                      
                        
                          
                            
                              η
                              ->
                            
                            i
                          
                          
                            {
                            
                              2
                              ⁢
                              n
                            
                          
                        
                      
                    
                  
                  )
                
                
                  B
                  1
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
              c
              
                L
                +
                1
              
            
            :=
            
              (
              
                
                  
                    s
                    
                      L
                      +
                      1
                    
                  
                  -
                  
                    
                      θ
                      
                        L
                        +
                        1
                      
                    
                    ⁢
                    
                      
                        
                          H
                          hk
                          
                            λ
                            ,
                            D
                          
                        
                        (
                        
                          
                            m
                            ⁢
                            
                              
                              S
                              )
                            
                          
                          ,
                          
                            θ
                            
                              L
                              +
                              1
                            
                          
                          ,
                          0
                          ,
                          0
                          ,
                          0
                          ,
                          0
                          ,
                          
                            η
                            
                              L
                              +
                              1
                            
                          
                        
                        )
                      
                      
                        B
                        2
                      
                    
                  
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    return
                    ⁢
                    
                      
                    
                    ⁢
                    0
                    ⁢
                    
                      
                    
                    ⁢
                    if
                    ⁢
                    
                      
                    
                    ⁢
                    
                      e
                      ⁡
                      
                        (
                        
                          
                            b
                            
                              0
                              ,
                              1
                            
                          
                          ,
                          
                            s
                            0
                            *
                          
                        
                        )
                      
                    
                  
                  =
                  1
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  
                    return
                    ⁢
                    
                      
                    
                    ⁢
                    1
                    ⁢
                    
                      
                    
                    ⁢
                    if
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        ∏
                        
                          i
                          =
                          0
                        
                        
                          L
                          +
                          1
                        
                      
                      ⁢
                      
                        e
                        ⁡
                        
                          (
                          
                            
                              c
                              i
                            
                            ,
                            
                              s
                              i
                              *
                            
                          
                          )
                        
                      
                    
                  
                  =
                  1
                
                ,
                
                  

                
                ⁢
                
                  
                
                ⁢
                
                  return
                  ⁢
                  
                    
                  
                  ⁢
                  0
                  ⁢
                  
                    
                  
                  ⁢
                  
                    otherwise
                    .
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          232
        
        ]
      
    
  




As described above, it is possible to construct the ABS scheme to which the CP-ABE scheme described in Embodiment 2 is applied.
Similarly as in the CP-ABE scheme described in Embodiment 2 in which the size of the decryption key skΓ can be reduced, the size of the signature key skΓ can be reduced in the ABS scheme described in Embodiment 4.
The ABS scheme to which the CP-ABE scheme described in Embodiment 2 is applied has been described herein. It is also possible to construct an ABS scheme to which the CP-FE scheme described in Embodiment 3 is applied by applying the concept of Embodiment 3 to the ABS scheme described in Embodiment 4.
Embodiment 5
In the above embodiments, the methods for implementing the cryptographic processes in dual vector spaces have been described. In Embodiment 5, a method for implementing the cryptographic processes in dual modules will be described.
That is, in the above embodiments, the cryptographic processes are implemented in cyclic groups of prime order q. However, when a ring R is expressed using a composite number M as indicated in Formula 233, the cryptographic processes described in the above embodiments can be adapted to a module having the ring R as a coefficient.

  [Formula 233]

where

: integer, and

M: composite number.

By changing Fq to R in the algorithms described in the above embodiments, the cryptographic processes in dual additive groups can be implemented.
In the above embodiments, the encoding part, the hidden part, the secret key randomness part, and the ciphertext randomness part are n-, 2n-, 2n- and n-dimensional, respectively, and the basis B1 and basis B*1 are 6n-dimensional. However, it is not limited to this, and the hidden part, the secret key randomness part, and the ciphertext randomness part may be u-, w-, and z-dimensional not depending on n, respectively, and the basis B1 and basis B*1 may be n+u+w+z-dimensional, where u, w, and z are integers of 0 or greater.
In the above description, in the case of KP, an element of a ciphertext is generated using a first vector, and an element of a decryption key is generated using a second vector, in order to reduce the size of the ciphertext. However, in the case of KP, an element of a decryption key may be generated using a first vector, and an element of a ciphertext may be generated using a second vector, in order to reduce the size of the decryption key.
Similarly, in the above description, in the case of CP, an element of a decryption key is generated using a first vector, and an element of a ciphertext is generated using a second vector, in order to reduce the size of the decryption key. However, in the case of CP, an element of a ciphertext may be generated using a first vector, and an element of a decryption key may be generated using a second vector, in order to reduce the size of the ciphertext.
In the above embodiments, a single key generation device 100 generates a decryption key. However, a single decryption key may be generated by a plurality of key generation devices 100 by combining the algorithms of the above embodiments with a multi-authority scheme described in Non-Patent Literature 3.
From the view point of security proof, in the above embodiments, ρ(i) for each integer i=1, . . . , L may be limited to a positive tuple (t, {right arrow over (v)}) or negative tuple (t, {right arrow over (v)}) for respectively different identification information t.
In other words, when ρ(i)=(t, {right arrow over (v)}) or ρ(i)=(t, {right arrow over (v)}), let a function ρ ̃ be map of {1, . . . , L}→{1, . . . , d} such that ρ ̃(i)=t. In this case, ρ ̃ may be limited to injection. Note that ρ(i) is ρ(i) in the access structure S:=(M, ρ(i)) described above.
FIG. 26 is a diagram illustrating an example of a hardware configuration of each device (the key generation device 100, the encryption device 200, the decryption device 300, the signature device 400, and the verification device 500) of the cryptographic system 10 presented in Embodiments 1 to 5.
Each device of the cryptographic system 10 is a computer, and each element of each device of the cryptographic system 10 can be implemented by a program.
As the hardware configuration of each device of the cryptographic system 10, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input/output device 905 are connected to a bus.
The arithmetic device 901 is a CPU (Central Processing Unit) or the like that executes programs. The external storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, a hard disk device, or the like. The main storage device 903 is, for example, a RAM (Random Access Memory) or the like. The communication device 904 is, for example, a communication board or the like. The input/output device 905 is, for example, a mouse, a keyboard, a display device, or the like.
The programs are normally stored in the external storage device 902. The programs are loaded into the main storage device 903 to be sequentially read and executed by the arithmetic device 901.
The programs are those that implement the functions described as the master key generation part 110, the master key storage part 120, the information input part 130, the decryption key generation part 140, the key transmission part 150, the public parameter receiving part 210, the information input part 220, the encrypted data generation part 230, the data transmission part 240, the decryption key receiving part 310, the data receiving part 320, the span program computation part 330, the complementary coefficient computation part 340, the decryption part 350, the signature key receiving part 410, the information input part 420, the complementary coefficient computation part 430, the signature data generation part 440, the data transmission part 450, the public parameter receiving part 510, the data receiving part 520, the verification data generation part 530, and the verification part 540.
Further, an operating system (OS) is also stored in the external storage device 902. At least part of the OS is loaded into the main storage device 903, and the arithmetic device 901 executes the above-described programs while executing the OS.
Information, data, signal values, and variable values described as the “public parameter pk”, the “master secret key sk”, the “decryption keys skΓ and skS”, the “ciphertexts ctS and CtΓ”, the “Signature Key SkΓ”, the “Verification Key”, the “Access structure S”, the “attribute set Γ”, the “message m”, the “signature σ”, and so on in the description of Embodiments 1 to 5 are stored as files in the main storage device 903.
The configuration of FIG. 26 indicates an example of the hardware configuration of each device of the cryptographic system 10. The hardware configuration of each device of the cryptographic system 10 is not limited to the configuration of FIG. 26, and may be a different configuration.
REFERENCE SIGNS LIST


    
    
        100: key generation device, 110: master key generation part, 111: space generation part, 112: matrix generation part, 113: basis generation part, 114: key generation part, 120: master key storage part, 130: information input part, 140: decryption key generation part, 141: f vector generation part, 142: s vector generation part, 143: random number generation part, 144: key element generation part, 150: key transmission part, 200: encryption device, 210: public parameter receiving part, 220: information input part, 230: encrypted data generation part, 231: random number generation part, 232: cipher element generation part, 233: f vector generation part, 234: s vector generation part, 240: data transmission part, 300: decryption device, 310: decryption key receiving part, 320: data receiving part, 330: span program computation n part, 340: complementary coefficient computation part, 350: decryption part, 400: signature device, 410: signature key receiving part, 420: information input part, 430: complementary coefficient computation part, 440: signature data generation part, 441: random number generation part, 442: signature element generation part, 450: data transmission part, 500: verification device, 510: public parameter receiving part, 520: data receiving part, 530: verification data generation part, 531: f vector generation part, 532: s vector generation part, 533: random number generation part, 534: verification element generation part, and 540: verification part

## Claims

1. A cryptographic system to perform a cryptographic process using a basis B and a basis B*, the cryptographic system comprising:
processing circuitry to:
generate a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj (j=1, . . . , n) of a polynomial having attribute information xi (i=1, . . . , n′, n′ being an integer from 1 to n−1, n being an integer of 2 or greater) as roots and a second vector consisting of v1i (i=0, . . . , n−1) being a power of predicate information v1;
perform a pairing operation on the transmission-side vector and a reception-side vector being a vector in the basis B* and being generated using another vector of the first vector and the second vector; and
generate at least one of a ciphertext, decryption key and signature output of reduced size containing the transmission-side vector or reception-side vector to reduce processing time of an encryption or decryption process.

2. The cryptographic system according to claim 1, wherein
the basis B and the basis B* are bases which are generated by transforming a basis A by using a sparse matrix having at least one value other than a constant value 0 in each row and each column.

3. A cryptographic system to perform a cryptographic process using a basis B and a basis B*, the cryptographic system comprising:
processing circuitry to:
generate a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj (j=1, . . . , n) of a polynomial having attribute information xi (i=1, . . . , n′, n′ being an integer from 1 to n−1, n being an integer of 2 or greater) as roots and a second vector consisting of v1i (i=0, . . . , n−1) being a power of predicate information v1;
perform a pairing operation on the transmission-side vector and a reception-side vector being a vector in the basis B* and being generated using another vector of the first vector and the second vector; and
generate at least one of a ciphertext, decryption key, and signature output of reduced size containing the transmission-side vector or reception-side vector to reduce processing time of an encryption or decryption process, wherein
the first vector is a vector indicated in Formula 1, and
the second vector is a vector indicated in Formula 2


{right arrow over (y)}:=(y1, . . . ,yn) such that Σj=0n-1yn-jzj=zn-1-n′·(z−xj)  [Formula 1]



{right arrow over (v)}1:=(v1n-1n, . . . ,v1,1)  [Formula 2]

4. The cryptographic system according to claim 3, wherein
the processing circuitry generates at least one of a ciphertext ctΓ including a transmission-side vector c1 indicated in Formula 3, and
decrypts the ciphertext ctΓ by using a decryption key skS including a reception-side vector k*i indicated in Formula 4





  
    
      
        
          
            c
            1
          
          =
          
            
              (
              
                
                  
                    
                      
                        
                          ω
                          ⁢
                          
                            
                          
                          ⁢
                          
                            y
                            ->
                          
                        
                        ,
                      
                      
                        {
                        n
                      
                    
                  
                  
                    ...
                  
                
              
              )
            
            
              B
              1
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          ω
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          3
        
        ]
      
    
  
  
    
      
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              v
              i
            
          
          ,
          
            

          
          ⁢
          
            
              k
              i
              *
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  e
                                  ->
                                
                                1
                              
                            
                            +
                            
                              
                                θ
                                i
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                i
                              
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
                *
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              k
              i
              *
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
                *
              
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            
              f
              ->
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
              r
            
          
          ,
          
            

          
          ⁢
          
            
              
                s
                ->
              
              T
            
            :=
            
              
                
                  (
                  
                    
                      s
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      s
                      L
                    
                  
                  )
                
                T
              
              :=
              
                M
                ·
                
                  
                    f
                    ->
                  
                  T
                
              
            
          
          ,
          
            

          
          ⁢
          
            
              s
              0
            
            :=
            
              
                1
                ->
              
              ·
              
                
                  f
                  ->
                
                T
              
            
          
          ,
          
            

          
          ⁢
          
            
              θ
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              
                v
                ->
              
              i
            
            :=
            
              
                (
                
                  
                    v
                    i
                    
                      n
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          4
        
        ]

5. The cryptographic system according to claim 3, wherein
the processing circuitry generates at least one of a ciphertext ctS including a transmission-side vector ci indicated in Formula 5, and
decrypts the ciphertext ctS by using a decryption key skΓ including a reception-side vector k*1 indicated in Formula 6





  
    
      
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              v
              i
            
          
          ,
          
            

          
          ⁢
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  e
                                  ->
                                
                                1
                              
                            
                            +
                            
                              
                                θ
                                i
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                i
                              
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
              
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            f
            ->
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
            r
          
        
        ,
        
          

        
        ⁢
        
          
            
              s
              ->
            
            T
          
          :=
          
            
              
                (
                
                  
                    s
                    1
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    s
                    L
                  
                
                )
              
              T
            
            :=
            
              M
              ·
              
                
                  f
                  ->
                
                T
              
            
          
        
        ,
        
          

        
        ⁢
        
          
            s
            0
          
          :=
          
            
              1
              ->
            
            ·
            
              
                f
                ->
              
              T
            
          
        
        ,
        
          

        
        ⁢
        
          
            θ
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              v
              ->
            
            i
          
          :=
          
            (
            
              
                v
                i
                
                  n
                  -
                  1
                
              
              ,
              ...
              ⁢
              
                
              
              ,
              
                v
                i
              
              ,
              1
            
            )
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          5
        
        ]
      
    
  
  
    
      
        
          
            k
            1
            *
          
          =
          
            
              (
              
                
                  
                    
                      
                        
                          ω
                          ⁢
                          
                            
                          
                          ⁢
                          
                            y
                            ->
                          
                        
                        ,
                      
                      
                        {
                        n
                      
                    
                  
                  
                    ...
                  
                
              
              )
            
            
              B
              1
              *
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            ω
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          .
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          6
        
        ]

6. The cryptographic system according to claim 3, wherein
the processing circuitry generates at least one of a ciphertext ctΓ including a transmission-side vector c1.t indicated in Formula 7, and
decrypts the ciphertext ctΓ by using a decryption key skS including a reception-side vector k*i.t indicated in Formula 8





  
    
      
        
          
            
              c
              
                1
                ,
                t
              
            
            =
            
              
                (
                
                  
                    
                      
                        
                          
                            ω
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                y
                                ->
                              
                              t
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                
                  1
                  ,
                  t
                
              
            
          
          ⁢
          
            

          
          ⁢
          where
          ⁢
          
            

          
          ⁢
          ω
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              y
              ->
            
            t
          
          :=
          
            
              
                (
                
                  
                    y
                    
                      1
                      ,
                      t
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    y
                    
                      
                        n
                        t
                      
                      ,
                      t
                    
                  
                
                )
              
              ⁢
              
                
              
              ⁢
              such
              ⁢
              
                
              
              ⁢
              that
              ⁢
              
                
              
              ⁢
              
                
                  ∑
                  
                    j
                    =
                    0
                  
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    y
                    
                      
                        
                          n
                          t
                        
                        -
                        j
                      
                      ,
                      t
                    
                  
                  ⁢
                  
                    z
                    j
                  
                
              
            
            =
            
              
                z
                
                  
                    n
                    t
                  
                  -
                  1
                  -
                  
                    n
                    t
                    ′
                  
                
              
              ·
              
                
                  ∏
                  
                    j
                    =
                    1
                  
                  
                    n
                    t
                    ′
                  
                
                ⁢
                
                  (
                  
                    z
                    -
                    
                      x
                      
                        j
                        ,
                        t
                      
                    
                  
                  )
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          7
        
        ]
      
    
  
  
    
      
        
          
            for
            ⁢
            
              
            
            ⁢
            i
          
          =
          1
        
        ,
        ...
        ⁢
        
          
        
        ,
        L
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            (
            
              t
              ,
              
                v
                i
              
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              (
              
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                e
                                ->
                              
                              
                                1
                                ,
                                t
                              
                            
                          
                          +
                          
                            
                              θ
                              i
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                        
                        ,
                      
                      
                        {
                        
                          n
                          t
                        
                      
                    
                  
                  
                    ...
                  
                
              
              )
            
            
              B
              
                1
                ,
                t
              
              *
            
          
        
        ,
        
          

        
        ⁢
        
          
            if
            ⁢
            
              
            
            ⁢
            
              ρ
              ⁡
              
                (
                i
                )
              
            
          
          =
          
            ⫬
            
              (
              
                t
                ,
                
                  v
                  i
                
              
              )
            
          
        
        ,
        
          

        
        ⁢
        
          
            k
            i
            *
          
          :=
          
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              i
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                
                  1
                  ,
                  t
                
                *
              
            
            ⁢
            
              

            
            ⁢
            where
            ⁢
            
              

            
            ⁢
            
              
                f
                ->
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                r
              
            
          
        
        ,
        
          

        
        ⁢
        
          
            
              s
              ->
            
            T
          
          :=
          
            
              
                (
                
                  
                    s
                    1
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    s
                    L
                  
                
                )
              
              T
            
            :=
            
              M
              ·
              
                
                  f
                  ->
                
                T
              
            
          
        
        ,
        
          

        
        ⁢
        
          
            s
            0
          
          :=
          
            
              1
              ->
            
            ·
            
              
                f
                ->
              
              T
            
          
        
        ,
        
          

        
        ⁢
        
          
            θ
            i
          
          ⁢
          
            ⟵
            U
          
          ⁢
          
            F
            q
          
        
        ,
        
          

        
        ⁢
        
          
            
              v
              ->
            
            i
          
          :=
          
            
              (
              
                
                  v
                  i
                  
                    
                      n
                      t
                    
                    -
                    1
                  
                
                ,
                ...
                ⁢
                
                  
                
                ,
                
                  v
                  i
                
                ,
                1
              
              )
            
            .
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          8
        
        ]

7. The cryptographic system according to claim 3, wherein
the processing circuitry generates at least one of a ciphertext ctS including a transmission-side vector ci.t indicated in Formula 9, and
decrypts the ciphertext ctS by using a decryption key skΓ including a reception-side vector k*1.t indicated in Formula 10





  
    
      
        
          
        
        ⁢
        
          
            
              
                for
                ⁢
                
                  
                
                ⁢
                i
              
              =
              1
            
            ,
            ...
            ⁢
            
              
            
            ,
            L
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                (
                
                  t
                  ,
                  
                    v
                    i
                  
                
                )
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                      
                        
                          
                            
                              
                                
                                  s
                                  i
                                
                                ⁢
                                
                                  
                                
                                ⁢
                                
                                  
                                    e
                                    ->
                                  
                                  
                                    1
                                    ,
                                    t
                                  
                                
                              
                              +
                              
                                
                                  θ
                                  i
                                
                                ⁢
                                
                                  
                                    v
                                    ->
                                  
                                  i
                                
                              
                            
                            ,
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                      
                      
                        ...
                      
                    
                  
                  )
                
                
                  B
                  
                    1
                    ,
                    t
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                if
                ⁢
                
                  
                
                ⁢
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                ⫬
                
                  (
                  
                    t
                    ,
                    
                      v
                      i
                    
                  
                  )
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                c
                i
              
              :=
              
                
                  (
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                i
                              
                            
                            ,
                          
                          
                            {
                            
                              n
                              t
                            
                          
                        
                      
                      
                        ...
                      
                    
                  
                  )
                
                
                  B
                  
                    1
                    ,
                    t
                  
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          where
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              
                f
                ->
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
                r
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  s
                  ->
                
                T
              
              :=
              
                
                  
                    (
                    
                      
                        s
                        1
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        s
                        L
                      
                    
                    )
                  
                  T
                
                :=
                
                  M
                  ·
                  
                    
                      f
                      ->
                    
                    T
                  
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                s
                0
              
              :=
              
                
                  1
                  ->
                
                ·
                
                  
                    f
                    ->
                  
                  T
                
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                θ
                
                  i
                  ,
                  t
                
              
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            
              
                
                  v
                  ->
                
                i
              
              :=
              
                (
                
                  
                    v
                    i
                    
                      
                        n
                        t
                      
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          9
        
        ]
      
    
  
  
    
      
        
          
        
        ⁢
        
          
            
              k
              
                1
                ,
                t
              
              *
            
            =
            
              
                (
                
                  
                    
                      
                        
                          
                            ω
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                y
                                t
                              
                              ->
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                
                  1
                  ,
                  t
                
                *
              
            
          
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          where
          ⁢
          
            

          
          ⁢
          
            
          
          ⁢
          
            
              ω
              ⁢
              
                ⟵
                U
              
              ⁢
              
                F
                q
              
            
            ,
            
              

            
            ⁢
            
              
                
                  y
                  ->
                
                t
              
              :=
              
                
                  
                    (
                    
                      
                        y
                        
                          1
                          ,
                          t
                        
                      
                      ,
                      ...
                      ⁢
                      
                        
                      
                      ,
                      
                        y
                        
                          
                            n
                            t
                          
                          ,
                          t
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                  
                  ⁢
                  such
                  ⁢
                  
                    
                  
                  ⁢
                  that
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      ∑
                      
                        j
                        =
                        0
                      
                      
                        
                          n
                          t
                        
                        -
                        1
                      
                    
                    ⁢
                    
                      
                        y
                        
                          
                            
                              n
                              t
                            
                            -
                            j
                          
                          ,
                          t
                        
                      
                      ⁢
                      
                        z
                        j
                      
                    
                  
                
                =
                
                  
                    z
                    
                      
                        n
                        t
                      
                      -
                      1
                      -
                      
                        n
                        t
                        ′
                      
                    
                  
                  ·
                  
                    
                      ∏
                      
                        j
                        =
                        1
                      
                      
                        n
                        t
                        ′
                      
                    
                    ⁢
                    
                      
                        (
                        
                          z
                          -
                          
                            x
                            
                              j
                              ,
                              t
                            
                          
                        
                        )
                      
                      .
                    
                  
                
              
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          10
        
        ]

8. The cryptographic system according to claim 3, wherein
the processing circuitry generates a signature Sig including a transmission-side vector s*i indicated in Formula 11, and
verifies the signature Sig by using a verification key vk including a reception-side vector ci indicated in Formula 12





  
    
      
        
          
            
              s
              i
              *
            
            :=
            
              
                
                  
                    γ
                    i
                  
                  ·
                  ξ
                
                ⁢
                
                  
                
                ⁢
                
                  k
                  1
                  *
                
              
              +
              
                
                  ∑
                  
                    t
                    =
                    1
                  
                  n
                
                ⁢
                
                  
                    u
                    
                      i
                      ,
                      t
                    
                  
                  ·
                  
                    b
                    
                      1
                      ,
                      t
                    
                    *
                  
                
              
            
          
          ,
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            
              k
              1
              *
            
            =
            
              
                (
                
                  
                    
                      
                        
                          
                            ω
                            ⁢
                            
                              
                            
                            ⁢
                            
                              y
                              ->
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
                *
              
            
          
          ,
          
            

          
          ⁢
          
            ξ
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            γ
            i
          
          ,
          
            
              
                u
                ->
              
              i
            
            :=
            
              
                
                  
                    
                      (
                      
                        
                          u
                          
                            i
                            ,
                            1
                          
                        
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          u
                          
                            i
                            ,
                            n
                          
                        
                      
                      )
                    
                    ⁢
                    
                      
                    
                    ⁢
                    are
                    ⁢
                    
                      
                    
                    ⁢
                    defined
                    ⁢
                    
                      
                    
                    ⁢
                    as
                    ⁢
                    
                      

                    
                    ⁢
                    if
                    ⁢
                    
                      
                    
                    ⁢
                    i
                  
                  ∈
                  I
                
                ⩓
                
                  ρ
                  ⁡
                  
                    (
                    i
                    )
                  
                
              
              =
              
                
                  v
                  ->
                
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              γ
              i
            
            :=
            
              α
              i
            
          
          ,
          
            

          
          ⁢
          
            
              
                u
                ->
              
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              {
              
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  |
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ·
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                
                =
                
                  
                    0
                    ⩓
                    
                      u
                      
                        i
                        ,
                        1
                      
                    
                  
                  =
                  
                    β
                    i
                  
                
              
              }
            
          
          ,
          
            

          
          ⁢
          
            
              
                
                  if
                  ⁢
                  
                    
                  
                  ⁢
                  i
                
                ∈
                I
              
              ⩓
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                
                  v
                  ->
                
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              γ
              i
            
            :=
            
              
                α
                i
              
              
                
                  
                    v
                    ->
                  
                  i
                
                ·
                
                  y
                  ->
                
              
            
          
          ,
          
            

          
          ⁢
          
            
              
                u
                ->
              
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              {
              
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  |
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ·
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                
                =
                
                  β
                  i
                
              
              }
            
          
          ,
          
            

          
          ⁢
          
            
              
                
                  if
                  ⁢
                  
                    
                  
                  ⁢
                  i
                
                ∉
                I
              
              ⩓
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              
                v
                ->
              
              i
            
          
          ,
          
            

          
          ⁢
          
            
              γ
              i
            
            :=
            0
          
          ,
          
            

          
          ⁢
          
            
              
                u
                ->
              
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              {
              
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  |
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ·
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                
                =
                
                  
                    0
                    ⩓
                    
                      u
                      
                        i
                        ,
                        1
                      
                    
                  
                  =
                  
                    β
                    i
                  
                
              
              }
            
          
          ,
          
            

          
          ⁢
          
            
              
                
                  if
                  ⁢
                  
                    
                  
                  ⁢
                  i
                
                ∉
                I
              
              ⩓
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                
                  v
                  ->
                
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              γ
              i
            
            :=
            0
          
          ,
          
            

          
          ⁢
          
            
              
                u
                ->
              
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              {
              
                
                  
                    
                      u
                      ->
                    
                    i
                  
                  |
                  
                    
                      
                        u
                        ->
                      
                      i
                    
                    ·
                    
                      
                        v
                        ->
                      
                      i
                    
                  
                
                =
                
                  β
                  i
                
              
              }
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          11
        
        ]
      
    
  
  
    
      
        
          
            
              for
              ⁢
              
                
              
              ⁢
              i
            
            =
            1
          
          ,
          ...
          ⁢
          
            
          
          ,
          L
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              v
              i
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              
                                s
                                i
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  e
                                  ->
                                
                                1
                              
                            
                            +
                            
                              
                                θ
                                i
                              
                              ⁢
                              
                                
                                  v
                                  ->
                                
                                t
                              
                            
                          
                          ,
                        
                        
                          {
                          n
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
              
            
          
          ,
          
            

          
          ⁢
          
            
              if
              ⁢
              
                
              
              ⁢
              
                ρ
                ⁡
                
                  (
                  i
                  )
                
              
            
            =
            
              ⫬
              
                v
                i
              
            
          
          ,
          
            

          
          ⁢
          
            
              c
              i
            
            :=
            
              
                (
                
                  
                    
                      
                        
                          
                            
                              s
                              i
                            
                            ⁢
                            
                              
                            
                            ⁢
                            
                              
                                v
                                ->
                              
                              t
                            
                          
                          ,
                        
                        
                          {
                          
                            n
                            t
                          
                        
                      
                    
                    
                      ...
                    
                  
                
                )
              
              
                B
                1
              
            
          
        
        ⁢
        
          

        
        ⁢
        where
        ⁢
        
          

        
        ⁢
        
          
            
              f
              ->
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
              r
            
          
          ,
          
            

          
          ⁢
          
            
              
                s
                ->
              
              T
            
            :=
            
              
                
                  (
                  
                    
                      s
                      1
                    
                    ,
                    ...
                    ⁢
                    
                      
                    
                    ,
                    
                      s
                      L
                    
                  
                  )
                
                T
              
              :=
              
                M
                ·
                
                  
                    f
                    ->
                  
                  T
                
              
            
          
          ,
          
            

          
          ⁢
          
            
              s
              0
            
            :=
            
              
                1
                ->
              
              ·
              
                
                  f
                  ->
                
                T
              
            
          
          ,
          
            

          
          ⁢
          
            
              θ
              i
            
            ⁢
            
              ⟵
              U
            
            ⁢
            
              F
              q
            
          
          ,
          
            

          
          ⁢
          
            
              
                v
                ->
              
              i
            
            :=
            
              
                (
                
                  
                    v
                    i
                    
                      n
                      -
                      1
                    
                  
                  ,
                  ...
                  ⁢
                  
                    
                  
                  ,
                  
                    v
                    i
                  
                  ,
                  1
                
                )
              
              .
            
          
        
      
    
    
      
        [
        
          Formula
          ⁢
          
            
          
          ⁢
          12
        
        ]

9. A non-transitory computer readable medium storing a cryptographic program for performing a cryptographic process using a basis B and a basis B*, the cryptographic program causing a computer to execute:
a transmission-side process of generating a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj (j=1, n) of a polynomial having attribute information xi (i=1, . . . , n′, n′ being an integer from 1 to n−1, n being an integer of 2 or greater) as roots and a second vector consisting of v1i (i=0, . . . , n−1) being a power of predicate information v1;
a reception-side process of performing a pairing operation on the transmission-side vector and a reception-side vector being a vector in the basis B* and being generated using another vector of the first vector and the second vector; and
wherein at least one of the transmission-side process and reception-side process generates at least one of a ciphertext, decryption key and signature output of reduced size containing the transmission-side vector or reception-side vector to reduce processing time of an encryption or decryption process.