Patent Publication Number: US-9407438-B2

Title: Cryptographic system, cryptographic method, and cryptographic program

Description:
TECHNICAL FIELD 
     The present invention relates to a cryptographic system that allows for addition of an attribute category without reissuing a public parameter. 
     BACKGROUND ART 
     Non-Patent Literature 29 describes a functional encryption scheme. 
     CITATION LIST 
     Non-Patent Literature 
     
         
         Non-Patent Literature 1: Beimel, A., Secure schemes for secret sharing and key distribution. PhD Thesis, Israel Institute of Technology, Technion, Haifa, Israel, 1996. 
         Non-Patent Literature 2: Bethencourt, J., Sahai, A., Waters, B.: Ciphertext-policy attribute-based encryption. In: 2007 IEEE Symposium on Security and Privacy, pp. 321-334. IEEE Press (2007) 
         Non-Patent Literature 3: Boneh, D., Boyen, X.: Efficient selective-ID secure identity based encryption without random oracles. In: Cachin, C., Camenisch, J. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 223-238. Springer Heidelberg (2004) 
         Non-Patent Literature 4: Boneh, D., Boyen, X.: Secure identity based encryption without random oracles. In: Franklin, M. K. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 443-459. Springer Heidelberg (2004) 
         Non-Patent Literature 5: Boneh, D., Boyen, X., Goh, E.: Hierarchical identity based encryption with constant size ciphertext. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 440-456. Springer Heidelberg (2005) 
         Non-Patent Literature 6: Boneh, D., Boyen, X., Shacham, H.: Short group signatures. In: Franklin, M. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 41-55. Springer, Heidelberg (2004) 
         Non-Patent Literature 7: Boneh, D., Franklin, M.: Identity-based encryption from the Weil pairing. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 213-229. Springer Heidelberg (2001) 
         Non-Patent Literature 8: Boneh, D., Hamburg, M.: Generalized identity based and broadcast encryption scheme. In: Pieprzyk, J. (ed.) ASIACRYPT 2008. LNCS, vol. 5350, pp. 455-470. Springer Heidelberg (2008) 
         Non-Patent Literature 9: Boneh, D., Katz, J., Improved efficiency for CCA-secure cryptosystems built using identity based encryption. RSA-CT 2005, LNCS, Springer Verlag (2005) 
         Non-Patent Literature 10: Boneh, D., Waters, B.: Conjunctive, subset, and range queries on encrypted data. In: Vadhan, S. P. (ed.) TCC 2007. LNCS, vol. 4392, pp. 535-554. Springer Heidelberg (2007) 
         Non-Patent Literature 11: Boyen, X., Waters, B.: Anonymous hierarchical identity-based encryption (without random oracles). In: Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 290-307. Springer Heidelberg (2006) 
         Non-Patent Literature 12: Canetti, R., Halevi S., Katz J.: Chosen-ciphertext security from identity-based encryption. EUROCRYPT 2004, LNCS, Springer Heidelberg (2004) 
         Non-Patent Literature 13: Chase, M.: Multi-authority attribute based encryption. TCC, LNCS, pp. 515-534, Springer Heidelberg (2007). 
         Non-Patent Literature 14: Chase, M. and Chow, S.: Improving privacy and security in multi-authority attribute-based encryption, ACM Conference on Computer and Communications Security, pp. 121-130, ACM (2009). 
         Non-Patent Literature 15: Cocks, C.: An identity based encryption scheme based on quadratic residues. In: Honary, B. (ed.) IMA Int. Conf LNCS, vol. 2260, pp. 360-363. Springer Heidelberg (2001) 
         Non-Patent Literature 16: Gentry, C.: Practical identity-based encryption without random oracles. In: Vaudenay, S. (ed.) EUROCRYPT 2006. LNCS, vol. 4004, pp. 445-464. Springer Heidelberg (2006) 
         Non-Patent Literature 17: Gentry, C., Halevi, S.: Hierarchical identity-based encryption with polynomially many levels. In: Reingold, O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 437-456. Springer Heidelberg (2009) 
         Non-Patent Literature 18: Gentry, C., Silverberg, A.: Hierarchical ID-based cryptography. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS, vol. 2501, pp. 548-566. Springer Heidelberg (2002) 
         Non-Patent Literature 19: Goyal, V., Pandey, O., Sahai, A., Waters, B.: Attribute-based encryption for fine-grained access control of encrypted data. In: ACM Conference on Computer and Communication Security 2006, pp. 89-98, ACM (2006) 
         Non-Patent Literature 20: Katz, J., Sahai, A., Waters, B.: Predicate encryption supporting disjunctions, polynomial equations, and inner products. In: Smart, N. P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 146-162. Springer Heidelberg (2008) 
         Non-Patent Literature 21: Lewko, A., Okamoto, T., Sahai, A., Takashima, K., Waters, B.: Fully secure functional encryption: Attribute based encryption and (hierarchical) inner product encryption, EUROCRYPT 2010. LNCS, Springer Heidelberg (2010) 
         Non-Patent Literature 22: Lewko, A. B., Waters, B.: New techniques for dual system encryption and fully secure HIBE with short ciphertexts. In: Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp. 455-479. Springer Heidelberg (2010) 
         Non-Patent Literature 23: Lewko, A. B., Waters, B.: Decentralizing Attribute-Based Encryption, the proceedings of Eurocrypt 2011, LNCS, Springer Heidelberg (2011). 
         Non-Patent Literature 24: Lewko, A. B., Waters, B.: Unbounded HIBE and attribute-based encryption, the proceedings of Eurocrypt 2011, LNCS, Springer Heidelberg (2011). 
         Non-Patent Literature 25: H. Lin, Z. Cao, X. Liang, and J. Shao.: Secure threshold multi authority attribute based encryption without a central authority, INDOCRYPT, LNCS, vol. 5365, pp. 426-436, Springer Heidelberg (2008). 
         Non-Patent Literature 26: S. M{umlaut over ( )}uller, S. Katzenbeisser, and C. Eckert.; On multi-authority ciphertext-policy attribute-based encryption, Bull. Korean Math Soc. 46, No. 4, pp. 803-819 (2009). 
         Non-Patent Literature 27: Okamoto, T., Takashima, K.: Homomorphic encryption and signatures from vector decomposition. In: Galbraith, S. D., Paterson, K. G. (eds.) Pairing 2008. LNCS, vol. 5209, pp. 57-74, Springer Heidelberg (2008) 
         Non-Patent Literature 28: Okamoto, T., Takashima, K.: Hierarchical predicate encryption for inner-products, In: ASIACRYPT 2009, Springer Heidelberg (2009) 
         Non-Patent Literature 29: Okamoto, T., Takashima, K.: Fully secure functional encryption with general relations from the decisional linear assumption. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 191-208. Springer Heidelberg (2010). Full version is available at http://eprint.iacr.org/2010/563 
         Non-Patent Literature 30: Okamoto, T., Takashima, K.: Efficient attribute-based signatures for non-monotone predicates in the standard model, In: PKC 2011, Springer Heidelberg (2011) 
         Non-Patent Literature 31: Okamoto, T., Takashima, K.: Decentralized Attribute-Based Signatures http://eprint.iacr.org/2011/701 
         Non-Patent Literature 32: Ostrovsky, R., Sahai, A., Waters, B.: Attribute-based encryption with non-monotonic access structures. In: ACM Conference on Computer and Communication Security 2007, pp. 195-203, ACM (2007) 
         Non-Patent Literature 33: Pirretti, M., Traynor, P., McDaniel, P., Waters, B.: Secure attribute-based systems. In: ACM Conference on Computer and Communication Security 2006, pp. 99-112, ACM, (2006) 
         Non-Patent Literature 34: Sahai, A., Waters, B.: Fuzzy identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457-473. Springer Heidelberg (2005) 
         Non-Patent Literature 35: Shi, E., Waters, B.: Delegating capability in predicate encryption systems. In: Aceto, L., Damgård, I., Goldberg, L. A., Halldørsson, M. M., Ingølfsdøttir, A., Walukiewicz, I. (eds.) ICALP (2) 2008. LNCS, vol. 5126, pp. 560-578. Springer Heidelberg (2008) 
         Non-Patent Literature 36: Waters, B.: Efficient identity based encryption without random oracles. Eurocrypt 2005, LNCS, vol. 3152, pp. 443-459. Springer Verlag, (2005) 
         Non-Patent Literature 37: Waters, B.: Ciphertext-policy attribute-based encryption: an expressive, efficient, and provably secure realization. ePrint, IACR, http://eprint.iacr.org/2008/290 
         Non-Patent Literature 38: Waters, B.: Dual system encryption: realizing fully secure IBE and HIBE under simple assumptions. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 619-636. Springer Heidelberg (2009) 
       
    
     SUMMARY OF INVENTION 
     Technical Problem 
     In the functional encryption scheme described in Non-Patent Literature 29, a pair of a basis B t  and a basis B* t  is required for each attribute category. When an attribute category is to be added, a new pair of a basis B t  and a basis B* t  needs to be generated. This makes it necessary to reissue a public parameter because the basis B t  is included in the public parameter. 
     It is an object of the present invention to allow for addition of an attribute category without reissuing a public parameter. 
     Solution to Problem 
     A cryptographic system according to the present invention is configured to perform a process using a predetermined basis B and a predetermined basis B*, and the cryptographic system includes: 
     a transmission device configured to generate a transmission-side vector t j  for at least one index j out of a plurality of indices j, the transmission-side vector t j  being a vector in which information J assigned in advance to the index j is set as a coefficient of a predetermined basis vector b index  of the basis B, and a parameter Φ j  for the index j is set as a coefficient of another basis vector b att  of the basis B; and 
     a reception device configured to use a reception-side vector r j′  for at least one index j′ out of a plurality of indices j′, the reception-side vector r j′  being a vector in which information J′ having an inner-product of 0 with the information J assigned in advance to the index j corresponding to the index j′ is set as a coefficient of a basis vector b* index  of the basis B* corresponding to the basis vector b index , and a parameter Ψ j′  for the index j′ is set as a coefficient of a basis vector b* att  of the basis B* corresponding to the basis vector b att , and compute a product of pairing operations on corresponding pairs of the basis vectors of the transmission-side vector t j  for the index j and the reception-side vector r j′  for the index j′ corresponding to the index j. 
     Advantageous Effects of Invention 
     In a cryptographic system according to the present invention, information J which is assigned in advance to index j is set in a transmission-side vector t j , and information J′ having an inner-product of 0 with the information J is set in a reception-side vector r j′ . With this arrangement, a basis B and a basis B* can be used commonly for all attribute categories with security maintained, thus eliminating the need for using a basis B t  and a basis B* t  for each category. As a result, when an attribute category is to be added, there is no need to newly generate a basis B t  and a basis B* t , thus allowing for addition of an attribute category without reissuing a public parameter. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is an explanatory drawing of a matrix M^; 
         FIG. 2  is an explanatory drawing of a matrix M δ ; 
         FIG. 3  is an explanatory drawing of s 0 ; 
         FIG. 4  is an explanatory drawing of s{right arrow over ( 0 )} T ; 
         FIG. 5  is a configuration diagram of a cryptographic system  10  that implements a KP-FE scheme according to Embodiment 2; 
         FIG. 6  is a configuration diagram of a key generation device  100  according to Embodiment 2; 
         FIG. 7  is a configuration diagram of an encryption device  200  according to Embodiment 2; 
         FIG. 8  is a configuration diagram of a decryption device  300  according to Embodiment 2; 
         FIG. 9  is a flowchart illustrating the process of a Setup algorithm according to Embodiment 2; 
         FIG. 10  is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 2; 
         FIG. 11  is a flowchart illustrating the process of an Enc algorithm according to Embodiment 2; 
         FIG. 12  is a flowchart illustrating the process of a Dec algorithm according to Embodiment 2; 
         FIG. 13  is a configuration diagram of a cryptographic system  10  that implements a CP-FE scheme according to Embodiment 3; 
         FIG. 14  is a configuration diagram of a key generation device  100  according to Embodiment 3; 
         FIG. 15  is a configuration diagram of an encryption device  200  according to Embodiment 3; 
         FIG. 16  is a configuration diagram of a decryption device  300  according to Embodiment 3; 
         FIG. 17  is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 3; 
         FIG. 18  is a flowchart illustrating the process of an Enc algorithm according to Embodiment 3; 
         FIG. 19  is a flowchart illustrating the process of a Dec algorithm according to Embodiment 3; 
         FIG. 20  is a configuration diagram of a cryptographic system  10  that implements an HIPE scheme according to Embodiment 4; 
         FIG. 21  is a configuration diagram of a key generation device  100  according to Embodiment 4; 
         FIG. 22  is a configuration diagram of an encryption device  200  according to Embodiment 4; 
         FIG. 23  is a configuration diagram of a decryption device  300  according to Embodiment 4; 
         FIG. 24  is a configuration diagram of a key delegation device  400  according to Embodiment 4; 
         FIG. 25  is a flowchart illustrating the process of a Setup algorithm according to Embodiment 4; 
         FIG. 26  is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 4; 
         FIG. 27  is a flowchart illustrating the process of an Enc algorithm according to Embodiment 4; 
         FIG. 28  is a flowchart illustrating the process of a Dec algorithm according to Embodiment 4; 
         FIG. 29  is a flowchart illustrating the process of a Delegate L  algorithm according to Embodiment 4; 
         FIG. 30  is a configuration diagram of a cryptographic system  10  that implements a signature scheme according to Embodiment 5; 
         FIG. 31  is a configuration diagram of a key generation device  100  according to Embodiment 5; 
         FIG. 32  is a configuration diagram of a signature device  500  according to Embodiment 5; 
         FIG. 33  is a configuration diagram of a verification device  600  according to Embodiment 5; 
         FIG. 34  is a flowchart illustrating the process of a Setup algorithm according to Embodiment 5; 
         FIG. 35  is a flowchart illustrating the process of a KeyGen algorithm according to Embodiment 5; 
         FIG. 36  is a flowchart illustrating the process of a Sig algorithm according to Embodiment 5; 
         FIG. 37  is a flowchart illustrating the process of a Ver algorithm according to Embodiment 5; 
         FIG. 38  is an explanatory drawing of multi-authority; 
         FIG. 39  is an explanatory drawing of a functional encryption scheme that allows for addition of an attribute category in a case of multi-authority; and 
         FIG. 40  is a diagram illustrating an example of a hardware configuration of the key generation device  100 , the encryption device  200 , the decryption device  300 , the key delegation device  400 , the signature device  500 , and the verification device  600 . 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     Embodiments of the present invention will be described hereinafter with reference to the accompanying drawings. 
     In the following description, a processing device is a CPU  911  or the like to be described later. A storage device is a ROM  913 , a RAM  914 , a magnetic disk  920  or the like to be described later. A communication device is a communication board  915  or the like to be described later. An input device is a keyboard  902 , the communication board  915  or the like to be described later. That is, the processing device, the storage device, the communication device, and the input device are hardware. 
     Notations to be used in the following description will be described. 
     When A is a random variable or distribution, Formula 101 denotes that y is randomly selected from A according to the distribution of A. That is, y is a random number in Formula 101. 
     
       
         
           
             
               
                 
                   y 
                   ⁢ 
                   
                     ⟵ 
                     R 
                   
                   ⁢ 
                   A 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     101 
                   
                   ] 
                 
               
             
           
         
       
     
     When A is a set, Formula 102 denotes that y is uniformly selected from A. That is, y is a uniform random number in Formula 102. 
     
       
         
           
             
               
                 
                   y 
                   ⁢ 
                   
                     ⟵ 
                     U 
                   
                   ⁢ 
                   A 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     102 
                   
                   ] 
                 
               
             
           
         
       
     
     Formula 103 denotes that y is a set defined or substituted by z.
 
 y:=z   [Formula 103]
 
     When  a  is a fixed value, Formula 104 denotes that a machine (algorithm) A outputs  a  on input x.
 
 A ( x )→ a   [Formula 104]
 
For example,
 
 A ( x )→1
 
     Formula 105, namely F q , denotes a finite field of order q.
 
   q   [Formula 105]
 
     A vector symbol denotes a vector representation over the finite field F q , as indicated in Formula 106.
 
 {right arrow over (x)}  denotes
 
( x   1   , . . . ,x   n )ε   q   n   [Formula 106]
 
     Formula 107 denotes that the inner-product, indicated in Formula 109, of two vectors x{right arrow over ( )} and v{right arrow over ( )} indicated in Formula 108.
 
 {right arrow over (x)}·{right arrow over (v)}   [Formula 107]
 
 {right arrow over (x)} =( x   1   , . . . ,x   n ),
 
 {right arrow over (v)} =( v   1   , . . . ,v   n )  [Formula 109]
 
Σ i=1   n   x   i   v   i   [Formula 109]
 
     Note that X T  denotes the transpose of a matrix X. 
     When b i  (i=1, . . . , n) is an element of a vector of a space V, that is when Formula 110 is established, Formula 111 denotes a subspace generated by Formula 112.
 
 b   i ε ( i= 1 , . . . ,n )  [Formula 110]
 
span b 1   , . . . ,b   n     ⊂   (resp. span    {right arrow over (x)}   1   , . . . ,{right arrow over (x)}   n   )  [Formula 111]
 
 b   1   , . . . ,b   n (resp.  {right arrow over (x)}   1   , . . . ,{right arrow over (x)}   n )  [Formula 112]
 
     For a basis B and a basis B* indicated in Formula 113, Formula 114 is established.
 
 :=( b   1   , . . . ,b   N ),
 
 *:=( b*   1   , . . . ,b*   N )  [Formula 113]
 
( x   1   , . . . ,x   N ) :=Σ i=1   N   x   i   b   i ,
 
( y   1   , . . . ,y   N ) :=Σ i=1   N   y   i   b*   i   [Formula 114]
 
     Note that e{right arrow over ( )} j  denotes an orthonormal basis vector indicated in Formula 115. 
     
       
         
           
             
               
                 
                   
                     
                       
                         
                           ⅇ 
                           → 
                         
                         j 
                       
                       : 
                       
                         
                           ( 
                           
                             
                               
                                 0 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 ⋯ 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   j 
                                   - 
                                   1 
                                 
                               
                             
                             , 
                             1 
                             , 
                             
                               
                                 0 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 ⋯ 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   n 
                                   - 
                                   j 
                                 
                               
                             
                           
                           ) 
                         
                         ∈ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ?? 
                             q 
                             n 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           j 
                         
                       
                     
                     = 
                     1 
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   n 
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     115 
                   
                   ] 
                 
               
             
           
         
       
     
     In the following description, when “Vt” is shown as a subscript or superscript, this Vt denotes V t . Likewise, when “δi,j” is shown as a superscript, this δi,j denotes δ i,j . 
     When “→” representing a vector is attached to a subscript or superscript, it is meant that this “→” is attached as a superscript to the subscript or superscript. 
     In the following description, processes of cryptographic primitives include not only a narrowly-defined cryptographic process for keeping information secure from a third party, but also include a signature process. The processes of the cryptographic primitives include a key generation process, an encryption process, a decryption process, a key delegation process, a signature process, and a verification process. 
     Embodiment 1 
     This embodiment describes a basic concept for implementing the processes of the cryptographic primitives to be described in the following embodiments that allow for addition of an attribute category without reissuing a public parameter. 
     First, addition of an attribute category will be described. 
     Second, a functional encryption scheme and a basic construction of the functional encryption scheme will be briefly described. 
     Third, a key technique for realizing addition of an attribute category without reissuing a public parameter will be described. 
     Fourth, a space having a rich mathematical structure called “dual pairing vector spaces (DPVS)” which is a space for implementing the functional encryption scheme will be described. 
     Fifth, a concept for implementing the functional encryption scheme will be described. Here, “span program”, “inner-product of attribute information and access structure”, and “secret distribution scheme (secret sharing scheme)” will be described. 
     &lt;1. Addition of an Attribute Category&gt; 
     An attribute category is a classification of an attribute of each user, such as belonging organization, belonging department, position in company, age, and gender. 
     The processes of the cryptographic primitives to be described in the following embodiments realize access control based on the user&#39;s attribute. For example, with a narrowly-defined cryptographic process for securing information from a third party, whether or not the user can decrypt a ciphertext is controlled based on the user&#39;s attribute. 
     Generally, attribute categories used for access control are determined in advance at the design stage of a system. However, there may be a case where the operational rules of the system are changed at a later stage, necessitating addition of an attribute category used for access control. 
     For example, suppose that a cryptographic system is constructed on the assumption that the system is to be used only within Company A. In this case, it is assumed that the attribute categories to be used are, for example, belonging department, position in company, and individual ID. However, suppose that the operational rules are changed at a later stage so that the cryptographic system is used not only in Company A but also in associated companies of Company A. In this case, belonging company needs to be newly set as an attribute category to be used. 
     If the attribute categories used for access control are specified by a public parameter, adding an attribute category at a later stage requires that the public parameter be reissued and redistributed to each user. For this reason, an attribute category cannot be easily added at a later stage, and an operational mode that was not taken into consideration at the design stage of the system cannot be flexibly adopted. 
     Therefore, it is important to allow for addition of an attribute category without reissuing a public parameter. 
     &lt;2. Functional Encryption Scheme&gt; 
     The functional encryption scheme is an encryption scheme that provides more sophisticated and flexible relations between an encryption key ek and a decryption key dk. 
     According to the functional encryption scheme, a parameter Φ and a parameter Ψ are set in the encryption key ek and the decryption key dk, respectively. The decryption key dk can decrypt a ciphertext encrypted with the encryption key ek if and only if a relation R (Φ, Ψ) holds. 
     The functional encryption scheme includes an attribute-based encryption scheme and an 1D-based encryption scheme. 
     The construction of the functional encryption scheme will be briefly described. 
     The functional encryption scheme consists of four algorithms: Setup, KeyGen, Enc, and Dec. 
     (Setup) 
     A Setup algorithm is an algorithm that outputs a public parameter pk and a master key sk. 
     (KeyGen) 
     A KeyGen algorithm is an algorithm that takes as input the public parameter pk, the master key sk, and a parameter Ψ, and outputs a decryption key sk Ψ . 
     (Enc) 
     An Enc algorithm is an algorithm that takes as input the public parameter pk, a parameter Φ, and a message m, and outputs a ciphertext ct Φ . 
     (Dec) 
     A Dec algorithm is an algorithm that takes as input the public parameter pk, the decryption key sk Ψ , and the ciphertext ct Φ , and outputs the message m or a distinguished symbol ⊥. 
     The ciphertext ct Φ  can be decrypted with the decryption key sk Ψ  to obtain the message m if and only if the parameter Ψ and the parameter Φ satisfy the relation R (if R(Φ, Ψ) holds). 
     Generally, the Setup algorithm is executed only once at system setup. The KeyGen algorithm is executed each time a decryption key sk Ψ  of a user is to be generated. The Enc algorithm is executed each time a message m is to be encrypted. The Dec algorithm is executed each time a ciphertext ct Φ  is to be decrypted. 
     &lt;3. Key Technique&gt; 
     The key technique for realizing addition of an attribute category without reissuing a public parameter is to apply an indexing technique to dual system encryption in the dual pairing vector spaces. 
     In the dual system encryption in the dual pairing vector spaces, a pair of dual bases, a basis B and a basis B*, are randomly generated. Then, a part of the basis B (basis B^) is used as a public parameter. 
     In the functional encryption scheme described in Non-Patent Literature 29, a basis B^ 1 , . . . , and a basis B^ d  are generated as a public parameter. One attribute category is assigned to each basis B^ t  corresponding to each integer t=1, . . . , d. That is, d pieces of attribute categories can be handled. 
     As is evident from the fact that the basis B^ 1 , . . . , and the basis B^ d  are used as the public parameter, the public parameter needs to be reissued to add a basis B^, that is, to increase the value of d, at a later stage. In other words, the value of d is bounded by the public parameter. 
     In the functional encryption scheme to be described in the following embodiments, a basis B^ is generated as a public parameter. Two-dimensional index vectors, σ t (1, t) and μ i (t, −1), corresponding to each integer t=1, . . . , d are set in a ciphertext c and a secret key k*, respectively, such that one attribute category is assigned to each integer t. That is, d pieces of attribute categories can be handled. 
     Note here that the public parameter includes the basis B^ but not the index vectors. Hence, when index vectors are to be added at a later stage to increase the value of d, there is no need to reissue the public parameter. In other words, the value of d is not bounded by the public parameter. 
     &lt;4. Dual Pairing Vector Spaces&gt; 
     First, symmetric bilinear pairing groups will be described. 
     Symmetric bilinear pairing groups (q, G, G T , g, e) are a tuple of a prime q, a cyclic additive group G of order q, a cyclic multiplicative group G T  of order q, g≠0εG, and a polynomial-time computable nondegenerate bilinear pairing e:G×G→G T . The nondegenerate bilinear pairing signifies e(sg, tg)=e(g, g) st , and e(g, g)≠1. 
     In the following description, let G bpg  be an algorithm that takes as input 1 λ  and outputs values of a parameter param G :=(q, G, G T , g, e) of bilinear pairing groups with a security parameter λ. 
     Dual pairing vector spaces will now be described. 
     Dual pairing vector spaces (q, V, G T , A, e) can be constructed by a direct product of the symmetric bilinear pairing groups (param G :=(q, G, G T , g, e)). The dual pairing vector spaces (q, V, G T , A, e) are a tuple of a prime q, an N-dimensional vector space V over F q  indicated in Formula 116, a cyclic group G T  of order q, and a canonical basis A:=(a 1 , . . . , a N ) of the space V, and have the following operations (1) and (2), where a i  is as indicated in Formula 117. 
     
       
         
           
             
               
                 
                   ?? 
                   := 
                   
                     
                       ?? 
                       × 
                       ⋯ 
                       × 
                       ?? 
                     
                     
                       ︷ 
                       N 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     116 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     a 
                     i 
                   
                   := 
                   
                     ( 
                     
                       
                         
                           0 
                           , 
                           ⋯ 
                           ⁢ 
                           
                               
                           
                           , 
                           0 
                         
                         
                           ︷ 
                           
                             i 
                             - 
                             1 
                           
                         
                       
                       , 
                       g 
                       , 
                       
                         
                           0 
                           , 
                           ⋯ 
                           ⁢ 
                           
                               
                           
                           , 
                           0 
                         
                         
                           ︷ 
                           
                             N 
                             - 
                             i 
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     117 
                   
                   ] 
                 
               
             
           
         
       
     
     Operation (1): Nondegenerate Bilinear Pairing 
     A pairing in the space V is defined by Formula 118.
 
 e ( x,y ):=Π i=1   N   e ( G   i   ,H   i )ε   T   [Formula 118]
 
where
 
( G   1   , . . . ,G   N ):= xε     ,  
 
( H   1   , . . . ,H   N ):= yε       
 
     This is nondegenerate bilinear, that is, e(sx, ty)=e(x, y) st  and if e(x, y)=1 for all yεV, then x=0. For all i and j, e(a i , a j )=e(g, g) δi,j , where δ i,j =1 if i=j, and δ i,j =0 if i≠j, and e(g, g)≠1εG T . 
     Operation (2): Distortion Maps 
     Linear transformations φ i,j  on the space V indicated in Formula 119 can achieve Formula 120. 
     
       
         
           
             
               
                 
                   
                     
                       If 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ϕ 
                           
                             i 
                             , 
                             j 
                           
                         
                         ⁡ 
                         
                           ( 
                           
                             a 
                             j 
                           
                           ) 
                         
                       
                     
                     = 
                     
                       
                         a 
                         i 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       and 
                     
                   
                   ⁢ 
                   
                      
                   
                   ⁢ 
                   
                     
                       k 
                       ≠ 
                       j 
                     
                     , 
                     
                       
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             ϕ 
                             
                               i 
                               , 
                               j 
                             
                           
                           ⁡ 
                           
                             ( 
                             
                               a 
                               k 
                             
                             ) 
                           
                         
                       
                       = 
                       0. 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     119 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         ϕ 
                         
                           i 
                           , 
                           j 
                         
                       
                       ⁡ 
                       
                         ( 
                         x 
                         ) 
                       
                     
                     := 
                     
                       ( 
                       
                         
                           
                             0 
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             0 
                           
                           
                             ︷ 
                             
                               i 
                               - 
                               1 
                             
                           
                         
                         , 
                         
                           g 
                           j 
                         
                         , 
                         
                           
                             0 
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             0 
                           
                           
                             ︷ 
                             
                               N 
                               - 
                               i 
                             
                           
                         
                       
                       ) 
                     
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       where 
                       ⁢ 
                       
                         
 
                       
                       ( 
                       
                         
                           g 
                           1 
                         
                         , 
                         
                           ⋯ 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             g 
                             N 
                           
                         
                       
                       ) 
                     
                     := 
                     x 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     120 
                   
                   ] 
                 
               
             
           
         
       
     
     The linear transformations φ i,j  will be called distortion maps. 
     In the following description, let G dpvs  be an algorithm that takes as input 1 λ  (λε natural number), Nε natural number, and values of a parameter param G :=(q, G, G T , g, e) of bilinear pairing groups, and outputs values of a parameter param V :=(q, V, G T , A, e) of dual pairing vector spaces with a security parameter λ and an N-dimensional space V. 
     Description will be directed herein to a case where the dual pairing vector spaces are constructed using the above-described symmetric bilinear pairing groups. The dual pairing vector spaces can also be constructed using asymmetric bilinear pairing groups. The following description can easily be adapted to a case where the dual pairing vector spaces are constructed using asymmetric bilinear pairing groups. 
     &lt;5. Concept for Implementing Functional Encryption&gt; 
     &lt;5-1. Span Program&gt; 
       FIG. 1  is an explanatory drawing of a matrix M^. 
     Let {p 1 , . . . , p n } be a set of variables. M^:=(M, ρ) is a labeled matrix. The matrix M is an (L rows×r columns) matrix over F q , and ρ is a label of rows of the matrix M and is related to one of literals {p 1 , . . . ,p n ,  p 1 , . . . ,  p n }. Alabel ρ i  (i=1, . . . L) of each row of M is related to one of the literals. That is, ρ: {1, . . . , L}→{p 1 , . . . , p n ,  p 1 , . . . ,  p n }. 
     For every input sequence δε{0, 1} n , a submatrix M δ  of the matrix M is defined. The matrix M δ  is a submatrix consisting of those rows of the matrix M the labels ρ of which are related to a value “1” by the input sequence δ. That is, the matrix M δ  is a submatrix consisting of the rows of the matrix M which are related to p i  such that δ i =1 and the rows of the matrix M which are related to  p i  such that δ i =0. 
       FIG. 2  is an explanatory drawing of the matrix M δ . In  FIG. 2 , note that n=7, L=6, and r=5. That is, the set of variables is {p 1 , . . . , p 7 }, and the matrix M is a (6 rows×5 columns) matrix. In  FIG. 2 , assume that the labels ρ are related such that ρ 1  is related to  p 2 , ρ 2  to p 1 , ρ 3  to p 4 , ρ 4  to  p 5 , ρ 5  to  p 3 , and ρ 6  to p 5 . 
     Assume that in an input sequence δε{0, 1} 7 , δ 1 =1, δ 2 =0, δ 3 =1, δ 4 =0, δ 5= 0, δ 6 =1, and δ 7 =1. In this case, a submatrix consisting of the rows of the matrix M which are related to literals (p 1 , p 3 , p 6 , p 7 ,  p 2 ,  p 4 ,  p 5 ) surrounded by broken lines is the matrix M δ . That is, the submatrix consisting of the first row (M 1 ), second row (M 2 ), and fourth row (M 4 ) of the matrix M is the matrix M δ . 
     In other words, when map γ:{1, . . . , L}→{0, 1} is [ρ(j)=p i ]^[δ i =1] or [ρ(j)= p i ] [δ i =0], then γ(j)=1; otherwise γ(j)=0. In this case, M δ :=(M j ) δ(j)=1 . Note that M j  is the j-th row of the matrix M. 
     That is, in  FIG. 2 , map γ(j)=1 (j=1, 2, 4), and map γ(j)=0 (j=3, 5, 6). Hence, (M j ) γ(j)=1  is M 1 , M 2 , and M 4 , and the matrix M δ . 
     More specifically, whether or not the j-th row of the matrix M is included in the matrix M δ  is determined by whether the value of the map γ(j) is “0” or “1”. 
     The span program M^ accepts an input sequence δ if and only if 1{right arrow over ( )}εspan&lt;M δ &gt;, and rejects the input sequence δ otherwise. That is, the span program M^ accepts the input sequence δ if and only if linear combination of the rows of the matrix M δ  which are obtained from the matrix M^ by the input sequence δ gives 1{right arrow over ( )}. 1{right arrow over ( )} is a row vector which has a value “1” in each element. 
     For example, in  FIG. 2 , the span program M^ accepts the input sequence δ if and only if linear combination of the respective rows of the matrix M δ  consisting of the 1st, 2nd, and 4th rows of the matrix M gives 1{right arrow over ( )}. That is, if there exist α 1 , α 2 , and α 4  with which α 1 (M 1 )+α 2 (M 2 )+α 4 (M 4 )={right arrow over (1)}, the span program M^ accepts the input sequence δ. 
     The span program is called monotone if its labels ρ are related to only positive literals {p 1 , . . . , p n }. The span program is called non-monotone if its labels ρ are related to the literals {p 1 , . . . , p n ,  p 1 , . . . ,  p n }. It is assumed herein that the span program is non-monotone. An access structure (non-monotone access structure) is constituted using the non-monotone span program. Briefly, an access structure controls access to encryption, that is, it controls whether a ciphertext is to be decrypted or not. 
     As will be described in detail later, the span program being non-monotone, instead of being monotone, allows for a wider range of applications of the functional encryption scheme constituted using the span program. 
     &lt;5-2. Inner-Product of Attribute Information and Access Structure&gt; 
     The above-described map γ(j) is computed using the inner-product of attribute information. That is, the inner-product of attribute information is used to determine which row of the matrix M is to be included in the matrix M δ . 
     U t  (t=1, . . . , d and U t ⊂{0, 1}*) is a sub-universe and a set of attributes. Each U t  includes identification information (t) of the sub-universe and an n-dimensional vector (v{right arrow over ( )}). That is, U t  is (t, v{right arrow over ( )}), where to tε{1, . . . , d} and v{right arrow over ( )}εF q   n . 
     Let U t :=(t, v{right arrow over ( )}) be a variable p of the span program M^:=(M, ρ). That is, p:=(t, v{right arrow over ( )}). Let the span program M^:=(M, ρ) having the variable (p:=(t, v{right arrow over ( )}), (t′, v{right arrow over ( )}′), . . . ) be an access structure S. 
     That is, the access structure S:=(M, ρ) and ρ:{1, . . . , L}→{(t, v{right arrow over ( )}), (t′, v{right arrow over ( )}′), . . . ,  (t, v{right arrow over ( )}),  (t′, v{right arrow over ( )}′), . . . }. 
     Let Γ be a set of attributes. That is, Γ:={(t, x{right arrow over ( )} t )|x{right arrow over ( )} t εF q   n , 1≦t≦d}. 
     When Γ is given to the access structure S, map γ: {1, . . . , L}→{0, 1} for the span program M^:=(M, ρ) is defined as follows. For each integer i=1, . . . , L, set γ(j)=1 if [ρ(i)=(t, v{right arrow over ( )} i )] [(t, x{right arrow over ( )} t )εΓ] [v{right arrow over ( )} i ·x{right arrow over ( )} t =0] or [ρ(i)= (t, v{right arrow over ( )} i )] [(t, x{right arrow over ( )} t )εΓ]^[v{right arrow over ( )} i ·x{right arrow over ( )} t ≠0]. Set γ(j)=0 otherwise.    
     That is, the map γ is computed based on the inner-product of the attribute information v{right arrow over ( )} and x{right arrow over ( )}. As described above, which row of the matrix M is to be included in the matrix M δ  is determined by the map γ. More specifically, which row of the matrix M is to be included in the matrix M δ  is determined by the inner-product of the attribute information v{right arrow over ( )} and x{right arrow over ( )}. The access structure S:=(M, ρ) accepts Γ if and only if 1{right arrow over ( )}εspan&lt;(M i ) γ(i)=1 &gt;. 
     &lt;5-3. Secret Distribution Scheme&gt; 
     A secret distribution scheme for the access structure S:=(M, ρ) will be described. 
     The secret distribution scheme is distributing secret information to render it nonsense distributed information. For example, secret information s is distributed into 10 pieces to generate 10 pieces of distributed information. Each of the 10 pieces of distributed information does not have information on the secret information s. Hence, even when one of the pieces of distributed information is obtained, no information can be obtained on the secret information s. On the other hand, if all of the 10 pieces of distributed information are obtained, the secret information s can be recovered. 
     Another secret distribution scheme is also available according to which the secret information s can be recovered if some (for example, 8 pieces) of distributed information can be obtained, without obtaining all of the 10 pieces of distributed information. A case like this where the secret information s can be recovered using 8 pieces out of 10 pieces of distributed information will be called 8-out-of-10. That is, a case where the secret information s can be recovered using t pieces out of n pieces of distributed information will be called t-out-of-n. This t will be called a threshold. 
     Still another secret distribution scheme is available according to which when 10 pieces of distributed information d 1 , . . . , d 10  are generated, the secret information s can be recovered with 8 pieces of distributed information d 1 , . . . , d 8 , but the secret information s cannot be recovered with 8 pieces of distributed information d 3 , . . . , d 10 . In other words, secret distribution schemes include a scheme according to which whether or not the secret information s can be recovered is controlled not only by the number of pieces of distributed information obtained, but also the combination of distributed information obtained. 
       FIG. 3  is an explanatory drawing of s 0 .  FIG. 4  is an explanatory drawing of s{right arrow over ( )} T . 
     Let a matrix M be an (L rows×r columns) matrix. Let f{right arrow over ( )} T  be a column vector indicated in Formula 121. 
     
       
         
           
             
               
                 
                   
                     
                       f 
                       → 
                     
                     T 
                   
                   := 
                   
                     
                       
                         ( 
                         
                           
                             f 
                             1 
                           
                           , 
                           
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               f 
                               r 
                             
                           
                         
                         ) 
                       
                       T 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       r 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     121 
                   
                   ] 
                 
               
             
           
         
       
     
     Let s 0  indicated in Formula 122 be secret information to be shared.
 
 s   0 :={right arrow over (1)} ·{right arrow over (f)}   T :=Σ k=1   r   f   k   [Formula 122]
 
     Let s{right arrow over ( )} T  indicated in Formula 123 be a vector of L pieces of distributed information of s 0 .
 
 {right arrow over (s)}   T :=( s   1   , . . . s   L ) T   :=M·{right arrow over (f)}   T   [Formula 123]
 
     Let the distributed information s i  belong to ρ(i). 
     If the access structure S:=(M, ρ) accepts Γ, that is, 1{right arrow over ( )}ε span&lt;(M i ) γ(i) = 1 &gt; for γ: {1, . . . , L}→{0, 1}, then there exist constants {α i  εF q |iεI} such that I ⊂ {iε{1, . . . , L}|γ(i)═1}. 
     This is obvious from the explanation about the example of  FIG. 2  that if there exist α 1 , α 2 , and α 4  with which α 1 (M 1 )+α 2 (M 2 )+α 4 (M 4 )=1{right arrow over ( )}, the span program M^ accepts the input sequence δ. That is, if the span program M^ accepts the input sequence δ when there exist α 1 , α 2 , and α 4  with which α 1 (M 1 )+α 2 (M 2 )+α 4 (M 4 )=1{right arrow over ( )}, then there exist α 1 , α 2 , and α 4  with which α 1 (M 1 )+α 2 (M 2 )+α 4 (M 4 )=1{right arrow over ( )}. 
     Note Formula 124.
 
Σ iεI α i   s   i   :=s   0   [Formula 124]
         Note that the constants {α i } can be computed in time polynomial in the size of the matrix M.       

     With the functional encryption scheme according to the following embodiments, an access structure is constructed by applying the inner-product predicate and the secret distribution scheme to the span program, as described above. Therefore, access control can be designed flexibly by designing the matrix M in the span program and the attribute information x and the attribute information v (predicate information) in the inner-product predicate. That is, access control can be designed very flexibly. Designing of the matrix M corresponds to designing of conditions such as a threshold of the secret distribution scheme. 
     For example, the attribute-based encryption scheme described above corresponds to a case where designing of the inner-product predicate is limited to a certain condition in the access structure in the functional encryption scheme according to the following embodiments. That is, when compared to the access structure in the functional encryption scheme according to the following embodiments, the access structure in the attribute-based encryption scheme has a lower flexibility in access control design because it lacks the flexibility in designing the attribute information x and the attribute information v (predicate information) in the inner-product predicate. More specifically, the attribute-based encryption scheme corresponds to a case where attribute information {x{right arrow over ( )} t } tε{1, . . . , d}  and {v{right arrow over ( )} t } tε{1, . . . , d}  are limited to two-dimensional vectors for the equality relation, for example, x{right arrow over ( )} t :=(1, x t ) and v{right arrow over ( )} t :=(v t , −1). 
     An inner-product predicate encryption scheme corresponds to a case where designing of the matrix M in the span program is limited to a certain condition in the access structure in the functional encryption scheme according to the following embodiments. That is, when compared to the access structure in the functional encryption scheme according to the following embodiments, the access structure in the inner-product predicate encryption scheme has a lower flexibility in access control design because it lacks the flexibility in designing the matrix M in the span program. More specifically, the inner-product predicate encryption scheme corresponds to a case where the secret distribution scheme is limited to 1-out-of-1 (or d-out-of-d). 
     In particular, the access structure in the functional encryption scheme according to the following embodiments constitutes a non-monotone access structure that uses a non-monotone span program. Thus, the flexibility in access control designing improves. 
     More specifically, since the non-monotone span program includes a negative literal ( p), a negative condition can be set. For example, assume that First Company includes four departments, A, B, C, and D. Assume that access control is to be performed such that only users belonging to departments other than department B of First Company are capable of access (capable of decryption). In this case, if a negative condition cannot be set, a condition that “the user belongs to any one of departments A, C, and D of First Company” must be set. On the other hand, if a negative condition can be set, a condition that “the user is an employee of First Company and belongs to a department other than department B” can be set. In other words, since a negative condition can be set, natural condition setting is possible. Although the number of departments is small in this case, this scheme is very effective in a case where the number of departments is large. 
     Embodiment 2 
     This embodiment describes a narrowly-defined cryptographic processing scheme. In particular, this embodiment describes a key-policy functional encryption (KP-FE) scheme. 
     Note that key-policy means that a policy, namely an access structure, is embedded in a decryption key. 
     First, the construction of the KP-FE scheme will be described. 
     Second, the configuration of a cryptographic system  10  that implements the KP-FE scheme will be described. 
     Third, the KP-FE scheme will be described in detail. 
     &lt;1. Construction of KP-FE Scheme&gt; 
     The KP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, and Dec. 
     (Setup) 
     A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ, and outputs a public parameter pk and a master key sk. 
     (KeyGen) 
     A KeyGen algorithm is a probabilistic algorithm that takes as input an access structure S:=(M, ρ), the public parameter pk, and the master key sk, and outputs a decryption key sk S . 
     (Enc) 
     An Enc algorithm is a probabilistic algorithm that takes as input a message m, an attribute set Γ:={(t, x{right arrow over ( )} t )|x{right arrow over ( )} t εF q   n , 1≦t≦d}, and the public parameter pk, and outputs a ciphertext ct Γ . 
     (Dec) 
     A Dec algorithm is an algorithm that takes as input the ciphertext ct Γ  encrypted under the attribute set Γ, the decryption key sk S  for the access structure S, and the public parameter pk, and outputs the message m or a distinguished symbol ⊥. 
     &lt;2. Configuration of Cryptographic System  10  that Implements KP-FE Scheme&gt; 
       FIG. 5  is a configuration diagram of the cryptographic system  10  that implements the KP-FE scheme according to Embodiment 2. 
     The cryptographic system  10  includes a key generation device  100 , an encryption device  200 , and a decryption device  300 . 
     The key generation device  100  executes the Setup algorithm taking as input a security parameter λ, and thus generates a public parameter pk and a master key sk. Then, the key generation device  100  publishes the generated public parameter pk. The key generation device  100  also executes the KeyGen algorithm taking as input an access structure S, and thus generates a decryption key sk S , and distributes the decryption key sk S  to the decryption device  300  in secrecy. 
     The encryption device  200  executes the Enc algorithm taking as input a message m, an attribute set Γ, and the public parameter pk, and thus generates a ciphertext ct Γ . The encryption device  200  transmits the generated ciphertext ct Γ  to the decryption device  300 . 
     The decryption device  300  executes the Dec algorithm taking as input the public parameter pk, the decryption key sk S , and the ciphertext ct Γ , and thus outputs the message m or a distinguished symbol ⊥. 
     &lt;3. KP-FE Scheme in Detail&gt; 
     With reference to  FIGS. 6 to 12 , the KP-FE scheme will be described, and the function and operation of the cryptographic system  10  that implements the KP-FE scheme will be described. 
       FIG. 6  is a configuration diagram of the key generation device  100  according to Embodiment 2.  FIG. 7  is a configuration diagram of the encryption device  200  according to Embodiment 2.  FIG. 8  is a configuration diagram of the decryption device  300  according to Embodiment 2. 
       FIGS. 9 and 10  show flowcharts illustrating the operation of the key generation device  100 .  FIG. 9  is a flowchart illustrating the process of the Setup algorithm, and  FIG. 10  is a flowchart illustrating the process of the KeyGen algorithm.  FIG. 11  is a flowchart illustrating the operation of the encryption device  200  and illustrating the process of the Enc algorithm.  FIG. 12  is a flowchart illustrating the operation of the decryption device  300  and illustrating the process of the Dec algorithm. 
     In the following description, it is assumed that x t,1 :=1. 
     The function and operation of the key generation device  100  will be described. 
     The key generation device  100  includes a master key generation unit  110 , a master key storage unit  120 , an information input unit  130 , a decryption key generation unit  140 , and a key distribution unit  150 . The decryption key generation unit  140  includes an f vector generation unit  141 , an s vector generation unit  142 , a random number generation unit  143 , and a key element generation unit  144 . 
     First, with reference to  FIG. 9 , the process of the Setup algorithm will be described. 
     (S 101 : Orthonormal Basis Generation Step) 
     Using the processing device, the master key generation unit  110  computes Formula 125, and thus generates a parameter param, a basis B 0  and a basis B* 0 , and a basis B 1  (basis B) and a basis B* 1  (basis B*). 
     
       
         
           
             
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     125 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   input 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     1 
                     λ 
                   
                 
               
               
                 
                   ( 
                   1 
                   ) 
                 
               
             
             
               
                 
                   
                     param 
                     ?? 
                   
                   := 
                   
                     
                       ( 
                       
                         q 
                         , 
                         ?? 
                         , 
                         
                           ?? 
                           T 
                         
                         , 
                         g 
                         , 
                         e 
                       
                       ) 
                     
                     ⁢ 
                     
                       ⟵ 
                       R 
                     
                     ⁢ 
                     
                       
                         ?? 
                         bpg 
                       
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   2 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       ψ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         x 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         N 
                         0 
                       
                       := 
                       
                         1 
                         + 
                         
                           u 
                           0 
                         
                         + 
                         1 
                         + 
                         
                           w 
                           0 
                         
                         + 
                         
                           z 
                           0 
                         
                       
                     
                     , 
                     
                       
                         N 
                         1 
                       
                       := 
                       
                         2 
                         + 
                         n 
                         + 
                         u 
                         + 
                         w 
                         + 
                         z 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         The 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         process 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           4 
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         through 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           8 
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         is 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         executed 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         each 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       0 
                     
                     , 
                     1. 
                   
                 
               
               
                 
                   ( 
                   3 
                   ) 
                 
               
             
             
               
                 
                   
                     param 
                     
                       ?? 
                       t 
                     
                   
                   := 
                   
                     
                       ( 
                       
                         q 
                         , 
                         
                           ?? 
                           t 
                         
                         , 
                         
                           ?? 
                           T 
                         
                         , 
                         
                           ?? 
                           t 
                         
                         , 
                         e 
                       
                       ) 
                     
                     := 
                     
                       
                         ?? 
                         dpvs 
                       
                       ⁡ 
                       
                         ( 
                         
                           
                             1 
                             λ 
                           
                           , 
                           
                             N 
                             t 
                           
                           , 
                           
                             param 
                             ?? 
                           
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   4 
                   ) 
                 
               
             
             
               
                 
                   
                     X 
                     t 
                   
                   := 
                   
                     
                       
                         ( 
                         
                           χ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ) 
                       
                       
                         i 
                         , 
                         
                           j 
                           = 
                           1 
                         
                         , 
                         
                             
                         
                         ⁢ 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           N 
                           t 
                         
                       
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       GL 
                       ⁡ 
                       
                         ( 
                         
                           
                             N 
                             t 
                           
                           , 
                           
                             ?? 
                             q 
                           
                         
                         ) 
                       
                     
                   
                 
               
               
                 
                   ( 
                   5 
                   ) 
                 
               
             
             
               
                 
                   
                     X 
                     t 
                     * 
                   
                   := 
                   
                     
                       
                         ( 
                         
                           ϑ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ) 
                       
                       
                         i 
                         , 
                         
                           j 
                           = 
                           1 
                         
                         , 
                         
                             
                         
                         ⁢ 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           N 
                           t 
                         
                       
                     
                     := 
                     
                       ψ 
                       · 
                       
                         
                           ( 
                           
                             X 
                             t 
                             T 
                           
                           ) 
                         
                         
                           - 
                           1 
                         
                       
                     
                   
                 
               
               
                 
                   ( 
                   6 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               χ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               1 
                             
                             
                               N 
                               t 
                             
                           
                           ⁢ 
                           
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   7 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                       * 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               ϑ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             ( 
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 1 
                               
                               
                                 N 
                                 t 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ϑ 
                             
                               t 
                               , 
                               i 
                               , 
                               j 
                             
                           
                           ⁢ 
                           
                             a 
                             
                               t 
                               , 
                               j 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                           * 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                           * 
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   8 
                   ) 
                 
               
             
             
               
                 
                   
                     
                       g 
                       T 
                     
                     := 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             g 
                           
                           ) 
                         
                       
                       ⁢ 
                       ψ 
                     
                   
                   , 
                   
                     param 
                     := 
                     
                       ( 
                       
                         
                           
                             { 
                             
                               param 
                               
                                 ?? 
                                 t 
                               
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               0 
                             
                             , 
                             1 
                           
                         
                         , 
                         
                           g 
                           T 
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   ( 
                   9 
                   ) 
                 
               
             
           
         
       
     
     That is, the master key generation unit  110  executes the following process. 
     (1) Using the input device, the master key generation unit  110  takes as input a security parameter λ(1 λ ). 
     (2) Using the processing device, the master key generation unit  110  executes the algorithm G bpg  taking as input the security parameter λ (1 λ ) inputted in (1), and thus generates values of a parameter param G :=(q, G, G T , g, e) of bilinear pairing groups. 
     (3) Using the processing device, the master key generation unit  110  generates a random number w, and sets 1+u 0 +1+w 0 +z 0  in N 0  and 2+n+u+w+z in N 1 , where n is an integer of 1 or more and u 0 , w 0 , z 0 , u, w, and z are integers of 0 or more. 
     Then, the master key generation unit  110  executes the following process (4) through (8) for each t=0, 1. 
     (4) Using the processing device, the master key generation unit  110  executes the algorithm G dpvs  taking as input the security parameter λ (1 λ ) inputted in (1), N t  set in (3), and the values of param G :=(q, G, G T , g, e) generated in (2), and thus generates values of a parameter param Vt :=(q, V t , G T , A t , e) of dual pairing vector spaces. 
     (5) Using the processing device, the master key generation unit  110  takes as input N t  set in (3) and F q , and randomly generates a linear transformation X t :=(χ t,i,j ) i,j . Note that GL stands for general linear. In other words, GL is a general linear group, a set of square matrices with nonzero determinants, and a group under multiplication. Note that (χ t,i,j ) i,j  denotes a matrix concerning the suffixes i and j of the matrix χ t,i,j , where i, j=1, . . . , N t . 
     (6) Using the processing device and based on the random number ψ and the linear transformation X t , the master key generation unit  110  generates (v t,i,j ) i,j :=ψ·(X t   T ) −1 . Like (χ t,i,j ) i,j , (v t,i,j ) i,j  denotes a matrix concerning the suffixes i and j of the matrix v t,i,j , where i, j=1, . . . , N t . 
     (7) Using the processing device and based on the linear transformation X t  generated in (5), the master key generation unit  110  generates a basis B t  from the orthonormal basis A t  generated in (4). Note that x{right arrow over ( )} t,i  indicates the i-th row of the linear transformation X t . 
     (8) Using the processing device and based on (v t,i,j ) i,j  generated in (6), the master key generation unit  110  generates a basis B* t  from the orthonormal basis A t  generated in (4). Note that v{right arrow over ( )} t,i  indicates the i-th row of the linear transformation X* t . 
     (9) Using the processing device, the master key generation unit  110  sets e(g, g) ψ  in g T . The master key generation unit  110  also sets {param Vt } t=0,1  generated in (4) and g T  in param. 
     In brief, in (S 101 ), the master key generation unit  110  executes an algorithm G ob  indicated in Formula 126, and thus generates param, the basis B 0  and the basis B* 0 , and the basis B 1  (basis B) and the basis B* 1  (basis B*). 
     
       
         
           
             
                 
             
             ⁢ 
             
               [ 
               
                 Formula 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 126 
               
               ] 
             
           
         
       
       
         
           
             
               
                 
                   
                     ?? 
                     ob 
                   
                   ⁡ 
                   
                     ( 
                     
                       1 
                       λ 
                     
                     ) 
                   
                 
                 : 
                 
                   param 
                   ?? 
                 
               
               := 
               
                 
                   ( 
                   
                     q 
                     , 
                     ?? 
                     , 
                     
                       ?? 
                       T 
                     
                     , 
                     g 
                     , 
                     e 
                   
                   ) 
                 
                 ⁢ 
                 
                   ⟵ 
                   R 
                 
                 ⁢ 
                 
                   
                     ?? 
                     bpg 
                   
                   ⁡ 
                   
                     ( 
                     
                       1 
                       λ 
                     
                     ) 
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
               ψ 
               ⁢ 
               
                 ⟵ 
                 U 
               
               ⁢ 
               
                 ?? 
                 q 
                 x 
               
             
             , 
             
               
                 N 
                 0 
               
               := 
               
                 1 
                 + 
                 
                   u 
                   0 
                 
                 + 
                 1 
                 + 
                 
                   w 
                   0 
                 
                 + 
                 
                   z 
                   0 
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 N 
                 1 
               
               := 
               
                 2 
                 + 
                 n 
                 + 
                 u 
                 + 
                 w 
                 + 
                 z 
               
             
             , 
             
               
                 for 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 t 
               
               = 
               0 
             
             , 
             1 
             , 
             
               
 
             
             ⁢ 
             
               
                 param 
                 
                   ?? 
                   t 
                 
               
               : 
               
                 
                   ( 
                   
                     q 
                     , 
                     
                       ?? 
                       t 
                     
                     , 
                     
                       ?? 
                       T 
                     
                     , 
                     
                       ?? 
                       t 
                     
                     , 
                     e 
                   
                   ) 
                 
                 : 
                 
                   
                     ?? 
                     dpvs 
                   
                   ⁡ 
                   
                     ( 
                     
                       
                         1 
                         λ 
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       
                         param 
                         ?? 
                       
                     
                     ) 
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 X 
                 t 
               
               := 
               
                 
                   
                     ( 
                     
                       χ 
                       
                         t 
                         , 
                         i 
                         , 
                         j 
                       
                     
                     ) 
                   
                   
                     i 
                     , 
                     
                       j 
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                   
                 
                 ⁢ 
                 
                   ⟵ 
                   U 
                 
                 ⁢ 
                 
                   GL 
                   ⁡ 
                   
                     ( 
                     
                       
                         N 
                         t 
                       
                       , 
                       
                         ?? 
                         q 
                       
                     
                     ) 
                   
                 
               
             
           
         
       
       
         
           
             
               
                 X 
                 t 
                 * 
               
               := 
               
                 
                   
                     ( 
                     
                       ϑ 
                       
                         t 
                         , 
                         i 
                         , 
                         j 
                       
                     
                     ) 
                   
                   
                     i 
                     , 
                     
                       j 
                       = 
                       1 
                     
                     , 
                     
                         
                     
                     ⁢ 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                   
                 
                 := 
                 
                   ψ 
                   · 
                   
                     
                       ( 
                       
                         X 
                         t 
                         T 
                       
                       ) 
                     
                     
                       - 
                       1 
                     
                   
                 
               
             
             , 
             hereafter 
           
         
       
       
         
           
             
               
                 
                   χ 
                   → 
                 
                 
                   t 
                   , 
                   i 
                 
               
               ⁢ 
               
                   
               
               ⁢ 
               and 
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   ϑ 
                   → 
                 
                 
                   t 
                   , 
                   i 
                 
               
               ⁢ 
               
                   
               
               ⁢ 
               denote 
               ⁢ 
               
                   
               
               ⁢ 
               the 
               ⁢ 
               
                   
               
               ⁢ 
               
                 i-th 
               
               ⁢ 
               
                   
               
               ⁢ 
               rows 
               ⁢ 
               
                   
               
               ⁢ 
               of 
               ⁢ 
               
                   
               
               ⁢ 
               
                 X 
                 t 
               
               ⁢ 
               
                   
               
               ⁢ 
               and 
               ⁢ 
               
                   
               
               ⁢ 
               
                 X 
                 t 
                 * 
               
             
             ⁢ 
             
                 
             
           
         
       
       
         
           
             
               
                 for 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 i 
               
               = 
               1 
             
             , 
             ⋯ 
             , 
             
               N 
               t 
             
             , 
             respectively 
             , 
             
                
             
             ⁢ 
             
               
                 b 
                 
                   t 
                   , 
                   i 
                 
               
               := 
               
                 
                   
                     ( 
                     
                       
                         χ 
                         → 
                       
                       
                         t 
                         , 
                         i 
                       
                     
                     ) 
                   
                   
                     ?? 
                     t 
                   
                 
                 = 
                 
                   
                     
                       ∑ 
                       
                         j 
                         = 
                         1 
                       
                       
                         N 
                         t 
                       
                     
                     ⁢ 
                     
                       
                         χ 
                         
                           t 
                           , 
                           i 
                           , 
                           j 
                         
                       
                       ⁢ 
                       
                         a 
                         
                           t 
                           , 
                           j 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                   
                   = 
                   1 
                 
               
             
             , 
             ⋯ 
             , 
             
               N 
               t 
             
           
         
       
       
         
           
             
               
                 
                   ?? 
                   t 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       
                         t 
                         , 
                         1 
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       b 
                       
                         t 
                         , 
                         
                           N 
                           t 
                         
                       
                     
                   
                   ) 
                 
               
               , 
               
                 
                   b 
                   
                     t 
                     , 
                     i 
                   
                   * 
                 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           ϑ 
                           → 
                         
                         
                           t 
                           , 
                           i 
                         
                       
                       ) 
                     
                     
                       ?? 
                       t 
                     
                   
                   = 
                   
                     
                       ∑ 
                       
                         j 
                         = 
                         1 
                       
                       
                         N 
                         t 
                       
                     
                     ⁢ 
                     
                       
                         ϑ 
                         
                           t 
                           , 
                           i 
                           , 
                           j 
                         
                       
                       ⁢ 
                       
                         a 
                         
                           t 
                           , 
                           j 
                         
                       
                     
                   
                 
               
             
             ⁢ 
             
                 
             
           
         
       
       
         
           
             
               
                 for 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 i 
               
               = 
               1 
             
             , 
             ⋯ 
             , 
             
               N 
               t 
             
             , 
             
               
                 B 
                 t 
                 * 
               
               := 
               
                 ( 
                 
                   
                     b 
                     
                       t 
                       , 
                       1 
                     
                     * 
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     b 
                     
                       t 
                       , 
                       
                         N 
                         t 
                       
                     
                     * 
                   
                 
                 ) 
               
             
             , 
             
               
                 g 
                 T 
               
               := 
               
                 
                   e 
                   ⁡ 
                   
                     ( 
                     
                       g 
                       , 
                       g 
                     
                     ) 
                   
                 
                 ψ 
               
             
             , 
             
               
 
             
             ⁢ 
             
               param 
               := 
               
                 ( 
                 
                   
                     
                       { 
                       
                         param 
                         
                           ?? 
                           t 
                         
                       
                       } 
                     
                     
                       
                         t 
                         = 
                         0 
                       
                       , 
                       1 
                     
                   
                   , 
                   
                     g 
                     T 
                   
                 
                 ) 
               
             
             , 
             
               return 
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   ( 
                   
                     param 
                     , 
                     
                       ?? 
                       t 
                     
                     , 
                     
                       ?? 
                       t 
                       * 
                     
                   
                   ) 
                 
                 . 
               
             
           
         
       
     
     In the following description, for simplicity, the basis B 1  and the basis B* 1  will be described as the basis B and the basis B*. 
     (S 102 : Public Parameter Generation Step) 
     Using the processing device, the master key generation unit  110  generates a subbasis B^ 0  of the basis B 0  and a subbasis B^ of the basis B, as indicated in Formula 127, the bases B 0  and B having been generated in (S 101 ).
 
   0 :=( b   0,1   ,b   0,1+u     0     +1   ,b   0,1+u     0     +1+w     0     +1   , . . . ,b   0,1+u     0     +1+w     0     +z     0   ),
 
 :=( b   1   , . . . ,b   2+n   ,b   2+n+u+w+1   , . . . ,b   2+n+u+w+z )  [Formula 127]
 
     The master key generation unit  110  generates a public parameter pk by putting together the generated subbasis B^ 0  and subbasis B^, the security parameter λ(1 λ ) inputted in (S 101 ), and param generated in (S 101 ). 
     (S 103 : Master Key Generation Step) 
     Using the processing device, the master key generation unit  110  generates a subbasis B^* 0  of the basis B* 0  and a subspace B^* of the basis B*, as indicated in Formula 128, the bases B* 0  and B^* having been generated in (S 101 ).
 
 * 0 :=( b*   0,1   ,b*   0,1+u     0     +1   ,b*   0,1+u     0     +1+1   , . . . ,b*   0,1+u     0     +1+w     0   ),
 
 *:=( b*   1   , . . . ,b*   2+n   ,b*   2+n+u+1   , . . . ,b*   2+n+u+w )  [Formula 128]
 
     The master key generation unit  110  generates a master key sk which is constituted by the generated subbasis B^* 0  and subbasis B^*. 
     (S 104 : Master Key Storage Step) 
     The master key storage unit  120  stores the parameter pk generated in (S 102 ) in the storage device. The master key storage unit  120  also stores the master key sk generated in (S 103 ) in the storage device. 
     In brief, in (S 101 ) through (S 103 ), the key generation device  100  executes the Setup algorithm indicated in Formula 129, and thus generates the public parameter pk and the master key sk. In (S 104 ), the key generation device  100  stores the generated public parameter pk and master key sk in the storage device. 
     The public parameter is published, for example, via the network, and is made available for the encryption device  200  and the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       Setup 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           ( 
                           
                             param 
                             , 
                             
                               ( 
                               
                                 
                                   0 
                                 
                                 , 
                                 
                                   0 
                                   * 
                                 
                               
                               ) 
                             
                             , 
                             
                               ( 
                               
                                 , 
                                 
                                   * 
                                 
                               
                               ) 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ← 
                           R 
                         
                         ⁢ 
                         
                           
                             ob 
                           
                           ⁢ 
                           
                             ( 
                             
                               1 
                               λ 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ^ 
                           
                           0 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           ^ 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                                 + 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                                 + 
                                 z 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ^ 
                           
                           0 
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                   + 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             ^ 
                           
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               1 
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           pk 
                         
                         := 
                         
                           ( 
                           
                             
                               1 
                               λ 
                             
                             , 
                             param 
                             , 
                             
                               
                                 ^ 
                               
                               0 
                             
                             , 
                             
                               ^ 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         sk 
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   ^ 
                                 
                                 0 
                                 * 
                               
                               , 
                               
                                 
                                   ^ 
                                 
                                 * 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     129 
                   
                   ] 
                 
               
             
           
         
       
     
     With reference to  FIG. 10 , the process of the KeyGen algorithm will be described. 
     (S 201 : Information Input Step) 
     Using the input device, the information input unit  130  takes as input the above-described access structure S:=(M, ρ). Note that the matrix M of the access structure S is to be set according to the conditions of a system to be implemented. Note also that attribute information of the user of a decryption key sk S  is set in ρ of the access structure S, for example. 
     (S 202 : f Vector Generation Step) 
     Using the processing device, the f vector generation unit  141  randomly generates a vector {right arrow over (f)} having r pieces of elements, as indicated in Formula 130. 
     
       
         
           
             
               
                 
                   
                     f 
                     → 
                   
                   ⁢ 
                   
                     ← 
                     U 
                   
                   ⁢ 
                   
                     q 
                     r 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     130 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 203 : s Vector Generation Step) 
     Using the processing device and based on the (L rows×r columns) matrix M included in the access structure S inputted in (S 201 ) and the vector {right arrow over (f)} generated in (S 202 ), the s vector generation unit  142  generates a vector {right arrow over (s)} T :=(s 1 , . . . , s L ) T , as indicated in Formula 131.
 
 {right arrow over (s)}   T :=( s   1   , . . . ,s   L ) T   :=M·{right arrow over (f)}   T   [Formula 131]
 
     Using the processing device and based on the vector {right arrow over (f)} generated in (S 202 ), the s vector generation unit  142  also generates a value s 0 , as indicated in Formula 132.
 
 s   0 :={right arrow over (1)} ·{right arrow over (f)}   T   [Formula 132]
 
     (S 204 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  143  generates random numbers, as indicated in Formula 133. 
     
       
         
           
             
               
                 
                   
                     
                       
                         η 
                         → 
                       
                       0 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             η 
                             
                               0 
                               , 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             η 
                             
                               0 
                               , 
                               
                                 w 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     μ 
                     i 
                   
                   , 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               η 
                               
                                 i 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               η 
                               
                                 i 
                                 , 
                                 w 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           
                             q 
                             w 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           i 
                         
                       
                       = 
                       1 
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     133 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 205 : Key Element Generation Step) 
     Using the processing device, the key element generation unit  144  generates an element k* 0  of the decryption key sk S , as indicated in Formula 134. 
     
       
         
           
             
               
                 
                   
                     k 
                     0 
                     * 
                   
                   := 
                   
                     
                       ( 
                       
                         
                           - 
                           
                             s 
                             0 
                           
                         
                         , 
                         
                           
                             0 
                             
                               u 
                               0 
                             
                           
                           
                             ︷ 
                             
                               u 
                               0 
                             
                           
                         
                         , 
                         1 
                         , 
                         
                           
                             
                               η 
                               → 
                             
                             0 
                           
                           
                             ︷ 
                             
                               w 
                               0 
                             
                           
                         
                         , 
                         
                           
                             0 
                             
                               z 
                               0 
                             
                           
                           
                             ︷ 
                             
                               z 
                               0 
                             
                           
                         
                         , 
                       
                       ) 
                     
                     
                       0 
                       * 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     134 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, for the basis B and the basis B* indicated in Formula 113, Formula 114 is established. Thus, Formula 134 means that −s 0  is set as the coefficient of a basis vector b* 0,1  of the basis B* 0 , 0 is set as the coefficient of basis vectors b* 0,1+1 , . . . , b* 0,1+u , 1 is set as the coefficient of a basis vector b* 0,1+u0+1 , η 0,1 , . . . , η 0,w0  are respectively set as the coefficient of basis vectors b* 0,1+u0+1+1 , . . . , b 0,1+u0+1+w0 , and 0 is set as the coefficient of basis vectors b* 0,1+u0+1+w0+1 , . . . , b* 0,1+u0+1+w0+z0 , where u0, w0, and z0 respectively denote u 0 , w 0 , and z 0 . 
     Using the processing device, the key element generation unit  144  also generates an element k* i  of the decryption key sk S  for each integer i=1, . . . , L, as indicated in Formula 135. 
     
       
         
           
             
               
                 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     u 
                                     i 
                                   
                                   ⁢ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                       , 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     
                                       s 
                                       i 
                                     
                                     ⁢ 
                                     
                                       
                                         e 
                                         → 
                                       
                                       1 
                                     
                                   
                                   + 
                                   
                                     
                                       θ 
                                       i 
                                     
                                     ⁢ 
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 u 
                               
                               , 
                             
                             
                               ︷ 
                               u 
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               w 
                             
                           
                           ⁢ 
                           
                             
                               0 
                               z 
                             
                             
                               ︷ 
                               z 
                             
                           
                         
                         ) 
                       
                       
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       i 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     u 
                                     i 
                                   
                                   ⁢ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                       , 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                                 , 
                               
                               ⁢ 
                               
                                   
                               
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 u 
                               
                               , 
                             
                             
                               ︷ 
                               u 
                             
                           
                           ⁢ 
                           
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               , 
                             
                             
                               ︷ 
                               w 
                             
                           
                           ⁢ 
                           
                             
                               0 
                               z 
                             
                             
                               ︷ 
                               z 
                             
                           
                         
                         ) 
                       
                       
                         * 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     135 
                   
                   ] 
                 
               
             
           
         
       
     
     That is, like Formula 134, the meaning of Formula 135 is as explained below. When ρ(i) is a positive set (t, v{right arrow over ( )} i ), pit is set as the coefficient of a basis vector b* 1  of the basis B*, −μ i  is set as the coefficient of a basis vector b* 2 , s i +θ i v i,1  is set as the coefficient of a basis vector b* 2+1 , θ i v i,2 , . . . , θ i v i,n  are respectively set as the coefficient of basis vectors b* 2+2 , . . . , b* 2+n , 0 is set as the coefficient of basis vectors b* 2+n+1 , . . . , b* 2+n+u , η i,1 , . . . , η i,w  are respectively set as the coefficient of basis vectors b* 2+n+u+1 , . . . , b* 2+n+u+w , and 0 is set as the coefficient of basis vectors b* 2+n+u+w+1 , . . . , b* 2+n+u+w+z . 
     On the other hand, when ρ(i) is a negative set  (t, v{right arrow over ( )} i ), it is set as the coefficient of the basis vector b* 1  of the basis B*, −μ i  is set as the coefficient of the basis vector b* 2 , s i v i,1 , . . . , s i v i,n  are respectively set as the coefficient of the basis vectors b* 2+1 , . . . , b* 2+n , 0 is set as the coefficient of the basis vectors b* 2+n+1 , . . . , b* 2+n+u , η i,1 , . . . , η i,w  are respectively set as the coefficient of the basis vectors b* 2+n+u+1 , . . . , b* 2+n+u+w , and 0 is set as the coefficient of the basis vectors b* 2+n+u+w+1 , . . . , b* 2+n+u+w+z . 
     (S 206 : Key Distribution Step) 
     Using the communication device and via the network, for example, the key distribution unit  150  distributes the decryption key sk S  having, as elements, the access structure S inputted in (S 201 ) and k* 0 , k* 1 , . . . , and k* L  generated in (S 205 ) to the decryption device  300  in secrecy. As a matter of course, the decryption key sk S  may be distributed to the decryption device  300  by another method. 
     In brief, in (S 201 ) through (S 205 ), the key generation device  100  executes the KeyGen algorithm indicated in Formula 136, and thus generates the decryption key sk S . In (S 206 ), the key generation device  100  distributes the generated decryption key sk S  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           sk 
                           , 
                           
                             := 
                             
                               ( 
                               
                                 M 
                                 , 
                                 ρ 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         f 
                         → 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                         r 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         s 
                         0 
                       
                       := 
                       
                         
                           1 
                           → 
                         
                         · 
                         
                           
                             f 
                             → 
                           
                           T 
                         
                       
                     
                     , 
                     
                       
                         
                           s 
                           → 
                         
                         T 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               
                                 s 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 s 
                                 L 
                               
                             
                             ) 
                           
                           T 
                         
                         := 
                         
                           M 
                           · 
                           
                             
                               f 
                               → 
                             
                             T 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         0 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               - 
                               
                                 s 
                                 0 
                               
                             
                             , 
                             
                               
                                 0 
                                 
                                   u 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             , 
                             1 
                             , 
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 
                                   z 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                             , 
                           
                           ) 
                         
                         
                           0 
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       
                         θ 
                         i 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                         w 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         i 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     
                                       u 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                         , 
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         1 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         i 
                                       
                                       ⁢ 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   u 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   i 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 z 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ρ 
                         ⁢ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         i 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     
                                       u 
                                       i 
                                     
                                     ⁢ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                         , 
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       s 
                                       i 
                                     
                                     ⁢ 
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                   
                                 
                                 ⁢ 
                                 
                                     
                                 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   u 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   i 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 z 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           sk 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             , 
                             
                               k 
                               0 
                               * 
                             
                             , 
                             
                               k 
                               1 
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               k 
                               L 
                               * 
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     136 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the encryption device  200  will be described. 
     The encryption device  200  includes a public parameter acquisition unit  210 , an information input unit  220 , a cipher data generation unit  230 , and a data transmission unit  240 . The cipher data generation unit  230  includes a random number generation unit  231  and a cipher element generation unit  232 . 
     With reference to  FIG. 11 , the process of the Enc algorithm will be described. 
     (S 301 : Public Parameter Acquisition Step) 
     Using the communication device and via the network, for example, the public parameter acquisition unit  210  obtains the public parameter pk generated by the key generation device  100 . 
     (S 302 : Information Input Step) 
     Using the input device, the information input unit  220  takes as input a message m to be transmitted to the decryption device  300 . Using the input device, the information input unit  220  also takes as input an attribute set Γ:={(t, x{right arrow over ( )} t :=(x t,1 , . . . , x t,n εFq n ))|1≦t≦d}. Note that t may be at least some integers from 1 to d, instead of being all of integers from 1 to d. Note that information on the attributes of the user capable of decryption is set in the attribute set Γ, for example. 
     (S 303 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  231  generates random numbers, as indicated in Formula 137. 
     
       
         
           
             
               
                 
                   ω 
                   , 
                   
                     ζ 
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                     
                   
                   , 
                   
                     
                       
                         φ 
                         → 
                       
                       0 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             φ 
                             
                               0 
                               , 
                               1 
                             
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             φ 
                             
                               0 
                               , 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           z 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       σ 
                       t 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         φ 
                         → 
                       
                       0 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               φ 
                               
                                 t 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               φ 
                               
                                 t 
                                 , 
                                 z 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           
                             q 
                             z 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                         
                       
                       ∈ 
                       Γ 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     137 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 304 : Cipher Element Generation Step) 
     Using the processing device, the cipher element generation unit  232  generates an element c 0  of a ciphertext ct Γ , as indicated in Formula 138. 
     
       
         
           
             
               
                 
                   
                     c 
                     0 
                   
                   := 
                   
                     
                       ( 
                       
                         ω 
                         , 
                         
                           
                             
                               
                                 0 
                                 
                                   u 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           ζ 
                         
                         , 
                         
                           
                             
                               
                                 0 
                                 
                                   w 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 φ 
                                 → 
                               
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                       
                       ) 
                     
                     
                       0 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     138 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the cipher element generation unit  232  also generates an element c t  of the ciphertext ct Γ  for each integer t included in the attribute information Γ, as indicated in Formula 139. 
     
       
         
           
             
               
                 
                   
                     c 
                     t 
                   
                   := 
                   
                     
                       ( 
                       
                         
                           
                             
                               
                                 σ 
                                 t 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   1 
                                   , 
                                   t 
                                 
                                 ) 
                               
                             
                             , 
                             
                               ω 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             , 
                           
                           
                             ︷ 
                             
                               2 
                               + 
                               n 
                             
                           
                         
                         ⁢ 
                         
                           
                             
                               0 
                               u 
                             
                             , 
                           
                           
                             ︷ 
                             
                               u 
                               0 
                             
                           
                         
                         ⁢ 
                         
                           
                             
                               0 
                               w 
                             
                             , 
                           
                           
                             ︷ 
                             
                               w 
                               0 
                             
                           
                         
                         ⁢ 
                         
                           
                             
                               φ 
                               → 
                             
                             t 
                           
                           
                             ︷ 
                             
                               z 
                               0 
                             
                           
                         
                       
                       ) 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     139 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the cipher element generation unit  232  also generates an element c d+1  of the ciphertext ct Γ , as indicated in Formula 140.
 
 c   d+1   :=g   T   ζ   m   [Formula 140]
 
     (S 305 : Data Transmission Step) 
     Using the communication device and via the network, for example, the data transmission unit  240  transmits the ciphertext ct Γ  having, as elements, the attribute set Γ inputted in (S 302 ) and c 0 , c t , and c d+1  generated in (S 304 ) to the decryption device  300 . As a matter of course, the ciphertext ct Γ  may be transmitted to the decryption device  300  by another method. 
     In brief, in (S 301 ) through (S 304 ), the encryption device  200  executes the Enc algorithm indicated in Formula 141, and thus generates the ciphertext ct Γ . In (S 305 ), the encryption device  200  transmits the generated ciphertext ct Γ  to the decryption device  300 . 
     
       
         
           
             
                 
             
             ⁢ 
             
               [ 
               
                 Formula 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 141 
               
               ] 
             
           
         
       
       
         
           
             
               Enc 
               ( 
               
                 pk 
                 , 
                 m 
                 , 
                 
                   Γ 
                   := 
                   
                     { 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             x 
                             t 
                           
                           := 
                           
                             
                               
                                 ( 
                                 
                                   
                                     x 
                                     
                                       t 
                                       , 
                                       1 
                                     
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     x 
                                     
                                       t 
                                       , 
                                       n 
                                     
                                   
                                 
                                 ) 
                               
                               ∈ 
                               
                                 
                                   q 
                                   n 
                                 
                                 ⁢ 
                                 \ 
                                 ⁢ 
                                 
                                   { 
                                   0 
                                   } 
                                 
                               
                             
                             ❘ 
                             
                               1 
                               ≤ 
                               t 
                               ≤ 
                               d 
                             
                           
                         
                       
                       ) 
                     
                     } 
                   
                 
               
               ) 
             
             ⁢ 
             
               : 
             
           
         
       
       
         
           
             ω 
             , 
             
               ζ 
               ⁢ 
               
                 ← 
                 U 
               
               ⁢ 
               
                 q 
               
             
             , 
             
               
                 
                   φ 
                   → 
                 
                 0 
               
               ⁢ 
               
                 ← 
                 U 
               
               ⁢ 
               
                 q 
                 
                   z 
                   0 
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 c 
                 0 
               
               := 
               
                 
                   ( 
                   
                     ω 
                     , 
                     
                       
                         
                           
                             0 
                             
                               u 
                               0 
                             
                           
                           , 
                         
                         
                           ︷ 
                           
                             u 
                             0 
                           
                         
                       
                       ⁢ 
                       ζ 
                     
                     , 
                     
                       
                         
                           
                             0 
                             
                               w 
                               0 
                             
                           
                           , 
                         
                         
                           ︷ 
                           
                             w 
                             0 
                           
                         
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         
                           ︷ 
                           
                             z 
                             0 
                           
                         
                       
                     
                   
                   ) 
                 
                 
                   0 
                 
               
             
             , 
             
               
                 c 
                 
                   d 
                   + 
                   1 
                 
               
               := 
               
                 
                   g 
                   T 
                   ζ 
                 
                 ⁢ 
                 m 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 for 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   ( 
                   
                     t 
                     , 
                     
                       
                         x 
                         → 
                       
                       t 
                     
                   
                   ) 
                 
               
               ∈ 
               Γ 
             
             , 
             
               
                 σ 
                 t 
               
               ⁢ 
               
                 ← 
                 U 
               
               ⁢ 
               
                 q 
               
             
             , 
             
               
                 
                   φ 
                   → 
                 
                 t 
               
               ⁢ 
               
                 ← 
                 U 
               
               ⁢ 
               
                 q 
                 z 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 c 
                 t 
               
               := 
               
                 
                   ( 
                   
                     
                       
                         
                           
                             σ 
                             t 
                           
                           ⁡ 
                           
                             ( 
                             
                               1 
                               , 
                               t 
                             
                             ) 
                           
                         
                         , 
                         
                           ω 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               x 
                               → 
                             
                             t 
                           
                         
                         , 
                       
                       
                         ︷ 
                         
                           2 
                           + 
                           n 
                         
                       
                     
                     ⁢ 
                     
                       
                         
                           0 
                           u 
                         
                         , 
                       
                       
                         ︷ 
                         
                           u 
                           0 
                         
                       
                     
                     ⁢ 
                     
                       
                         
                           0 
                           w 
                         
                         , 
                       
                       
                         ︷ 
                         
                           w 
                           0 
                         
                       
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       
                         ︷ 
                         
                           z 
                           0 
                         
                       
                     
                   
                   ) 
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
               
                 return 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   ct 
                   Γ 
                 
               
               := 
               
                 
                   ( 
                   
                     Γ 
                     , 
                     
                       c 
                       0 
                     
                     , 
                     
                       
                         { 
                         
                           c 
                           t 
                         
                         } 
                       
                       
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                         ∈ 
                         Γ 
                       
                     
                     , 
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                   
                   ) 
                 
                 . 
               
             
           
         
       
     
     The function and operation of the decryption device  300  will be described. 
     The decryption device  300  includes a decryption key acquisition unit  310 , a data receiving unit  320 , a span program computation unit  330 , a complementary coefficient computation unit  340 , a pairing operation unit  350 , and a message computation unit  360 . 
     With reference to  FIG. 12 , the process of the Dec algorithm will be described. 
     (S 401 : Decryption Key Acquisition Step) 
     Using the communication device and via the network, for example, the decryption key acquisition unit  310  obtains the decryption key sk S :=(S, k* 0 , k* 1 , . . . , k* L ) distributed by the key generation device  100 . The decryption key acquisition unit  310  also obtains the public parameter pk generated by the key generation device  100 . 
     (S 402 : Data Reception Step) 
     Using the communication device and via the network, for example, the data receiving unit  320  receives the ciphertext ct Γ  transmitted by the encryption device  200 . 
     (S 403 : Span Program Computation Step) 
     Using the processing device, the span program computation unit  330  checks whether or not the access structure S included in the decryption key sk S  obtained in (S 401 ) accepts Γ included in the ciphertext ct Γ  received in (S 402 ). The method for checking whether or not the access structure S accepts Γ is the same as that described in “5. Concept for implementing functional encryption in Embodiment 1”. 
     If the access structure S accepts Γ (accept in S 403 ), the span program computation unit  330  advances the process to (S 404 ). If the access structure S rejects Γ (reject in S 403 ), the span program computation unit  330  determines that the ciphertext ct Γ  cannot be decrypted with the decryption key sk S , and ends the process. 
     (S 404 : Complementary Coefficient Computation Step) 
     Using the processing device, the complementary coefficient computation unit  340  computes I and a constant (complementary coefficient) {α i } iε1  such that Formula 142 is satisfied.
 
{right arrow over (1)}=Σ iεI α i   M   i , where  M   i  is the  i - th  row of  M,  
 
and  I ⊂ {iε{ 1 , . . . ,L }|[ρ( i )=( t,{right arrow over (v)}   i ) ( t,{right arrow over (x)}   t )εΓ   {right arrow over (v)}   i   ·{right arrow over (x)}   t =0]
 
 [ρ( i )= ( t,{right arrow over (v)}   i ) ( t,{right arrow over (x)}   t )εΓ   {right arrow over (v)}   i   ·{right arrow over (x)}   t ≠0]}  [Formula 142]
 
     (S 405 : Pairing Operation Step) 
     Using the processing device, the pairing operation unit  350  computes Formula 143, and thus generates a session key K=g T   ζ . 
     
       
         
           
             
               
                 
                   K 
                   := 
                   
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             c 
                             0 
                           
                           , 
                           
                             k 
                             0 
                             * 
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       
                         ∑ 
                         
                           
                             i 
                             ∈ 
                             
                               I 
                               ⋀ 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                           
                           = 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                         
                             
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 t 
                               
                               , 
                               
                                 k 
                                 i 
                                 * 
                               
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           α 
                           i 
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   ⋀ 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             
                                 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               / 
                               
                                 ( 
                                 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                   · 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 ) 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     143 
                   
                   ] 
                 
               
             
           
         
       
     
     As indicated in Formula 144, the key K=g T   ζ  can be obtained by computing Formula 143. 
     
       
         
           
             
               
                 
                   
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             c 
                             0 
                           
                           , 
                           
                             k 
                             0 
                             * 
                           
                         
                         ) 
                       
                     
                     · 
                     
                       
                         ∏ 
                         
                           
                             i 
                             ∈ 
                             
                               I 
                               ⋀ 
                               
                                 ρ 
                                 ⁢ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                           
                           = 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                         
                             
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 t 
                               
                               , 
                               
                                 k 
                                 i 
                                 * 
                               
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           · 
                           
                             
                               ∏ 
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     ⋀ 
                                     
                                       ρ 
                                       ⁡ 
                                       
                                         ( 
                                         i 
                                         ) 
                                       
                                     
                                   
                                 
                                 = 
                                 
                                   ⫬ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                               
                               
                                   
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       t 
                                     
                                     , 
                                     
                                       k 
                                       i 
                                       * 
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   α 
                                   i 
                                 
                                 / 
                                 
                                   ( 
                                   
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                     · 
                                     
                                       
                                         x 
                                         → 
                                       
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                   
                   = 
                   
                     
                       
                         g 
                         T 
                         
                           
                             
                               - 
                               ω 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               s 
                               0 
                             
                           
                           + 
                           ζ 
                         
                       
                       ⁢ 
                       
                         
                           ∏ 
                           
                             
                               i 
                               ∈ 
                               
                                 I 
                                 ⋀ 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               ) 
                             
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             g 
                             T 
                             
                               ω 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 α 
                                 i 
                               
                               ⁢ 
                               
                                 s 
                                 i 
                               
                             
                           
                           ⁢ 
                           
                             
                               ∏ 
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     ⋀ 
                                     
                                       ρ 
                                       ⁡ 
                                       
                                         ( 
                                         i 
                                         ) 
                                       
                                     
                                   
                                 
                                 = 
                                 
                                   ⫬ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                               
                               
                                   
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               g 
                               T 
                               
                                 ω 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   α 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                       · 
                                       
                                         
                                           x 
                                           → 
                                         
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   ( 
                                   
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                     · 
                                     
                                       
                                         x 
                                         → 
                                       
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                     = 
                     
                       
                         g 
                         T 
                         
                           
                             ω 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   - 
                                   
                                     s 
                                     0 
                                   
                                 
                                 + 
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       ∈ 
                                       I 
                                     
                                     
                                         
                                     
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       α 
                                       i 
                                     
                                     ⁢ 
                                     
                                       s 
                                       i 
                                     
                                   
                                 
                               
                               ) 
                             
                           
                           + 
                           ζ 
                         
                       
                       + 
                       
                         
                           g 
                           T 
                           ζ 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     144 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 406 : Message Computation Step) 
     Using the processing device, the message computation unit  360  computes m′=c d+1 /K, and thus generates a message m′ (=m). Note that c d+1  is g T   ζ m, as indicated in Formula 142, and that K is g T   ζ . Hence, the message m can be obtained by computing m′=c d+1 /K. 
     In brief, in (S 401 ) through (S 406 ), the decryption device  300  executes the Dec algorithm indicated in Formula 145, and thus generates the message m′ (=m). 
     
       
         
           
             
               
                 
                   
                     
                       
                         
                           Dec 
                           ⁡ 
                           
                             ( 
                             
                               pk 
                               , 
                               
                                 
                                   sk 
                                 
                                 := 
                                 
                                   ( 
                                   
                                     , 
                                     
                                       k 
                                       1 
                                       * 
                                     
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       k 
                                       L 
                                       * 
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   ct 
                                   Γ 
                                 
                                 := 
                                 
                                   ( 
                                   
                                     Γ 
                                     , 
                                     
                                       
                                         { 
                                         
                                           c 
                                           t 
                                         
                                         } 
                                       
                                       
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                         ∈ 
                                         Γ 
                                       
                                     
                                     , 
                                     
                                       c 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           : 
                         
                       
                       ⁢ 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           If 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 M 
                                 , 
                                 ρ 
                               
                               ) 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             accepts 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             Γ 
                           
                           := 
                           
                             { 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               ) 
                             
                             } 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       then 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       compute 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       I 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       and 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           { 
                           
                             α 
                             i 
                           
                           } 
                         
                         
                           i 
                           ∈ 
                           I 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         1 
                         → 
                       
                       = 
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             I 
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           ⁢ 
                           
                             M 
                             i 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     where 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         M 
                         i 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       is 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       the 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                       ⁢ 
                       
                         - 
                       
                       ⁢ 
                       th 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       row 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       of 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       M 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     and 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     I 
                     ⊆ 
                     
                       { 
                       
                         i 
                         ∈ 
                         
                           
                             { 
                             
                               1 
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               L 
                             
                             } 
                           
                           ⁢ 
                           
                               
                             
                               ❘ 
                               
                                 [ 
                                 
                                   
                                     
                                       
                                         
                                             
                                           
                                             
                                               ρ 
                                               ⁡ 
                                               
                                                 ( 
                                                 i 
                                                 ) 
                                               
                                             
                                             = 
                                             
                                               
                                                 
                                                   
                                                     ( 
                                                     
                                                       t 
                                                       , 
                                                       
                                                         
                                                           v 
                                                           → 
                                                         
                                                         i 
                                                       
                                                     
                                                     ) 
                                                   
                                                   ⋀ 
                                                   
                                                     ( 
                                                     
                                                       t 
                                                       , 
                                                       
                                                         
                                                           x 
                                                           → 
                                                         
                                                         t 
                                                       
                                                     
                                                     ) 
                                                   
                                                 
                                                 ∈ 
                                                 
                                                   
                                                     Γ 
                                                     ⋀ 
                                                     
                                                       
                                                         v 
                                                         → 
                                                       
                                                       i 
                                                     
                                                   
                                                   · 
                                                   
                                                     
                                                       x 
                                                       → 
                                                     
                                                     t 
                                                   
                                                 
                                               
                                               = 
                                               0 
                                             
                                           
                                           ] 
                                         
                                         ⋁ 
                                         
                                           [ 
                                           
                                               
                                             
                                               
                                                 ρ 
                                                 ⁡ 
                                                 
                                                   ( 
                                                   i 
                                                   ) 
                                                 
                                               
                                               = 
                                               
                                                 ⫬ 
                                                 
                                                   
                                                     
                                                       ( 
                                                       
                                                         t 
                                                         , 
                                                         
                                                           
                                                             v 
                                                             → 
                                                           
                                                           i 
                                                         
                                                       
                                                       ) 
                                                     
                                                     ⋀ 
                                                     
                                                       ( 
                                                       
                                                         t 
                                                         , 
                                                         
                                                           
                                                             x 
                                                             → 
                                                           
                                                           t 
                                                         
                                                       
                                                       ) 
                                                     
                                                   
                                                   ∈ 
                                                   
                                                     
                                                       
                                                         Γ 
                                                         ⋀ 
                                                         
                                                           
                                                             v 
                                                             → 
                                                           
                                                           i 
                                                         
                                                       
                                                       · 
                                                       
                                                         
                                                           x 
                                                           → 
                                                         
                                                         t 
                                                       
                                                     
                                                     ≠ 
                                                     0 
                                                   
                                                 
                                               
                                             
                                             ] 
                                           
                                           } 
                                         
                                       
                                       ⁢ 
                                       
                                         
 
                                       
                                       ⁢ 
                                       K 
                                     
                                     := 
                                     
                                       
                                         e 
                                         ⁡ 
                                         
                                           ( 
                                           
                                             
                                               c 
                                               0 
                                             
                                             , 
                                             
                                               k 
                                               0 
                                               * 
                                             
                                           
                                           ) 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           ∑ 
                                           
                                             
                                               i 
                                               ∈ 
                                               
                                                 I 
                                                 ⋀ 
                                                 
                                                   ρ 
                                                   ⁡ 
                                                   
                                                     ( 
                                                     i 
                                                     ) 
                                                   
                                                 
                                               
                                             
                                             = 
                                             
                                               ( 
                                               
                                                 t 
                                                 , 
                                                 
                                                   
                                                     v 
                                                     → 
                                                   
                                                   i 
                                                 
                                               
                                               ) 
                                             
                                           
                                           
                                               
                                           
                                         
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           
                                             e 
                                             ⁡ 
                                             
                                               ( 
                                               
                                                 
                                                   c 
                                                   t 
                                                 
                                                 , 
                                                 
                                                   k 
                                                   i 
                                                   * 
                                                 
                                               
                                               ) 
                                             
                                           
                                           ⁢ 
                                           
                                             α 
                                             i 
                                           
                                           ⁢ 
                                           
                                             
                                               ∏ 
                                               
                                                 
                                                   i 
                                                   ∈ 
                                                   
                                                     I 
                                                     ⋀ 
                                                     
                                                       ρ 
                                                       ⁡ 
                                                       
                                                         ( 
                                                         i 
                                                         ) 
                                                       
                                                     
                                                   
                                                 
                                                 = 
                                                 
                                                   ( 
                                                   
                                                     t 
                                                     , 
                                                     
                                                       
                                                         v 
                                                         → 
                                                       
                                                       i 
                                                     
                                                   
                                                   ) 
                                                 
                                               
                                               
                                                   
                                               
                                             
                                             ⁢ 
                                             
                                                 
                                             
                                             ⁢ 
                                             
                                               
                                                 e 
                                                 ⁡ 
                                                 
                                                   ( 
                                                   
                                                     
                                                       c 
                                                       t 
                                                     
                                                     , 
                                                     
                                                       k 
                                                       i 
                                                       * 
                                                     
                                                   
                                                   ) 
                                                 
                                               
                                               ⁢ 
                                               
                                                 
                                                   α 
                                                   i 
                                                 
                                                 / 
                                                 
                                                   ( 
                                                   
                                                     
                                                       
                                                         v 
                                                         → 
                                                       
                                                       i 
                                                     
                                                     · 
                                                     
                                                       
                                                         x 
                                                         → 
                                                       
                                                       t 
                                                     
                                                   
                                                   ) 
                                                 
                                               
                                             
                                           
                                         
                                       
                                     
                                   
                                   , 
                                   
                                     
 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     
                                       return 
                                       ⁢ 
                                       
                                           
                                       
                                       ⁢ 
                                       
                                         m 
                                         ′ 
                                       
                                     
                                     := 
                                     
                                       
                                         c 
                                         
                                           d 
                                           + 
                                           1 
                                         
                                       
                                       / 
                                       
                                         K 
                                         . 
                                       
                                     
                                   
                                 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     145 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, in the cryptographic system  10  according to Embodiment 2, μ i t and −μ i  are respectively set as the coefficient of the basis vectors b* 1  and b* 2  for the element k* i  of the decryption key sk S . In the cryptographic system  10 , σ t  and σ t t are respectively set as the coefficient of the basis vectors b 1  and b 2  for the element c t  of the ciphertext ct Γ . 
     Because of these arrangements, when a pairing operation is performed on the element k* i  and the element c t  for the corresponding index t, an inner-product of 0 is obtained for portions constituted by the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 , which are thus canceled out. That is, when a pairing operation is performed on the element k* i  and the element c t  for the corresponding index t, the index parts that are set as the coefficients of the basis vectors (portions constituted by the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 ) are canceled out, and a result of the pairing operation for the remaining portions can be obtained. 
     In the cryptographic system  10  according to Embodiment 2, the index parts are provided, so that the bases that are used for every attribute category can be constructed as the common bases (basis B and basis B*). As a result, only the basis B and the basis B* need to be included in a public parameter, eliminating the need for reissuing the public parameter when an attribute category is to be added at a later stage. 
     In the cryptographic system  10  according to Embodiment 2, the public parameter and the master secret key are of smaller sizes compared with those in the functional encryption scheme described in Non-Patent Literature 29. Therefore, calculations using the public parameter and the master secret key can be performed efficiently. 
     For the index parts, it is required that 0 be obtained as a result of an inner-product operation of the index parts. Therefore, although the 2-dimensional index parts, namely the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 , are employed in the above description, the index parts are not limited to 2-dimensional and may be 3-dimensional or higher-dimensional. The values assigned to the index parts are not limited to those described above, and a different assignment arrangement may be employed. 
     The functional encryption scheme has been described above. As indicated in Formula 146 through Formula 149, however, the functional encryption scheme described above can be modified into an attribute-based encryption scheme. Note that N 0  is 1+1+1+1+1=5 and N 1  is 2+2+8+2+2=16 in Formula 146 through Formula 149. That is, u 0 =1, w 0 =1, z 0 =1, n=2, u=8, w=2, and z=2. Even in this case, security can be proven. 
     
       
         
           
             
                 
             
             ⁢ 
             
               [ 
               
                 Formula 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 146 
               
               ] 
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               Setup 
               ⁢ 
               
                   
               
               ⁢ 
               
                 ( 
                 
                   1 
                   λ 
                 
                 ) 
               
               ⁢ 
               
                 : 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 
                   ( 
                   
                     param 
                     , 
                     
                       ( 
                       
                         
                           0 
                         
                         , 
                         
                           0 
                           * 
                         
                       
                       ) 
                     
                     , 
                     
                       ( 
                       
                         , 
                         
                           * 
                         
                       
                       ) 
                     
                   
                   ) 
                 
                 ⁢ 
                 
                   ← 
                   R 
                 
                 ⁢ 
                 
                   
                     ob 
                   
                   ⁢ 
                   
                     ( 
                     
                       1 
                       λ 
                     
                     ) 
                   
                 
               
               , 
               
                 
                   / 
                   
                     * 
                     N 
                   
                 
                 = 
                 
                   
                     16 
                     * 
                     
                       / 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           ^ 
                         
                         0 
                       
                     
                   
                   := 
                   
                     ( 
                     
                       
                         b 
                         
                           0 
                           , 
                           1 
                         
                       
                       , 
                       
                         b 
                         
                           0 
                           , 
                           3 
                         
                       
                       , 
                       
                         b 
                         
                           0 
                           , 
                           5 
                         
                       
                     
                     ) 
                   
                 
               
               , 
               
                 
                   ^ 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       b 
                       4 
                     
                     , 
                     
                       b 
                       15 
                     
                     , 
                     
                       b 
                       16 
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                 
                   
                     ^ 
                   
                   0 
                   * 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       
                         0 
                         , 
                         1 
                       
                     
                     , 
                     
                       b 
                       
                         0 
                         , 
                         3 
                       
                     
                     , 
                     
                       b 
                       
                         0 
                         , 
                         4 
                       
                     
                   
                   ) 
                 
               
               , 
               
                 
                   
                     ^ 
                   
                   * 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       1 
                       * 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       b 
                       
                         4 
                         * 
                       
                     
                     , 
                     
                       b 
                       13 
                       * 
                     
                     , 
                     
                       b 
                       14 
                       * 
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   return 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   pk 
                 
                 := 
                 
                   ( 
                   
                     
                       1 
                       λ 
                     
                     , 
                     param 
                     , 
                     
                       
                         ^ 
                       
                       0 
                     
                     , 
                     
                       ^ 
                     
                   
                   ) 
                 
               
               , 
               
                 sk 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           
                             ^ 
                           
                           0 
                           * 
                         
                         , 
                         
                           
                             ^ 
                           
                           * 
                         
                       
                       ) 
                     
                     . 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ob 
                     
                   
                   ⁢ 
                   
                     ( 
                     
                       1 
                       λ 
                     
                     ) 
                   
                   ⁢ 
                   
                     : 
                   
                 
               
             
           
         
       
       
         
           
             
               := 
               
                 
                   ( 
                   
                     q 
                     , 
                     , 
                     
                       T 
                     
                     , 
                     g 
                     , 
                     e 
                   
                   ) 
                 
                 ⁢ 
                 
                   ← 
                   R 
                 
                 ⁢ 
                 
                   
                     bpg 
                   
                   ⁢ 
                   
                     ( 
                     
                       1 
                       λ 
                     
                     ) 
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             
               ψ 
               ⁢ 
               
                 ← 
                 U 
               
               ⁢ 
               
                 q 
                 x 
               
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             
               
                 N 
                 0 
               
               := 
               5 
             
             , 
             
               
                 N 
                 1 
               
               := 
               16 
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             
               
                 for 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 t 
               
               = 
               0 
             
             , 
             1 
             , 
             
               
 
             
             ⁢ 
             
               := 
               
                 
                   ( 
                   
                     q 
                     , 
                     
                       t 
                     
                     , 
                     
                       T 
                     
                     , 
                     
                       t 
                     
                     , 
                     e 
                   
                   ) 
                 
                 := 
                 
                   
                     dpvs 
                   
                   ⁢ 
                   
                     ( 
                     
                       
                         1 
                         λ 
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                     
                     ) 
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             
               
                 X 
                 t 
               
               := 
               
                 
                   
                     ( 
                     
                       χ 
                       
                         t 
                         , 
                         i 
                         , 
                         j 
                       
                     
                     ) 
                   
                   
                     i 
                     , 
                     
                       j 
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                   
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   GL 
                   ⁢ 
                   
                     ( 
                     
                       
                         N 
                         t 
                       
                       , 
                       
                         q 
                       
                     
                     ) 
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             
               
                 X 
                 t 
                 * 
               
               := 
               
                 
                   
                     ( 
                     
                       ϑ 
                       
                         t 
                         , 
                         i 
                         , 
                         j 
                       
                     
                     ) 
                   
                   
                     i 
                     , 
                     
                       j 
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                   
                 
                 := 
                 
                   ψ 
                   · 
                   
                     
                       ( 
                       
                         X 
                         t 
                         T 
                       
                       ) 
                     
                     
                       - 
                       1 
                     
                   
                 
               
             
             , 
             
               
 
             
             ⁢ 
             
                 
             
             ⁢ 
             hereafter 
             , 
             
               
                 χ 
                 → 
               
               
                 t 
                 , 
                 i 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               and 
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   ϑ 
                   → 
                 
                 
                   t 
                   , 
                   i 
                 
               
               ⁢ 
               
                   
               
               ⁢ 
               denote 
               ⁢ 
               
                   
               
               ⁢ 
               the 
               ⁢ 
               
                   
               
               ⁢ 
               i 
               ⁢ 
               
                 - 
               
               ⁢ 
               th 
               ⁢ 
               
                   
               
               ⁢ 
               rows 
               ⁢ 
               
                   
               
               ⁢ 
               of 
               ⁢ 
               
                   
               
               ⁢ 
               
                 X 
                 t 
               
             
             ⁢ 
             
                 
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 
                   and 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     X 
                     t 
                     * 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   for 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   i 
                 
                 = 
                 1 
               
               , 
               … 
               ⁢ 
               
                   
               
               , 
               
                 N 
                 t 
               
               , 
               respectively 
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   b 
                   
                     t 
                     , 
                     i 
                   
                 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           χ 
                           → 
                         
                         
                           t 
                           , 
                           i 
                         
                       
                       ) 
                     
                     
                       t 
                     
                   
                   = 
                   
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           1 
                         
                         
                           N 
                           t 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           χ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ⁢ 
                         
                           a 
                           
                             t 
                             , 
                             j 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                     
                     = 
                     1 
                   
                 
               
               , 
               … 
               ⁢ 
               
                   
               
               , 
               
                 N 
                 t 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   t 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       
                         t 
                         , 
                         1 
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       b 
                       
                         t 
                         , 
                         
                           N 
                           t 
                         
                       
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   b 
                   
                     t 
                     , 
                     i 
                   
                   * 
                 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           ϑ 
                           → 
                         
                         
                           t 
                           , 
                           i 
                         
                       
                       ) 
                     
                     
                       t 
                     
                   
                   = 
                   
                     
                       
                         ∑ 
                         
                           j 
                           = 
                           1 
                         
                         
                           N 
                           t 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           ϑ 
                           
                             t 
                             , 
                             i 
                             , 
                             j 
                           
                         
                         ⁢ 
                         
                           a 
                           
                             t 
                             , 
                             j 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                     
                     = 
                     1 
                   
                 
               
               , 
               … 
               ⁢ 
               
                   
               
               , 
               
                 N 
                 t 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   t 
                   * 
                 
                 := 
                 
                   ( 
                   
                     
                       b 
                       
                         t 
                         , 
                         1 
                       
                       * 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       b 
                       
                         t 
                         , 
                         
                           N 
                           t 
                         
                       
                       * 
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   g 
                   T 
                 
                 := 
                 
                   
                     e 
                     ⁡ 
                     
                       ( 
                       
                         g 
                         , 
                         g 
                       
                       ) 
                     
                   
                   ⁢ 
                   ψ 
                 
               
               , 
               
                 param 
                 := 
                 
                   ( 
                   
                     
                       
                         { 
                         } 
                       
                       
                         
                           t 
                           = 
                           0 
                         
                         , 
                         1 
                       
                     
                     , 
                     
                       g 
                       T 
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   return 
                   ⁡ 
                   
                     ( 
                     
                       param 
                       , 
                       , 
                       
                         * 
                       
                     
                     ) 
                   
                 
                 . 
                 
                   
 
                 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     147 
                   
                   ] 
                 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 KeyGen 
                 ⁡ 
                 
                   ( 
                   
                     pk 
                     , 
                     sk 
                     , 
                     
                       := 
                       
                         ( 
                         
                           M 
                           , 
                           ρ 
                         
                         ) 
                       
                     
                   
                   ) 
                 
               
               ⁢ 
               
                 : 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 
                   f 
                   → 
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   q 
                   r 
                 
               
               , 
               
                 
                   s 
                   0 
                 
                 := 
                 
                   
                     1 
                     → 
                   
                   · 
                   
                     
                       f 
                       → 
                     
                     T 
                   
                 
               
               , 
               
                 
                   
                     s 
                     → 
                   
                   T 
                 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           s 
                           1 
                         
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           s 
                           L 
                         
                       
                       ) 
                     
                     T 
                   
                   := 
                   
                     M 
                     · 
                     
                       
                         f 
                         → 
                       
                       T 
                     
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   η 
                   0 
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   q 
                 
               
               , 
               
                 
                   k 
                   0 
                   * 
                 
                 := 
                 
                   
                     ( 
                     
                       
                         - 
                         
                           s 
                           0 
                         
                       
                       , 
                       0 
                       , 
                       1 
                       , 
                       
                         η 
                         0 
                       
                       , 
                       0 
                     
                     ) 
                   
                   
                     0 
                     * 
                   
                 
               
               , 
               
                 
                   for 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   i 
                 
                 = 
                 1 
               
               , 
               … 
               ⁢ 
               
                   
               
               , 
               L 
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 μ 
                 i 
               
               , 
               
                 θ 
                 i 
               
               , 
               
                 η 
                 
                   i 
                   , 
                   1 
                 
               
               , 
               
                 
                   η 
                   
                     i 
                     , 
                     2 
                   
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   q 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   if 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ρ 
                     ⁡ 
                     
                       ( 
                       i 
                       ) 
                     
                   
                 
                 = 
                 
                   ( 
                   
                     t 
                     , 
                     
                       v 
                       i 
                     
                   
                   ) 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                 
                   k 
                   i 
                   * 
                 
                 := 
                 
                   
                     
                       ( 
                       
                         
                           
                             
                               
                                 
                                   u 
                                   i 
                                 
                                 ⁢ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       - 
                                       1 
                                     
                                     , 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   s 
                                   i 
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     v 
                                     i 
                                   
                                 
                                 - 
                                 
                                   θ 
                                   i 
                                 
                               
                             
                             ⁢ 
                             
                                 
                             
                           
                           
                             ︷ 
                             4 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               0 
                               8 
                             
                             , 
                           
                           
                             ︷ 
                             8 
                           
                         
                         ⁢ 
                         
                           
                             
                               η 
                               
                                 i 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               η 
                               
                                 i 
                                 , 
                                 2 
                               
                             
                             , 
                           
                           
                             ︷ 
                             2 
                           
                         
                         ⁢ 
                         
                           
                             0 
                             2 
                           
                           
                             ︷ 
                             2 
                           
                         
                       
                       ) 
                     
                     
                         
                     
                   
                   
                     * 
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   if 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ρ 
                     ⁡ 
                     
                       ( 
                       i 
                       ) 
                     
                   
                 
                 = 
                 
                   ⫬ 
                   
                     ( 
                     
                       t 
                       , 
                       
                         v 
                         i 
                       
                     
                     ) 
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   k 
                   i 
                   * 
                 
                 := 
                 
                   
                     ( 
                     
                       
                         
                           
                             
                               
                                 u 
                                 i 
                               
                               ⁢ 
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     - 
                                     1 
                                   
                                   , 
                                 
                                 ) 
                               
                             
                             , 
                             
                               
                                 s 
                                 i 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     v 
                                     i 
                                   
                                   , 
                                   
                                     - 
                                     1 
                                   
                                 
                                 ) 
                               
                             
                             , 
                           
                           ⁢ 
                           
                               
                           
                         
                         
                           ︷ 
                           4 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             0 
                             8 
                           
                           , 
                         
                         
                           ︷ 
                           8 
                         
                       
                       ⁢ 
                       
                         
                           
                             η 
                             
                               i 
                               , 
                               1 
                             
                           
                           , 
                           
                             η 
                             
                               i 
                               , 
                               2 
                             
                           
                           , 
                         
                         
                           ︷ 
                           2 
                         
                       
                       ⁢ 
                       
                         
                           0 
                           2 
                         
                         
                           ︷ 
                           2 
                         
                       
                     
                     ) 
                   
                   
                     * 
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   return 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     sk 
                   
                 
                 := 
                 
                   
                     ( 
                     
                       , 
                       
                         k 
                         0 
                         * 
                       
                       , 
                       
                         k 
                         1 
                         * 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         k 
                         L 
                         * 
                       
                     
                     ) 
                   
                   . 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     [ 
                     
                       Formula 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       148 
                     
                     ] 
                   
                 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 Enc 
                 ⁡ 
                 
                   ( 
                   
                     pk 
                     , 
                     m 
                     , 
                     
                       Γ 
                       := 
                       
                         { 
                         
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                           ❘ 
                           
                             1 
                             ≤ 
                             t 
                             ≤ 
                             d 
                           
                         
                         } 
                       
                     
                   
                   ) 
                 
               
               ⁢ 
               
                 : 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               ω 
               , 
               ζ 
               , 
               
                 
                   φ 
                   0 
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   q 
                 
               
               , 
               
                 
                   c 
                   0 
                 
                 := 
                 
                   
                     ( 
                     
                       ω 
                       , 
                       0 
                       , 
                       ζ 
                       , 
                       0 
                       , 
                       
                         φ 
                         0 
                       
                     
                     ) 
                   
                   
                     0 
                   
                 
               
               , 
               
                 
                   c 
                   
                     d 
                     + 
                     1 
                   
                 
                 := 
                 
                   
                     g 
                     T 
                     ζ 
                   
                   ⁢ 
                   m 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   for 
                   ⁡ 
                   
                     ( 
                     
                       t 
                       , 
                       
                         x 
                         t 
                       
                     
                     ) 
                   
                 
                 ∈ 
                 Γ 
               
               , 
               
                 σ 
                 t 
               
               , 
               
                 φ 
                 
                   t 
                   , 
                   1 
                 
               
               , 
               
                 
                   φ 
                   
                     t 
                     , 
                     2 
                   
                 
                 ⁢ 
                 
                   ← 
                   U 
                 
                 ⁢ 
                 
                   q 
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   c 
                   t 
                 
                 = 
                 
                   
                     ( 
                     
                       
                         
                           
                             
                               σ 
                               i 
                             
                             ⁡ 
                             
                               ( 
                               
                                 1 
                                 , 
                                 t 
                               
                               ) 
                             
                           
                           , 
                           
                             ω 
                             ⁢ 
                             
                               ( 
                               
                                 1 
                                 , 
                                 
                                   x 
                                   t 
                                 
                               
                               ) 
                             
                           
                           , 
                         
                         
                           ︷ 
                           4 
                         
                       
                       ⁢ 
                       
                         
                           
                             0 
                             8 
                           
                           , 
                         
                         
                           ︷ 
                           8 
                         
                       
                       ⁢ 
                       
                         
                           
                             0 
                             2 
                           
                           , 
                         
                         
                           ︷ 
                           2 
                         
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             
                               t 
                               , 
                               1 
                             
                           
                           , 
                           
                             φ 
                             
                               t 
                               , 
                               2 
                             
                           
                         
                         
                           ︷ 
                           2 
                         
                       
                     
                     ) 
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   return 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ct 
                     Γ 
                   
                 
                 := 
                 
                   
                     ( 
                     
                       Γ 
                       , 
                       
                         c 
                         0 
                       
                       , 
                       
                         
                           { 
                           
                             c 
                             t 
                           
                           } 
                         
                         
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                           ∈ 
                           Γ 
                         
                       
                       , 
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                     
                     ) 
                   
                   . 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     [ 
                     
                       Formula 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       149 
                     
                     ] 
                   
                 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 Dec 
                 ⁡ 
                 
                   ( 
                   
                     pk 
                     , 
                     
                       
                         sk 
                       
                       := 
                       
                         ( 
                         
                           , 
                           
                             k 
                             1 
                             * 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           
                             k 
                             L 
                             * 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ct 
                         Γ 
                       
                       := 
                       
                         ( 
                         
                             
                         
                         ⁢ 
                         
                           Γ 
                           , 
                           
                             
                               { 
                               
                                 c 
                                 t 
                               
                               } 
                             
                             
                               
                                 x 
                                 t 
                               
                               ∈ 
                               Γ 
                             
                           
                           , 
                           
                             c 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                         ) 
                       
                     
                   
                   ) 
                 
               
               ⁢ 
               
                 : 
               
             
           
         
       
       
         
           
             
                 
             
             ⁢ 
             
               
                 
                   If 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                 
                 := 
                 
                   
                     
                       ( 
                       
                         M 
                         , 
                         ρ 
                       
                       ) 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     accepts 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     Γ 
                   
                   := 
                   
                     { 
                     
                       ( 
                       
                         t 
                         , 
                         
                           x 
                           t 
                         
                       
                       ) 
                     
                     } 
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 
                   then 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   compute 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   I 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   and 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       { 
                       
                         α 
                         i 
                       
                       } 
                     
                     
                       i 
                       ∈ 
                       I 
                     
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   such 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   that 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     1 
                     → 
                   
                 
                 = 
                 
                   
                     ∑ 
                     
                       i 
                       ∈ 
                       I 
                     
                     
                         
                     
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       α 
                       i 
                     
                     ⁢ 
                     
                       M 
                       i 
                     
                   
                 
               
               , 
               
                 
 
               
               ⁢ 
               
                   
               
               ⁢ 
               
                 where 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   M 
                   i 
                 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 is 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 the 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 i 
                 ⁢ 
                 
                   - 
                 
                 ⁢ 
                 th 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 row 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 of 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 M 
               
               , 
               and 
             
           
         
       
       
         
           
             I 
             ⊆ 
             
               { 
               
                 
                   i 
                   ∈ 
                   
                     
                       { 
                       
                         1 
                         , 
                         … 
                         ⁢ 
                         
                             
                         
                         , 
                         L 
                       
                       } 
                     
                     ⁢ 
                     
                         
                       
                         ❘ 
                         
                           
                             [ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                               = 
                               
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         v 
                                         i 
                                       
                                     
                                     ) 
                                   
                                   ⋀ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         x 
                                         t 
                                       
                                     
                                     ) 
                                   
                                 
                                 ∈ 
                                 Γ 
                               
                             
                             ] 
                           
                           ⋁ 
                           
                             [ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           v 
                                           i 
                                         
                                       
                                       ) 
                                     
                                     ⋀ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                   ∈ 
                                   
                                     
                                       Γ 
                                       ⋀ 
                                       
                                         v 
                                         i 
                                       
                                     
                                     ≠ 
                                     
                                       x 
                                       t 
                                     
                                   
                                 
                               
                             
                             ] 
                           
                         
                       
                       } 
                     
                   
                 
                 , 
                 
                   
 
                 
                 ⁢ 
                 
                   K 
                   := 
                   
                     
                       e 
                       ⁡ 
                       
                         ( 
                         
                           
                             c 
                             0 
                           
                           , 
                           
                             k 
                             0 
                             * 
                           
                         
                         ) 
                       
                     
                     · 
                     
                       
                         ∏ 
                         
                           
                             i 
                             ∈ 
                             
                               I 
                               ⋀ 
                               
                                 ρ 
                                 ⁢ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                           
                           = 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 v 
                                 i 
                               
                             
                             ) 
                           
                         
                         
                             
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 t 
                               
                               , 
                               
                                 k 
                                 i 
                                 * 
                               
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           α 
                           i 
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   ⋀ 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                 
                               
                               = 
                               
                                 ⫬ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       v 
                                       i 
                                     
                                   
                                   ) 
                                 
                               
                             
                             
                                 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     t 
                                   
                                   , 
                                   
                                     k 
                                     i 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 i 
                               
                               / 
                               
                                 ( 
                                 
                                   
                                     v 
                                     i 
                                   
                                   · 
                                   
                                     x 
                                     i 
                                   
                                 
                                 ) 
                               
                             
                           
                         
                       
                     
                   
                 
                 , 
                 
                   
 
                 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       m 
                       ′ 
                     
                   
                   := 
                   
                     
                       c 
                       
                         d 
                         + 
                         1 
                       
                     
                     / 
                     
                       K 
                       . 
                     
                   
                 
               
             
           
         
       
     
     Embodiment 3 
     Like Embodiment 2, this embodiment describes a narrowly-defined cryptographic processing scheme. In particular, this embodiment describes a ciphertext-policy functional encryption (CP-FE) scheme. 
     Note that cipher-text policy means that a policy, namely an access structure, is embedded in a ciphertext. 
     First, the construction of the CP-FE scheme will be described. 
     Second, the configuration of a cryptographic system  10  that implements the CP-FE scheme will be described. 
     Third, the CP-FE scheme will be described in detail. 
     &lt;1. Construction of CP-FE Scheme&gt; 
     The CP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, and Dec. 
     (Setup) 
     A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ, and outputs a public parameter pk and a master key sk. 
     (KeyGen) 
     A KeyGen algorithm is a probabilistic algorithm that takes as input an attribute set Γ:={(t, x{right arrow over ( )} t )|x{right arrow over ( )} t εF q   n , 1≦t≦d}, the public parameter pk, and the master key sk, and outputs a decryption key sk Γ . 
     (Enc) 
     An Enc algorithm is a probabilistic algorithm that takes as input a message m, an access structure S:=(M, ρ), and the public parameter pk, and outputs a ciphertext ct S . 
     (Dec) 
     A Dec algorithm is an algorithm that takes as input the ciphertext ct S  encrypted under the access structure S, the decryption key sk Γ  for the attribute set Γ, and the public parameter pk, and outputs the message m or a distinguished symbol ⊥. 
     &lt;2. Configuration of Cryptographic System  10  that Implements CP-FE Scheme&gt; 
       FIG. 13  is a configuration diagram of the cryptographic system  10  that implements the CP-FE scheme according to Embodiment 3. 
     The cryptographic system  10  includes a key generation device  100 , an encryption device  200 , and a decryption device  300 . 
     The key generation device  100  executes the Setup algorithm taking as input a security parameter λ, and thus generates a public parameter pk and a master key sk. Then, the key generation device  100  publishes the generated public parameter pk. The key generation device  100  also executes the KeyGen algorithm taking as input an attribute set Γ, and thus generates a decryption key sk Γ , and distributes the decryption key sk Γ  to the decryption device  300  in secrecy. 
     The encryption device  200  executes the Enc algorithm taking as input a message m, an access structure S, and the public parameter pk, and thus generates a ciphertext ct S . The encryption device  200  transmits the generated ciphertext ct S  to the decryption device  300 . 
     The decryption device  300  executes the Dec algorithm taking as input the public parameter pk, the decryption key sk S , and the ciphertext ct S , and outputs the message m or a distinguished symbol ⊥. 
     &lt;3. CP-FE Scheme in Detail&gt; 
     With reference to  FIGS. 14 to 19 , the CP-FE scheme will be described, and the function and operation of the cryptographic system  10  that implements the CP-FE scheme will be described. 
       FIG. 14  is a configuration diagram of the key generation device  100  according to Embodiment 3.  FIG. 15  is a configuration diagram of the encryption device  200  according to Embodiment 3.  FIG. 16  is a configuration diagram of the decryption device  300  according to Embodiment 3. 
       FIG. 17  is a flowchart illustrating the operation of the key generation device  100  and illustrating the process of the KeyGen algorithm.  FIG. 18  is a flowchart illustrating the operation of the encryption device  200  and illustrating the process of the Enc algorithm.  FIG. 19  is a flowchart illustrating the operation of the decryption device  300  and illustrating the process of the Dec algorithm. 
     In the following description, it is assumed that x t,1 :=1. 
     The process of the Setup algorithm is the same as the process described in Embodiment 2, and thus will not be described. 
     The function and operation of the key generation device  100  will be described. 
     The key generation device  100  includes a master key generation unit  110 , a master key storage unit  120 , an information input unit  130 , a decryption key generation unit  140 , and a key distribution unit  150 . The decryption key generation unit  140  includes a random number generation unit  143  and a key element generation unit  144 . 
     With reference to  FIG. 17 , the process of the KeyGen algorithm will be described. 
     (S 501 : Information Input Step) 
     Using the input device, the information input unit  130  takes as input an attribute set Γ:={(t, x{right arrow over ( )} t :=(x t,1 , . . . , x t,n εF q   n )) 1≦t≦d}. Note that attribute information of the user of a decryption key sk Γ  is set in the attribute set Γ, for example. 
     (S 502 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  143  generates random numbers, as indicated in Formula 150. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       ω 
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               φ 
                               
                                 0 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               φ 
                               
                                 0 
                                 , 
                                 
                                   w 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           
                             w 
                             0 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         σ 
                         t 
                       
                       ⁢ 
                       
                         ← 
                         U 
                       
                       ⁢ 
                       
                         q 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               
                                 φ 
                                 
                                   t 
                                   , 
                                   1 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 φ 
                                 
                                   t 
                                   , 
                                   w 
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             ← 
                             U 
                           
                           ⁢ 
                           
                             
                               q 
                               w 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               ) 
                             
                           
                         
                         ∈ 
                         Γ 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     150 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 503 : Key Element Generation Step) 
     Using the processing device, the key element generation unit  144  generates an element k* 0  of the decryption key sk Γ , as indicated in Formula 151. 
     
       
         
           
             
               
                 
                   
                     k 
                     0 
                     * 
                   
                   := 
                   
                     
                       ( 
                       
                         ω 
                         , 
                         
                           
                             
                               
                                 0 
                                 
                                   u 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           1 
                         
                         , 
                         
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 0 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 
                                   z 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                       
                       ) 
                     
                     
                       ?? 
                       0 
                       * 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     151 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the key element generation unit  144  also generates an element k* t  of the decryption key sk Γ  for each integer t included in the attribute set Γ, as indicated in Formula 152. 
     
       
         
           
             
               
                 
                   
                     k 
                     t 
                     * 
                   
                   := 
                   
                     
                       ( 
                       
                         
                           
                             
                               
                                 σ 
                                 t 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   1 
                                   , 
                                   t 
                                 
                                 ) 
                               
                             
                             , 
                             
                               ω 
                               ⁢ 
                               
                                 
                                   
                                     
                                         
                                     
                                     ⁢ 
                                     x 
                                   
                                   → 
                                 
                                 t 
                               
                             
                             , 
                           
                           
                             ︷ 
                             
                               2 
                               + 
                               n 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               0 
                               u 
                             
                             , 
                           
                           
                             ︷ 
                             u 
                           
                         
                         ⁢ 
                         
                           
                             
                               
                                 φ 
                                 → 
                               
                               t 
                             
                             , 
                           
                           
                             ︷ 
                             w 
                           
                         
                         ⁢ 
                         
                           
                             0 
                             z 
                           
                           
                             ︷ 
                             z 
                           
                         
                       
                       ) 
                     
                     
                       ?? 
                       * 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     152 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 504 : Key Distribution Step) 
     Using the communication device and via the network, for example, the key distribution unit  150  distributes the decryption key sk Γ  having, as elements, the attribute set Γ inputted in (S 501 ) and k* 0  and k* t  generated in (S 503 ) to the decryption device  300  in secrecy. As a matter of course, the decryption key sk Γ  may be distributed to the decryption device  300  by another method. 
     In brief, in (S 501 ) through (S 503 ), the key generation device  100  executes the KeyGen algorithm indicated in Formula 153, and thus generates the decryption key sk Γ . In (S 504 ), the key generation device  100  distributes the generated decryption key sk Γ  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       KeyGen 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           sk 
                           , 
                           
                             Γ 
                             := 
                             
                               { 
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                       := 
                                       
                                         
                                           ( 
                                           
                                             
                                               x 
                                               
                                                 1 
                                                 , 
                                                 t 
                                               
                                             
                                             , 
                                             … 
                                             ⁢ 
                                             
                                                 
                                             
                                             , 
                                             
                                               x 
                                               
                                                 t 
                                                 , 
                                                 n 
                                               
                                             
                                           
                                           ) 
                                         
                                         ∈ 
                                         
                                           
                                             ?? 
                                             q 
                                             n 
                                           
                                           ⁢ 
                                           \ 
                                           ⁢ 
                                           
                                             { 
                                             
                                               0 
                                               → 
                                             
                                             } 
                                           
                                         
                                       
                                     
                                   
                                   ) 
                                 
                                 | 
                                 
                                   1 
                                   ≤ 
                                   t 
                                   ≤ 
                                   d 
                                 
                               
                               } 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ω 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         0 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             ω 
                             , 
                             
                               
                                 
                                   
                                     0 
                                     
                                       u 
                                       0 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               1 
                             
                             , 
                             
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     0 
                                     
                                       z 
                                       0 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                         
                           ?? 
                           0 
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                           ) 
                         
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
                         σ 
                         t 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         w 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         t 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     σ 
                                     t 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       1 
                                       , 
                                       t 
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   ω 
                                   ⁢ 
                                   
                                     
                                       
                                         
                                             
                                         
                                         ⁢ 
                                         x 
                                       
                                       → 
                                     
                                     t 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   u 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   t 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 z 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         
                           ?? 
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           sk 
                           Γ 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             Γ 
                             , 
                             
                               k 
                               0 
                               * 
                             
                             , 
                             
                               
                                 { 
                                 
                                   k 
                                   t 
                                   * 
                                 
                                 } 
                               
                               
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                   
                                   ) 
                                 
                                 ∈ 
                                 Γ 
                               
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     153 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the encryption device  200  will be described. 
     The encryption device  200  includes a public parameter acquisition unit  210 , an information input unit  220 , a cipher data generation unit  230 , and a data transmission unit  240 . The cipher data generation unit  230  includes a random number generation unit  231 , a cipher element generation unit  232 , an f vector generation unit  233 , and an s vector generation unit  234 . 
     With reference to  FIG. 18 , the process of the Enc algorithm will be described. 
     (S 601 : Public Parameter Acquisition Step) 
     Using the communication device and via the network, for example, the public parameter acquisition unit  210  obtains the public parameter pk generated by the key generation device  100 . 
     (S 602 : Information Input Step) 
     Using the input device, the information input unit  220  takes as input an access structure S:=(M, ρ). Note that the access structure S is to be set according to the conditions of a system to be implemented. Note also that attribute information of the user capable of decryption is set in ρ of the access structure S, for example. 
     Using the input device, the information input unit  220  also takes as input a message m to be transmitted to the decryption device  300 . 
     (S 603 : f Vector Generation Step) 
     Using the processing device, the f vector generation unit  233  randomly generates a vector f{right arrow over ( )} having r pieces of elements, as indicated in Formula 154. 
     
       
         
           
             
               
                 
                   
                     f 
                     → 
                   
                   ⁢ 
                   
                     ⟵ 
                     U 
                   
                   ⁢ 
                   
                     ?? 
                     q 
                     r 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     154 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 604 : s Vector Generation Step) 
     Using the processing device and based on an (L rows×r columns) matrix M included in the access structure S inputted in (S 602 ) and the vector f{right arrow over ( )} generated in (S 603 ), the s vector generation unit  234  generates a vector s{right arrow over ( )} T :=(s 1 , . . . , s L ) T , as indicated in Formula 155.
 
 {right arrow over (s)}   T :=( s   1   , . . . ,s   L ) T   :=M·{right arrow over (f)}   T   [Formula 155]
 
     Using the processing device and based on the vector f{right arrow over ( )} generated in (S 603 ), the s vector generation unit  234  also generates a value s 0 , as indicated in Formula 156.
 
 s   0 :={right arrow over (1)} ·{right arrow over (f)}   T   [Formula 156]
 
     (S 605 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  231  generates random numbers, as indicated in Formula 157. 
     
       
         
           
             
               
                 
                   
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               η 
                               
                                 0 
                                 , 
                                 1 
                               
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               η 
                               
                                 0 
                                 , 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             z 
                             0 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       
                         θ 
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               η 
                               
                                 i 
                                 , 
                                 1 
                               
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               η 
                               
                                 i 
                                 , 
                                 z 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           z 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               η 
                               
                                 i 
                                 , 
                                 1 
                               
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               η 
                               
                                 i 
                                 , 
                                 z 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           z 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     157 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 606 : Cipher Element Generation Step) 
     Using the processing device, the cipher element generation unit  232  generates an element c 0  of cipher data c, as indicated in Formula 158. 
     
       
         
           
             
               
                 
                   
                     c 
                     0 
                   
                   := 
                   
                     
                       ( 
                       
                         
                           - 
                           
                             s 
                             0 
                           
                         
                         , 
                         
                           
                             
                               
                                 0 
                                 
                                   u 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 u 
                                 0 
                               
                             
                           
                           ⁢ 
                           ζ 
                         
                         , 
                         
                           
                             
                               
                                 0 
                                 
                                   w 
                                   0 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 w 
                                 0 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               0 
                             
                             
                               ︷ 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                       
                       ) 
                     
                     
                       ?? 
                       0 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     158 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the cipher element generation unit  232  also generates an element c i  of the cipher data c for each integer i=1, . . . , L, as indicated in Formula 159. 
     
       
         
           
             
               
                 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       i 
                     
                     = 
                     1 
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   L 
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ( 
                       
                         t 
                         , 
                         
                           
                             v 
                             → 
                           
                           i 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   μ 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       - 
                                       1 
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 + 
                                 
                                   
                                     θ 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 u 
                               
                               , 
                             
                             
                               ︷ 
                               u 
                             
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 w 
                               
                               , 
                             
                             
                               ︷ 
                               w 
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               z 
                             
                           
                         
                         ) 
                       
                       ?? 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   μ 
                                   i 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     t 
                                     , 
                                     
                                       - 
                                       1 
                                     
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   s 
                                   i 
                                 
                                 ⁢ 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                               , 
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 u 
                               
                               , 
                             
                             
                               ︷ 
                               u 
                             
                           
                           ⁢ 
                           
                             
                               
                                 0 
                                 w 
                               
                               , 
                             
                             
                               ︷ 
                               w 
                             
                           
                           ⁢ 
                           
                             
                               
                                 η 
                                 → 
                               
                               i 
                             
                             
                               ︷ 
                               z 
                             
                           
                         
                         ) 
                       
                       ?? 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     159 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the cipher element generation unit  232  also generates an element c d+1  of the cipher data c, as indicated in Formula 160.
 
 c   d+1   :=g   T   ζ   m   [Formula 160]
 
     (S 607 : Data Transmission Step) 
     Using the communication device and via the network, for example, the data transmission unit  240  transmits a ciphertext ct S  having, as elements, the access structure S inputted in (S 602 ) and c 0 , c 1 , . . . , c L , and c d+1  generated in (S 606 ) to the decryption device  300 . As a matter of course, the ciphertext ct S  may be transmitted to the decryption device  300  by another method. 
     In brief, in (S 601 ) through (S 606 ), the encryption device  200  executes the Enc algorithm indicated in Formula 161, and thus generates the ciphertext ct S . In (S 607 ), the encryption device  200  transmits the generated ciphertext ct S  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       Enc 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           m 
                           , 
                           
                             ?? 
                             := 
                             
                               ( 
                               
                                 M 
                                 , 
                                 ρ 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       f 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         r 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         s 
                         0 
                       
                       := 
                       
                         
                           1 
                           → 
                         
                         · 
                         
                           
                             f 
                             → 
                           
                           T 
                         
                       
                     
                     , 
                     
                       
                         
                           s 
                           → 
                         
                         T 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               
                                 s 
                                 1 
                               
                               , 
                               ⋯ 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 s 
                                 L 
                               
                             
                             ) 
                           
                           T 
                         
                         := 
                         
                           M 
                           · 
                           
                             
                               f 
                               → 
                             
                             T 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           z 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         0 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               - 
                               
                                 s 
                                 0 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     0 
                                     
                                       u 
                                       0 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               ζ 
                             
                             , 
                             
                               
                                 
                                   
                                     0 
                                     
                                       w 
                                       0 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       η 
                                       → 
                                     
                                     0 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                         
                           ?? 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       - 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       
                         θ 
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         z 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     μ 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     
                                       s 
                                       i 
                                     
                                     ⁢ 
                                     
                                       
                                         e 
                                         → 
                                       
                                       1 
                                     
                                   
                                   + 
                                   
                                     
                                       θ 
                                       i 
                                     
                                     ⁢ 
                                     
                                       
                                         v 
                                         → 
                                       
                                       i 
                                     
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   u 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   w 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         ?? 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
                         μ 
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         z 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     μ 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁢ 
                                   
                                     
                                       v 
                                       → 
                                     
                                     1 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   u 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   w 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   η 
                                   → 
                                 
                                 i 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         ?? 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                       := 
                       
                         
                           g 
                           T 
                           ζ 
                         
                         ⁢ 
                         m 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           ?? 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             ?? 
                             , 
                             
                               c 
                               0 
                             
                             , 
                             
                               c 
                               1 
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               c 
                               L 
                             
                             , 
                             
                               c 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     161 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the decryption device  300  will be described. 
     The decryption device  300  includes a decryption key acquisition unit  310 , a data receiving unit  320 , a span program computation unit  330 , a complementary coefficient computation unit  340 , a pairing operation unit  350 , and a message computation unit  360 . 
     With reference to  FIG. 15 , the process of the Dec algorithm will be described. 
     (S 701 : Decryption Key Acquisition Step) 
     Using the communication device and via the network, for example, the decryption key acquisition unit  310  obtains the decryption key sk Γ  distributed by the key generation device  100 . The decryption key acquisition unit  310  also obtains the public parameter pk generated by the key generation device  100 . 
     (S 702 : Data Reception Step) 
     Using the communication device and via the network, for example, the data receiving unit  320  receives the ciphertext ct S  transmitted by the encryption device  200 . 
     (S 703 : Span Program Computation Step) 
     Using the processing device, the span program computation unit  330  checks whether or not the access structure S included in the ciphertext ct S  obtained in (S 702 ) accepts Γ included in the decryption key sk Γ  received in (S 701 ). The method for checking whether or not the access structure S accepts Γ is the same as that described in “5. Concept for implementing functional encryption in Embodiment 1”. 
     If the access structure S accepts Γ (accept in S 703 ), the span program computation unit  330  advances the process to (S 704 ). If the access structure S rejects Γ (reject in S 703 ), the span program computation unit  330  determines that the ciphertext ct S  cannot be decrypted with the decryption key sk Γ  and ends the process. 
     (S 704 ) through (S 706 ) are substantially the same as (S 404 ) through (S 406 ) in Embodiment 2 shown in  FIG. 12 . 
     In brief, in (S 701 ) through (S 706 ), the encryption device  200  executes the Dec algorithm indicated in Formula 162, and thus generates the message m′ (=m). 
     
       
         
           
             
               
                 
                   
                     
                       Dec 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           
                             
                               sk 
                               Γ 
                             
                             := 
                             
                               ( 
                               
                                 Γ 
                                 , 
                                 
                                   k 
                                   0 
                                   * 
                                 
                                 , 
                                 
                                   
                                     { 
                                     
                                       k 
                                       t 
                                       * 
                                     
                                     } 
                                   
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               ct 
                               ?? 
                             
                             := 
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 
                                   c 
                                   0 
                                 
                                 , 
                                 
                                   c 
                                   1 
                                 
                                 , 
                                 ⋯ 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   c 
                                   L 
                                 
                                 , 
                                 
                                   c 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         If 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ?? 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               M 
                               , 
                               ρ 
                             
                             ) 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           accepts 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           Γ 
                         
                         := 
                         
                           { 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   x 
                                   → 
                                 
                                 t 
                               
                             
                             ) 
                           
                           } 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       then 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       compute 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       I 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       and 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           { 
                           
                             α 
                             i 
                           
                           } 
                         
                         
                           i 
                           ∈ 
                           I 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         1 
                         → 
                       
                       = 
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             I 
                           
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           ⁢ 
                           
                             M 
                             i 
                           
                         
                       
                     
                     , 
                     
                       where 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         M 
                         i 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       is 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       the 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                          i-th 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       row 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       of 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       M 
                     
                     , 
                     and 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       I 
                       ⊆ 
                       
                         
                           { 
                           
                             
                               i 
                               ∈ 
                               
                                 { 
                                 
                                   1 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   L 
                                 
                                 } 
                               
                             
                             | 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 [ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                   = 
                                   
                                     
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                         ⋀ 
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                       
                                       ∈ 
                                       
                                         
                                           Γ 
                                           ⋀ 
                                           
                                             
                                               v 
                                               → 
                                             
                                             i 
                                           
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           i 
                                         
                                       
                                     
                                     = 
                                     0 
                                   
                                 
                                 ] 
                               
                               ⋁ 
                               
                                 [ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                   = 
                                   
                                     ⫬ 
                                     
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                         ⋀ 
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                       
                                       ∈ 
                                       
                                         
                                           ⋀ 
                                           
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                             · 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               i 
                                             
                                           
                                         
                                         ≠ 
                                         0 
                                       
                                     
                                   
                                 
                                 ] 
                               
                             
                           
                           } 
                         
                         . 
                         
                           
 
                         
                         ⁢ 
                         K 
                       
                     
                     := 
                     
                       
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 0 
                               
                               , 
                               
                                 k 
                                 0 
                                 * 
                               
                             
                             ) 
                           
                         
                         ⁢ 
                         
                           
                             ∏ 
                             
                               
                                 i 
                                 ∈ 
                                 
                                   I 
                                   ⋀ 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                 
                               
                               = 
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       v 
                                       → 
                                     
                                     i 
                                   
                                 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     i 
                                   
                                   , 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               α 
                               i 
                             
                             ⁢ 
                             
                               
                                 ∏ 
                                 
                                   
                                     i 
                                     ∈ 
                                     
                                       I 
                                       ⋀ 
                                       
                                         ρ 
                                         ⁡ 
                                         
                                           ( 
                                           i 
                                           ) 
                                         
                                       
                                     
                                   
                                   = 
                                   
                                     ⫬ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           
                                             v 
                                             → 
                                           
                                           i 
                                         
                                       
                                       ) 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   e 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         c 
                                         i 
                                       
                                       , 
                                       
                                         k 
                                         t 
                                         * 
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     α 
                                     i 
                                   
                                   / 
                                   
                                     ( 
                                     
                                       
                                         
                                           v 
                                           → 
                                         
                                         i 
                                       
                                       - 
                                       
                                         
                                           x 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   
 
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 return 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   m 
                                   ′ 
                                 
                               
                             
                           
                         
                       
                       := 
                       
                         
                           c 
                           
                             d 
                             + 
                             1 
                           
                         
                         / 
                         
                           K 
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     162 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, as in the cryptographic system  10  according to Embodiment 2, in the cryptographic system  10  according to Embodiment 3, the index parts are provided, so that the bases that are used for every attribute category can be constructed as the common bases (basis B and basis B*). As a result, only the basis B and the basis B* need to be included in a public parameter, eliminating the need for reissuing the public parameter when an attribute category is to be added at a later stage. 
     As in Embodiment 2, for the index parts, it is required that 0 be obtained as a result of an inner-product operation of the index parts. Therefore, although the 2-dimensional index parts, namely the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 , are employed in the above description, the index parts are not limited to 2-dimensional and may be 3-dimensional or higher-dimensional. The values assigned to the index parts are not limited to those described above, and a different assignment arrangement may be employed. 
     The functional encryption scheme has been described above. As indicated in Formula 163 through Formula 167, however, the functional encryption scheme can be modified into an attribute-based encryption scheme. Note that N 0  is 1+1+1+1+1=5 and N 1  is 2+2+8+2+2=16 in Formula 163 through Formula 167. That is, u 0 =1, w 0 =1, z 0 =1, n=2, u=8, w=2, and z=2. Even in this case, security can be proven. 
     
       
         
           
             
               
                 
                   
                     
                       Setup 
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                     : 
                     
                         
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           param 
                           , 
                           
                             ( 
                             
                               
                                 ?? 
                                 0 
                               
                               , 
                               
                                 ?? 
                                 0 
                                 * 
                               
                             
                             ) 
                           
                           , 
                           
                             ( 
                             
                               ?? 
                               , 
                               
                                 ?? 
                                 * 
                               
                             
                             ) 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ⟵ 
                         R 
                       
                       ⁢ 
                       
                         
                           ?? 
                           ob 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       / 
                       
                         * 
                         N 
                       
                     
                     = 
                     
                       
                         16 
                         * 
                         
                           / 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ?? 
                               ^ 
                             
                             0 
                           
                         
                       
                       := 
                       
                         ( 
                         
                           
                             b 
                             
                               0 
                               , 
                               1 
                             
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               3 
                             
                           
                           , 
                           
                             b 
                             
                               0 
                               , 
                               5 
                             
                           
                         
                         ) 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ?? 
                       ^ 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           1 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           4 
                         
                         , 
                         
                           b 
                           15 
                         
                         , 
                         
                           b 
                           16 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       0 
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             0 
                             , 
                             1 
                           
                           * 
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             3 
                           
                           * 
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             4 
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           1 
                           * 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           4 
                           * 
                         
                         , 
                         
                           b 
                           13 
                           * 
                         
                         , 
                         
                           b 
                           14 
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     pk 
                     := 
                     
                       ( 
                       
                         
                           1 
                           λ 
                         
                         , 
                         param 
                         , 
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                         
                         , 
                         
                           ?? 
                           ^ 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     sk 
                     := 
                     
                       ( 
                       
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                           * 
                         
                         , 
                         
                           
                             ?? 
                             ^ 
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     pk 
                   
                   , 
                   
                     sk 
                     . 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     163 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         
                           ?? 
                           ob 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                       : 
                       
                           
                       
                       ⁢ 
                       
                         param 
                         ?? 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           q 
                           , 
                           ?? 
                           , 
                           
                             ?? 
                             T 
                           
                           , 
                           g 
                           , 
                           e 
                         
                         ) 
                       
                       ⁢ 
                       
                         ⟵ 
                         R 
                       
                       ⁢ 
                       
                         
                           ?? 
                           bpg 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ψ 
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       ?? 
                       q 
                       x 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       N 
                       0 
                     
                     := 
                     5 
                   
                   , 
                   
                     
                       N 
                       1 
                     
                     := 
                     16 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       t 
                     
                     = 
                     0 
                   
                   , 
                   1 
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         param 
                         
                           ?? 
                           t 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             q 
                             , 
                             
                               ?? 
                               t 
                             
                             , 
                             
                               ?? 
                               T 
                             
                             , 
                             
                               ?? 
                               t 
                             
                             , 
                             e 
                           
                           ) 
                         
                         := 
                         
                           
                             ?? 
                             dpvs 
                           
                           ⁢ 
                           
                             ( 
                             
                               
                                 1 
                                 λ 
                               
                               , 
                               
                                 N 
                                 t 
                               
                               , 
                               
                                 param 
                                 ?? 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         X 
                         t 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ) 
                           
                           
                             i 
                             , 
                             
                               j 
                               = 
                               1 
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               N 
                               t 
                             
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           GL 
                           ⁡ 
                           
                             ( 
                             
                               
                                 N 
                                 t 
                               
                               , 
                               
                                 ?? 
                                 q 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         X 
                         t 
                         * 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               ϑ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ) 
                           
                           
                             i 
                             , 
                             
                               j 
                               = 
                               1 
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               N 
                               t 
                             
                           
                         
                         := 
                         
                           ψ 
                           · 
                           
                             
                               ( 
                               
                                 X 
                                 t 
                                 T 
                               
                               ) 
                             
                             
                               - 
                               1 
                             
                           
                         
                       
                     
                     , 
                     hereafter 
                     , 
                     
                       
                         χ 
                         → 
                       
                       
                         t 
                         , 
                         i 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     and 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ϑ 
                         → 
                       
                       
                         t 
                         , 
                         i 
                       
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     denote 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     the 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       i-th 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     rows 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     of 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       X 
                       t 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     and 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           X 
                           t 
                           * 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                     , 
                     respectively 
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               χ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             
                               ∑ 
                               
                                 N 
                                 t 
                               
                             
                             
                               j 
                               = 
                               1 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       b 
                       
                         t 
                         , 
                         i 
                       
                       * 
                     
                     := 
                     
                       
                         
                           ( 
                           
                             
                               ϑ 
                               → 
                             
                             
                               t 
                               , 
                               i 
                             
                           
                           ) 
                         
                         
                           ?? 
                           t 
                         
                       
                       = 
                       
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               1 
                             
                             
                               N 
                               t 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ϑ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             for 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                         
                         = 
                         1 
                       
                     
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     N 
                     t 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       ?? 
                       t 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             t 
                             , 
                             1 
                           
                           * 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             t 
                             , 
                             
                               N 
                               t 
                             
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       g 
                       T 
                     
                     := 
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             g 
                             , 
                             g 
                           
                           ) 
                         
                       
                       ψ 
                     
                   
                   , 
                   
                     param 
                     := 
                     
                       ( 
                       
                         
                           
                             { 
                             
                               param 
                               
                                 V 
                                 t 
                               
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               0 
                             
                             , 
                             1 
                           
                         
                         , 
                         
                           g 
                           T 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     return 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           param 
                           , 
                           ?? 
                           , 
                           
                             ?? 
                             * 
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         KeyGen 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             sk 
                             , 
                             
                               Γ 
                               := 
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         x 
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ❘ 
                                   
                                     1 
                                     ≤ 
                                     t 
                                     ≤ 
                                     d 
                                   
                                 
                                 } 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ω 
                       , 
                       
                         
                           φ 
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           0 
                           * 
                         
                         := 
                         
                           
                             ( 
                             
                               ω 
                               , 
                               0 
                               , 
                               1 
                               , 
                               
                                 φ 
                                 0 
                               
                               , 
                               0 
                             
                             ) 
                           
                           
                             ?? 
                             0 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                         
                         ∈ 
                         Γ 
                       
                       , 
                       
                         σ 
                         t 
                       
                       , 
                       
                         φ 
                         
                           t 
                           , 
                           1 
                         
                       
                       , 
                       
                         φ 
                         
                           t 
                           , 
                           2 
                         
                       
                       , 
                       
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           t 
                           * 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     
                                       σ 
                                       t 
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         1 
                                         , 
                                         t 
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     ω 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         1 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   4 
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     0 
                                     8 
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   8 
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     φ 
                                     
                                       t 
                                       , 
                                       1 
                                     
                                   
                                   , 
                                   
                                     φ 
                                     
                                       t 
                                       , 
                                       2 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   2 
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   2 
                                 
                                 
                                   ︷ 
                                   2 
                                 
                               
                             
                             ) 
                           
                           
                             B 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             sk 
                             Γ 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               Γ 
                               , 
                               
                                 k 
                                 0 
                                 * 
                               
                               , 
                               
                                 
                                   { 
                                   
                                     k 
                                     t 
                                     * 
                                   
                                   } 
                                 
                                 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         x 
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ∈ 
                                   Γ 
                                 
                               
                             
                             ) 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     164 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               Enc 
                               ⁡ 
                               
                                 ( 
                                 
                                   pk 
                                   , 
                                   m 
                                   , 
                                   
                                     ?? 
                                     := 
                                     
                                       ( 
                                       
                                         M 
                                         , 
                                         ρ 
                                       
                                       ) 
                                     
                                   
                                 
                                 ) 
                               
                             
                             : 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 f 
                                 → 
                               
                               ⁢ 
                               
                                 ⟵ 
                                 U 
                               
                               ⁢ 
                               
                                 ?? 
                                 q 
                                 r 
                               
                             
                           
                           , 
                           
                             
                               s 
                               0 
                             
                             := 
                             
                               
                                 1 
                                 → 
                               
                               · 
                               
                                 
                                   f 
                                   → 
                                 
                                 T 
                               
                             
                           
                           , 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 s 
                                 → 
                               
                               T 
                             
                             := 
                             
                               
                                 
                                   ( 
                                   
                                     
                                       s 
                                       1 
                                     
                                     , 
                                     ⋯ 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       s 
                                       L 
                                     
                                   
                                   ) 
                                 
                                 T 
                               
                               := 
                               
                                 M 
                                 · 
                                 
                                   
                                     f 
                                     → 
                                   
                                   T 
                                 
                               
                             
                           
                           , 
                           ζ 
                           , 
                           
                             
                               η 
                               0 
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                             
                           
                           , 
                         
                       
                     
                   
                   
                     
                       
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               c 
                               0 
                             
                             := 
                             
                               
                                 ( 
                                 
                                   
                                     - 
                                     
                                       s 
                                       0 
                                     
                                   
                                   , 
                                   0 
                                   , 
                                   ζ 
                                   , 
                                   0 
                                   , 
                                   
                                     η 
                                     0 
                                   
                                 
                                 ) 
                               
                               
                                 ?? 
                                 0 
                               
                             
                           
                           , 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     165 
                   
                   ] 
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         i 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       θ 
                       i 
                     
                     , 
                     
                       η 
                       
                         i 
                         , 
                         1 
                       
                     
                     , 
                     
                       
                         η 
                         
                           i 
                           , 
                           2 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         c 
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     μ 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     i 
                                   
                                   + 
                                   
                                     
                                       θ 
                                       i 
                                     
                                     ⁢ 
                                     
                                       v 
                                       i 
                                     
                                   
                                 
                                 , 
                                 
                                   - 
                                   
                                     θ 
                                     i 
                                   
                                 
                               
                               
                                 ︷ 
                                 4 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   8 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 8 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   2 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   η 
                                   
                                     i 
                                     , 
                                     1 
                                   
                                 
                                 , 
                                 
                                   η 
                                   
                                     i 
                                     , 
                                     2 
                                   
                                 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                           
                           ) 
                         
                         ?? 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               v 
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       μ 
                       i 
                     
                     , 
                     
                       η 
                       
                         i 
                         , 
                         1 
                       
                     
                     , 
                     
                       
                         η 
                         
                           i 
                           , 
                           2 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         c 
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     μ 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         v 
                                         i 
                                       
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 4 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   8 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 8 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   0 
                                   2 
                                 
                                 , 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   η 
                                   
                                     i 
                                     , 
                                     1 
                                   
                                 
                                 , 
                                 
                                   η 
                                   
                                     i 
                                     , 
                                     2 
                                   
                                 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                           
                           ) 
                         
                         ?? 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                       := 
                       
                         
                           g 
                           T 
                           ζ 
                         
                         ⁢ 
                         m 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           ?? 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             ?? 
                             , 
                             
                               c 
                               0 
                             
                             , 
                             
                               c 
                               1 
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               c 
                               L 
                             
                             , 
                             
                               c 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                         . 
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       Dec 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           
                             
                               sk 
                               Γ 
                             
                             := 
                             
                               ( 
                               
                                 Γ 
                                 , 
                                 
                                   k 
                                   0 
                                   * 
                                 
                                 , 
                                 
                                   
                                     { 
                                     
                                       k 
                                       t 
                                       * 
                                     
                                     } 
                                   
                                   
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           x 
                                           t 
                                         
                                       
                                       ) 
                                     
                                     ∈ 
                                     Γ 
                                   
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               ct 
                               ?? 
                             
                             := 
                             
                               ( 
                               
                                 ?? 
                                 , 
                                 
                                   c 
                                   0 
                                 
                                 , 
                                 
                                   c 
                                   1 
                                 
                                 , 
                                 ⋯ 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   c 
                                   L 
                                 
                                 , 
                                 
                                   c 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         If 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         ?? 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               M 
                               , 
                               ρ 
                             
                             ) 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           accepts 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           Γ 
                         
                         := 
                         
                           { 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 x 
                                 t 
                               
                             
                             ) 
                           
                           } 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       then 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       compute 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       I 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       and 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           { 
                           
                             α 
                             i 
                           
                           } 
                         
                         
                           i 
                           ∈ 
                           I 
                         
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       such 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       that 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         1 
                         → 
                       
                       = 
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             I 
                           
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           ⁢ 
                           
                             M 
                             i 
                           
                         
                       
                     
                     , 
                     
                       where 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         M 
                         i 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       is 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       the 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         i-th 
                       
                       ⁢ 
                       
                         
                             
                         
                         ⁢ 
                         
                             
                         
                       
                       ⁢ 
                       row 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       of 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       M 
                     
                     , 
                     and 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     166 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     I 
                     ⊆ 
                     
                       
                         { 
                         
                           
                             i 
                             ∈ 
                             
                               { 
                               
                                 1 
                                 , 
                                 ⋯ 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 L 
                               
                               } 
                             
                           
                           ❘ 
                           
                             
                               [ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   
                                     
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             v 
                                             i 
                                           
                                         
                                         ) 
                                       
                                       ⋀ 
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             x 
                                             t 
                                           
                                         
                                         ) 
                                       
                                     
                                     ∈ 
                                     
                                       Γ 
                                       ⋀ 
                                       
                                         v 
                                         i 
                                       
                                     
                                   
                                   = 
                                   
                                     x 
                                     t 
                                   
                                 
                               
                               ] 
                             
                             ⋁ 
                             
                                 
                             
                             ⁢ 
                             
                               [ 
                               
                                   
                               
                               ⁢ 
                               
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                                 = 
                                 
                                   ⫬ 
                                   
                                     
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             v 
                                             i 
                                           
                                         
                                         ) 
                                       
                                       ⋀ 
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             x 
                                             t 
                                           
                                         
                                         ) 
                                       
                                     
                                     ∈ 
                                     
                                       
                                         Γ 
                                         ⋀ 
                                         
                                           v 
                                           i 
                                         
                                       
                                       ≠ 
                                       
                                         x 
                                         t 
                                       
                                     
                                   
                                 
                               
                               ] 
                             
                           
                         
                         } 
                       
                       . 
                       
                         
 
                       
                       ⁢ 
                       K 
                     
                   
                   := 
                   
                     
                       
                         e 
                         ⁡ 
                         
                           ( 
                           
                             
                               c 
                               0 
                             
                             , 
                             
                               k 
                               0 
                               * 
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         
                           ∏ 
                           
                             
                               i 
                               ∈ 
                               
                                 I 
                                 ⋀ 
                                 
                                   ρ 
                                   ⁡ 
                                   
                                     ( 
                                     i 
                                     ) 
                                   
                                 
                               
                             
                             = 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   v 
                                   i 
                                 
                               
                               ) 
                             
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   c 
                                   i 
                                 
                                 , 
                                 
                                   k 
                                   t 
                                   * 
                                 
                               
                               ) 
                             
                           
                           ⁢ 
                           
                             α 
                             i 
                           
                           ⁢ 
                           
                             
                               ∏ 
                               
                                 
                                   i 
                                   ∈ 
                                   
                                     I 
                                     ⋀ 
                                     
                                       ρ 
                                       ⁡ 
                                       
                                         ( 
                                         i 
                                         ) 
                                       
                                     
                                   
                                 
                                 = 
                                 
                                   ⫬ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         v 
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                               
                             
                             ⁢ 
                             
                               
                                 e 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       c 
                                       i 
                                     
                                     , 
                                     
                                       k 
                                       t 
                                       * 
                                     
                                   
                                   ) 
                                 
                               
                               ⁢ 
                               
                                 
                                   α 
                                   i 
                                 
                                 / 
                                 
                                   
                                     α 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         v 
                                         i 
                                       
                                       - 
                                       
                                         x 
                                         i 
                                       
                                     
                                     ) 
                                   
                                 
                               
                               ⁢ 
                               
                                 
 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               return 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               
                                 m 
                                 ′ 
                               
                             
                           
                         
                       
                     
                     := 
                     
                       
                         c 
                         
                           d 
                           + 
                           1 
                         
                       
                       / 
                       
                         K 
                         . 
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     In Embodiment 2, the KP-FE scheme has been described. In Embodiment 3, the CP-FE scheme has been described. As with these schemes, the unified-policy (UP-FE) scheme described in Non-Patent Literature 30 may be constructed such that there is no need to reissue a public parameter when an attribute category is to be added. 
     Embodiment 4 
     Like Embodiments 2 and 3, this embodiment describes a narrowly-defined cryptographic processing scheme. In particular, this embodiment describes a hierarchical inner-product predicate encryption (HIPE) scheme. 
     The HIPE scheme is an inner-product predicate encryption scheme which is capable of delegation. Delegation means that a user who has a higher-level key generates a lower-level key having more limited capabilities than the user&#39;s (higher-level) key. The limited capabilities mean that the lower-level key can decrypt only some of ciphertexts that can be decrypted with the higher-level key. As explained in Embodiment 1, the inner-product predicate encryption scheme corresponds to a case where the design of the access structure in the functional encryption scheme is limited. 
     The HIPE scheme includes a first scheme which is efficient, and a second scheme which is less efficient than the first scheme, but guarantees security of even attribute information that is set in a ciphertext (see Non-Patent Literature 29). Here, as an example of the second scheme, a scheme which allows for addition of an attribute category without reissuing a public parameter will be described. However, by making similar modifications to the algorithms described in Non-Patent Literature 29, the first scheme can also be constructed to allow for addition of an attribute category without reissuing a public parameter. 
     First, the construction of the HIPE scheme will be described. 
     Second, the configuration of a cryptographic system  10  that implements the HIPE scheme will be described. 
     Third, the HIPE scheme will be described in detail. 
     &lt;1. Construction of HIPE Scheme&gt; 
     The HIPE scheme consists of five algorithms: Setup, KeyGen, Enc, Dec, and Delegate L . 
     (Setup) 
     A Setup algorithm is a probabilistic algorithm that takes as input a security parameter 1 λ , and outputs a master public key pk and a master secret key sk. The master secret key sk is a top-level key. 
     (KeyGen) 
     A KeyGen algorithm is a probabilistic algorithm that takes as input the master public key pk, the master secret key sk, and predicate information (v{right arrow over ( )} 1 , . . . , v{right arrow over ( )} L ) (1≦L≦d), and outputs an L-th-level secret key sk L . 
     (Enc) 
     An Enc algorithm is a probabilistic algorithm that takes as input the master public key pk, attribute information (x{right arrow over ( )} 1 , . . . , x{right arrow over ( )} h ) (1≦h≦d), and a message m, and outputs a ciphertext ct. 
     (Dec) 
     A Dec algorithm is a probabilistic algorithm that takes as input the master public key pk, the L-th-level secret key sk L , and the ciphertext ct, and outputs the message m or a distinguished symbol ⊥. 
     (Delegate L ) 
     Delegate L  is a probabilistic algorithm that takes as input the master public key pk, the L-th-level secret key sk L , and (L+1)-th level predicate information v{right arrow over ( )} L+1  (L+1≦d), and outputs an (L+1)-th-level secret key sk L+1 . That is, the Delegate L  algorithm outputs a lower-level secret key. 
     &lt;2. Configuration of Cryptographic System  10  that Implements HIPE Scheme&gt; 
       FIG. 20  is a configuration diagram of the cryptographic system  10  that implements the HIPE scheme according to Embodiment 4. 
     The cryptographic system  10  includes a key generation device  100 , an encryption device  200 , a decryption device  300 , and a key delegation device  400 . It is assumed in the following description that the decryption device  300  includes the key delegation device  400 . However, the key delegation device  400  may be provided separately from the decryption device  300 . 
     The key generation device  100  executes the Setup algorithm taking as input a security parameter λ, and thus generates a master public key pk and a master secret key sk. Then, the key generation device  100  publishes the generated master public key pk. The key generation device  100  also executes the KeyGen algorithm taking as input the master public key pk, the master secret key sk, and predicate information (v{right arrow over ( )} 1 , . . . , v{right arrow over ( )} L ) (1≦L≦d), and thus generates an L-th-level secret key sk L , and distributes the L-th-level secret key sk L  to the L-th level decryption device  300  in secrecy. 
     The encryption device  200  executes the Enc algorithm taking as input the master public key pk, attribute information (x{right arrow over ( )} 1 , . . . , x{right arrow over ( )} h ) (1≦h≦d), and a message m, and thus generates a ciphertext ct. The encryption device  200  transmits the generated ciphertext ct to the decryption device  300 . 
     The decryption device  300  executes the Dec algorithm taking as input the master public key pk, the L-th-level secret key sk L , and the ciphertext ct, and outputs the message m or a distinguished symbol  1 . 
     The key delegation device  400  executes the Delegate L  algorithm taking as input the master public key pk, the L-th-level secret key sk L , and (L+1)-th-level predicate information v{right arrow over ( )} L+1  (L+1≦d), and thus generates an (L+1)-th-level secret key sk L+1 , and distributes the (L+1)-th-level secret key sk L+1  to the (L+1)-th-level decryption device  300  in secrecy. 
     &lt;3. HIPE Scheme in Detail&gt; 
     With reference to  FIGS. 21 to 29 , the HIPE scheme and the operation and function of the cryptographic system  10  that implements the HIPE scheme according to Embodiment 4 will be described. 
       FIG. 21  is a configuration diagram of the key generation device  100  according to Embodiment 4.  FIG. 22  is a configuration diagram of the encryption device  200  according to Embodiment 4.  FIG. 23  is a configuration diagram of the decryption device  300  according to Embodiment 4.  FIG. 24  is a configuration diagram of the key delegation device  400  according to Embodiment 4. 
       FIGS. 25 and 26  show flowcharts illustrating the operation of the key generation device  100 .  FIG. 25  is a flowchart illustrating the process of the Setup algorithm.  FIG. 26  is a flowchart illustrating the process of the KeyGen algorithm.  FIG. 27  is a flowchart illustrating the operation of the encryption device  200  and illustrating the process of the Enc algorithm.  FIG. 28  is a flowchart illustrating the operation of the decryption device  300  and illustrating the process of the Dec algorithm.  FIG. 29  is a flowchart illustrating the operation of the key delegation device  400  and illustrating the process of the Delegate L  algorithm. 
     The function and operation of the key generation device  100  will be described. 
     The key generation device  100  includes a master key generation unit  110 , a master key storage unit  120 , an information input unit  130 , a decryption key generation unit  140 , and a key distribution unit  150 . The decryption key generation unit  140  includes a random number generation unit  143 , a key element generation unit  144 , a randomizing element generation unit  145 , and a delegation element generation unit  146 . 
     With reference to  FIG. 25 , the process of the Setup algorithm will be described. 
     S 801  is substantially the same as (S 101 ) in Embodiment 2 shown in  FIG. 9 . 
     (S 802 : Public Parameter Generation Step) 
     Using the processing device, the master key generation unit  110  generates a subbasis B^ 0  of the basis B 0 , a subbasis B^ of the basis B, a subbasis B^ 0,pk  of the basis B* 0 , and a subbasis B^* pk  of the basis B*, as indicated in Formula 167, the bases B 0 , B^, B, and B* 0  having been generated in (S 801 ).
 
   0 :=( b   0,1   ,b   0,1+u     0     +1   ,b   0,1+u     0     +1+w     0     +1   , . . . ,b   0,1+u     0     +1+w     0     +z     0   ),
 
 :=( b   1   , . . . ,b   2+n   ,b   2+n+u+w+1   , . . . ,b   2+n+u+w+z ),
 
 * 0,pk   =b*   0,1+u     0     +1+1   , . . . ,b   0,1+u     0     +1+w     0   ,
 
 * pk :=( b*   1   ,b*   2   ,b*   2+n+u+1   , . . . ,b*   2+n+u+w )  [Formula 167]
 
     The master key generation unit  110  generates a public parameter pk by putting together the generated subbasis B^ 0 , subbasis B^, subbasis B^* 0,pk , and subbasis B^* pk , the security parameter λ(1 λ ) inputted in (S 801 ), and param generated in (S 801 ). 
     (S 803 : Master Key Generation Step) 
     Using the processing device, the master key generation unit  110  generates a subbasis B^* 0,sk  of the basis B* 0  and a subbasis B^* sk  of the basis B*, as indicated in Formula 168, the bases B* 0  and B* having been generated in (S 801 ).
 
 * 0,sk :=( b*   0,1   ,b*   0,1+u     0     +1 ),
 
 * sk =( b*   2+1   , . . . ,b*   2+n )  [Formula 168]
 
     The master key generation unit  110  generates a master key sk which is constituted by the generated subbasis B^* 0  and subbasis B^*. 
     (S 804 : Master Key Storage Step) 
     The master key storage unit  120  stores the public parameter pk generated in (S 802 ) in the storage device. The master key storage unit  120  also stores the master key sk generated in (S 803 ) in the storage device. 
     In brief, in (S 801 ) through (S 803 ), the key generation device  100  executes the Setup algorithm indicated in Formula 169, and thus generates the public parameter pk and the master key sk. In (S 804 ), the key generation device  100  stores the generated public parameter pk and master key sk in the storage device. 
     The public parameter is published via the network, for example, and is made available for the encryption device  200  and the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                     
                       Setup 
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       : 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           param 
                           , 
                           
                             ( 
                             
                               
                                 ?? 
                                 0 
                               
                               , 
                               
                                 ?? 
                                 0 
                                 * 
                               
                             
                             ) 
                           
                           , 
                           
                             ( 
                             
                               ?? 
                               , 
                               
                                 ?? 
                                 * 
                               
                             
                             ) 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         ⟵ 
                         R 
                       
                       ⁢ 
                       
                         
                           ?? 
                           ob 
                         
                         ⁡ 
                         
                           ( 
                           
                             1 
                             λ 
                           
                           ) 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       0 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             0 
                             , 
                             1 
                           
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             
                               1 
                               + 
                               
                                 u 
                                 0 
                               
                               + 
                               1 
                             
                           
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             
                               1 
                               + 
                               
                                 u 
                                 0 
                               
                               + 
                               1 
                               + 
                               
                                 w 
                                 0 
                               
                               + 
                               1 
                             
                           
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             
                               1 
                               + 
                               
                                 u 
                                 0 
                               
                               + 
                               1 
                               + 
                               
                                 w 
                                 0 
                               
                               + 
                               
                                 z 
                                 0 
                               
                             
                           
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ?? 
                       ^ 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           1 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                           
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             w 
                             + 
                             1 
                           
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             w 
                             + 
                             z 
                           
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       
                         0 
                         , 
                         
                           p 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           k 
                         
                       
                       * 
                     
                     := 
                     
                       b 
                       
                         0 
                         , 
                         
                           1 
                           + 
                           
                             u 
                             0 
                           
                           + 
                           1 
                           + 
                           1 
                         
                       
                       * 
                     
                   
                   , 
                   ⋯ 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     b 
                     
                       0 
                       , 
                       
                         1 
                         + 
                         
                           u 
                           0 
                         
                         + 
                         1 
                         + 
                         
                           w 
                           0 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       
                         0 
                         , 
                         sk 
                       
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             0 
                             , 
                             1 
                           
                           * 
                         
                         , 
                         
                           b 
                           
                             0 
                             , 
                             
                               1 
                               + 
                               
                                 u 
                                 0 
                               
                               + 
                               1 
                             
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       
                         p 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         k 
                       
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           1 
                           * 
                         
                         , 
                         
                           b 
                           2 
                           * 
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             1 
                           
                           * 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             w 
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ?? 
                         ^ 
                       
                       sk 
                       * 
                     
                     := 
                     
                       ( 
                       
                         
                           b 
                           
                             2 
                             + 
                             1 
                           
                           * 
                         
                         , 
                         ⋯ 
                         ⁢ 
                         
                             
                         
                         , 
                         
                           b 
                           
                             2 
                             + 
                             n 
                           
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       pk 
                     
                     := 
                     
                       ( 
                       
                         
                           1 
                           λ 
                         
                         , 
                         param 
                         , 
                         
                           
                             ?? 
                             ^ 
                           
                           0 
                         
                         , 
                         
                           ?? 
                           ^ 
                         
                         , 
                         
                           
                             ?? 
                             ^ 
                           
                           
                             0 
                             , 
                             pk 
                           
                           * 
                         
                         , 
                         
                           
                             ?? 
                             ^ 
                           
                           pk 
                           * 
                         
                       
                       ) 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     sk 
                     := 
                     
                       
                         ( 
                         
                           
                             
                               ?? 
                               ^ 
                             
                             
                               0 
                               , 
                               sk 
                             
                             * 
                           
                           , 
                           
                             
                               ?? 
                               ^ 
                             
                             sk 
                             * 
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     169 
                   
                   ] 
                 
               
             
           
         
       
     
     With reference to  FIG. 26 , the process of the KeyGen algorithm to be executed by the key generation device  100  will be described. 
     (S 901 : Information Input Step) 
     Using the input device, the information input unit  130  takes as input predicate information (v{right arrow over ( )} 1 , . . . , v{right arrow over ( )} L ). Note that v{right arrow over ( )} i :=v i,1 , . . . , v i,n  for each integer i=1, . . . , L. Note that the attribute of the user of the key is input as the predicate information. 
     (S 902 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  143  generates random numbers, as indicated in Formula 170. 
     
       
         
           
             
               
                 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         j 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         2 
                         ⁢ 
                         L 
                       
                       ; 
                       
                         τ 
                         = 
                         
                           L 
                           + 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       d 
                       ; 
                       
                         i 
                         = 
                         1 
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       n 
                       ; 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     ψ 
                     , 
                     
                       μ 
                       
                         dec 
                         , 
                         t 
                       
                     
                     , 
                     
                       μ 
                       
                         ran 
                         , 
                         1 
                         , 
                         j 
                         , 
                         t 
                       
                     
                     , 
                     
                       s 
                       
                         dec 
                         , 
                         t 
                       
                     
                     , 
                     
                       s 
                       
                         ran 
                         , 
                         1 
                         , 
                         j 
                         , 
                         t 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       θ 
                       
                         dec 
                         , 
                         t 
                       
                     
                     , 
                     
                       
                         
                           
                             θ 
                             
                               ran 
                               , 
                               1 
                               , 
                               j 
                               , 
                               t 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       μ 
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         t 
                       
                     
                     , 
                     
                       μ 
                       
                         ran 
                         , 
                         2 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     , 
                     
                       s 
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         t 
                       
                     
                     , 
                     
                       s 
                       
                         ran 
                         , 
                         2 
                         , 
                         τ 
                         , 
                         ι 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       θ 
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         t 
                       
                     
                     , 
                     
                       
                         
                           
                             θ 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                               , 
                               t 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       L 
                       + 
                       1 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           dec 
                           , 
                           0 
                         
                       
                       := 
                       
                         η 
                         
                           dec 
                           , 
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       η 
                       
                         dec 
                         , 
                         0 
                         , 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           0 
                         
                       
                       := 
                       
                         η 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       η 
                       
                         ran 
                         , 
                         1 
                         , 
                         j 
                         , 
                         0 
                         , 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           0 
                         
                       
                       := 
                       
                         η 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       η 
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         0 
                         , 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         η 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         η 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           0 
                           , 
                           
                             w 
                             0 
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           dec 
                           , 
                           t 
                         
                       
                       := 
                       
                         η 
                         
                           dec 
                           , 
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       η 
                       
                         dec 
                         , 
                         t 
                         , 
                         w 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                         
                       
                       := 
                       
                         η 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         
                           
                             η 
                             
                               ran 
                               , 
                               1 
                               , 
                               j 
                               , 
                               t 
                               , 
                               w 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             w 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       := 
                       
                         η 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       η 
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         t 
                         , 
                         w 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           η 
                           -&gt; 
                         
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           ι 
                         
                       
                       := 
                       
                         η 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           
                             η 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                               , 
                               t 
                               , 
                               w 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             w 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       L 
                       + 
                       1 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     170 
                   
                   ] 
                 
               
             
           
         
       
     
     The random number generation unit  143  also sets s dec,0 , s ran,1,j,0 , s ran,2,τ,0 , and s del,(τ,ι),0 , as indicated in Formula 171.
 
 s   dec,0 :=Σ t=1   L   s   dec,t ,
 
 s   ran,1,j,0 :=Σ t=1   L   s   ran,1,j,t ,
 
 s   ran,2,τ,0 :=Σ t=1   L+1   s   ran,2,τ,t ,
 
 s   del,(τ,ι),0 :=Σ t=1   L+1   s   del,(τ,ι),t ,  [Formula 171]
 
     (S 903 : Key Element Generation Step) 
     Using the processing device, the key element generation unit  144  generates a key element k* L,dec  which is an element of the decryption key sk L , as indicated in Formula 172.
 
 k*   L,dec :=((− s   dec,0 ,0 u     0   ,1,{right arrow over (η)} dec,0 ,0 z     0   )   *     0   ),
 
(μ dec,t ( t,− 1), s   dec,t   {right arrow over (e)}   1 +θ dec,t   {right arrow over (v)}   t ,0 u ,{right arrow over (η)} dec,t ,0 z )   *  
 
: t= 1 , . . . ,L )  [Formula 172]
 
     (S 904 : First Randomizing Element Generation Step) 
     Using the processing device, the randomizing element generation unit  145  generates a first randomizing element k* L,ran,1,j  which is an element of the decryption key sk L , for each integer j=1, . . . , 2L, as indicated in Formula 173.
 
 k*   L,ran,1,j :=((− s   ran,1,j,0 ,0 u   0 ,0,{right arrow over (η)} ran,1,j,0 ,0 z     0   )   *     0   ,
 
(μ ran,1,j,t ( t,− 1), s   ran,1,j,t   {right arrow over (e)}   1 +θ ran,1,j,t   {right arrow over (v)}   t ,0 u ,
 
{right arrow over (η)} ran,1,j,t ,0 z )   *   :t= 1 , . . . ,L )  [Formula 173]
 
     (S 905 : Second Randomizing Element Generation Step) 
     Using the processing device, the randomizing element generation unit  145  generates a second randomizing element k* L,ran,2,τ  which is an element of the decryption key sk L , for each integer τ=L+1, . . . , d, as indicated in Formula 174.
 
 k*   L,ran,2,τ :=((− s   ran,2,τ,0 ,0 u     0   ,0,{right arrow over (η)} ran,2,τ,0 ,0 z     0   )   *     0   ,
 
(μ ran,2,τ,t ( t,− 1), s   ran,2,τ,t   {right arrow over (e)}   1 +θ ran,2,τ,t   {right arrow over (v)}   t ,0 u ,
 
{right arrow over (η)} ran,2,τ,t ,0 z )   *   :t= 1 , . . . ,L,  
 
(μ ran,2,τ,L+1 (τ,−1), s   ran,2,τ,L+1   {right arrow over (e)}   1 ,0 u ,{right arrow over (η)} ran,2,τ,L+1 ,0 z )   * )  [Formula 174]
 
     (S 906 : Delegation Element Generation Step) 
     Using the processing device, the delegation element generation unit  146  generates a delegation element k* L,del,(τ,ι)  which is an element of the decryption key sk L , for each integer τ=L+1, . . . , d, and each integer ι=1, 2 with respect to each integer τ, as indicated in Formula 175.
 
 k*   L,del,(τ,ι) :=((− s   del,(τ,ι),0 ,0 u     0   ,0,{right arrow over (η)} del,(τ,ι),0 ,0 z     0   )   *     0   ,
 
(μ del,(τ,ι),t ( t,− 1), s   del,(τ,ι),t   {right arrow over (e)}   1 +θ del,(τ,ι),t   {right arrow over (v)}   t ,0 u ,
 
{right arrow over (η)} del,(τ,ι),t ,0 z )   *   :t= 1 , . . . ,L,  
 
(μ del,(τ,ι),L+1 (τ,−1), s   del,(τ,ι),L+1   {right arrow over (e)}   1   +ψ{right arrow over (e)}   t ,0 u ,
 
{right arrow over (η)} del,(τ,2),L+1 ,0 z )   * )  [Formula 175]
 
     (S 907 : Key Distribution Step) 
     Using the communication device and via the network, for example, the key distribution unit  150  distributes the decryption key sk L  having, as elements, the key element k* L,dec , the first randomizing element k* L,ran,1,j , the second randomizing element k* L,ran,2,τ , and the delegation element k* L,del,(τ,ι)  to the decryption device  300  in secrecy. As a matter of course, the decryption key sk L  may be distributed to the decryption device  300  by another method. 
     In brief, in (S 901 ) through (S 906 ), the key generation device  100  executes the KeyGen algorithm indicated in Formula 176 and Formula 177, and thus generates the decryption key sk L . In (S 907 ), the key generation device  100  distributes the generated decryption key sk L  to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         KeyGen 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             sk 
                             , 
                             
                               
                                 ( 
                                 
                                   
                                     
                                       
                                         v 
                                         → 
                                       
                                       
                                         1 
                                         , 
                                       
                                     
                                     ⁢ 
                                     ⋯ 
                                   
                                   , 
                                   
                                     
                                       v 
                                       → 
                                     
                                     L 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               
                                 
                                   
                                     ?? 
                                     q 
                                     n 
                                   
                                   ⨯ 
                                   ⋯ 
                                 
                                 × 
                                 
                                   ?? 
                                   q 
                                   n 
                                 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           j 
                         
                         = 
                         1 
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           L 
                         
                         ; 
                         
                           τ 
                           = 
                           
                             L 
                             + 
                             1 
                           
                         
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         d 
                         ; 
                         
                           t 
                           = 
                           1 
                         
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         n 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ψ 
                       , 
                       
                         μ 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         θ 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           
                             
                               θ 
                               
                                 ran 
                                 , 
                                 1 
                                 , 
                                 j 
                                 , 
                                 t 
                               
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         μ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           t 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         θ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           
                             
                               θ 
                               
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                                 , 
                                 t 
                               
                             
                             ⁢ 
                             
                               ⟵ 
                               U 
                             
                             ⁢ 
                             
                               ?? 
                               q 
                             
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         L 
                         + 
                         1 
                       
                       , 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     176 
                   
                   ] 
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         s 
                         
                           dec 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           ∑ 
                           
                             t 
                             = 
                             1 
                           
                           L 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           
                             dec 
                             , 
                             t 
                           
                         
                       
                     
                     , 
                     
                       
                         s 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           ∑ 
                           
                             t 
                             = 
                             1 
                           
                           
                             L 
                             + 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           
                             del 
                             , 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 ι 
                               
                               ) 
                             
                             , 
                             t 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         s 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           ∑ 
                           
                             t 
                             = 
                             1 
                           
                           L 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           
                             ran 
                             , 
                             1 
                             , 
                             j 
                             , 
                             t 
                           
                         
                       
                     
                     , 
                     
                       
                         s 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                       := 
                       
                         
                           ∑ 
                           
                             t 
                             = 
                             1 
                           
                           
                             L 
                             + 
                             1 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                             , 
                             ι 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         η 
                         → 
                       
                       
                         dec 
                         , 
                         0 
                       
                     
                     , 
                     
                       
                         η 
                         → 
                       
                       
                         ran 
                         , 
                         1 
                         , 
                         j 
                         , 
                         0 
                       
                     
                     , 
                     
                       
                         η 
                         → 
                       
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         0 
                       
                     
                     , 
                     
                       
                         
                           η 
                           → 
                         
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           0 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         η 
                         → 
                       
                       
                         dec 
                         , 
                         t 
                       
                     
                     , 
                     
                       
                         
                           
                             
                               η 
                               → 
                             
                             
                               ran 
                               , 
                               1 
                               , 
                               j 
                               , 
                               t 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             w 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         η 
                         → 
                       
                       
                         del 
                         , 
                         
                           ( 
                           
                             τ 
                             , 
                             ι 
                           
                           ) 
                         
                         , 
                         t 
                       
                     
                     , 
                     
                       
                         
                           
                             
                               η 
                               → 
                             
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                               , 
                               t 
                             
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                             w 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       L 
                       + 
                       1 
                     
                     , 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         
                           k 
                           
                             L 
                             , 
                             dec 
                           
                           * 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         - 
                                         
                                           s 
                                           
                                             dec 
                                             , 
                                             0 
                                           
                                         
                                       
                                       , 
                                       
                                         0 
                                         
                                           u 
                                           0 
                                         
                                       
                                       , 
                                       1 
                                       , 
                                       
                                         
                                           η 
                                           → 
                                         
                                         
                                           dec 
                                           , 
                                           0 
                                         
                                       
                                       , 
                                       
                                         0 
                                         
                                           z 
                                           0 
                                         
                                       
                                     
                                     ) 
                                   
                                   
                                     ?? 
                                     0 
                                     * 
                                   
                                 
                                 , 
                                 
                                   
                                     
                                       ( 
                                       
                                         
                                           
                                             μ 
                                             
                                               dec 
                                               , 
                                               t 
                                             
                                           
                                           ⁡ 
                                           
                                             ( 
                                             
                                               t 
                                               , 
                                               
                                                 - 
                                                 1 
                                               
                                             
                                             ) 
                                           
                                         
                                         , 
                                         
                                           
                                             
                                               s 
                                               
                                                 dec 
                                                 , 
                                                 t 
                                               
                                             
                                             ⁢ 
                                             
                                               
                                                 e 
                                                 → 
                                               
                                               1 
                                             
                                           
                                           + 
                                           
                                             
                                               θ 
                                               
                                                 dec 
                                                 , 
                                                 t 
                                               
                                             
                                             ⁢ 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               t 
                                             
                                           
                                         
                                         , 
                                         
                                           0 
                                           u 
                                         
                                         , 
                                         
                                           
                                             η 
                                             → 
                                           
                                           
                                             dec 
                                             , 
                                             t 
                                           
                                         
                                         , 
                                         
                                           0 
                                           z 
                                         
                                       
                                       ) 
                                     
                                     
                                       B 
                                       * 
                                     
                                   
                                   ⁢ 
                                   
                                     : 
                                   
                                 
                               
                               ⁢ 
                               
                                   
                               
                                 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             t 
                           
                           = 
                           1 
                         
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                     
                     ) 
                   
                   , 
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     177 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     k 
                     
                       L 
                       , 
                       del 
                       , 
                       
                         ( 
                         
                           τ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     * 
                   
                   := 
                   
                     ( 
                     
                       
                         
                           ( 
                           
                             
                               - 
                               
                                 s 
                                 
                                   del 
                                   , 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                   , 
                                   0 
                                 
                               
                             
                             , 
                             
                               0 
                               
                                 u 
                                 0 
                               
                             
                             , 
                             0 
                             , 
                             
                               
                                 η 
                                 → 
                               
                               
                                 del 
                                 , 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                                 , 
                                 0 
                               
                             
                             , 
                             
                               0 
                               
                                 z 
                                 0 
                               
                             
                           
                           ) 
                         
                         
                           ?? 
                           0 
                           * 
                         
                       
                       , 
                       
                         ( 
                         
                           
                             
                               μ 
                               
                                 del 
                                 , 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                                 , 
                                 t 
                               
                             
                             ⁡ 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   - 
                                   1 
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               
                                 s 
                                 
                                   del 
                                   , 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                   , 
                                   t 
                                 
                               
                               ⁢ 
                               
                                 
                                   e 
                                   → 
                                 
                                 1 
                               
                             
                             + 
                             
                               
                                 θ 
                                 
                                   del 
                                   , 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                   , 
                                   t 
                                 
                               
                               ⁢ 
                               
                                 
                                   v 
                                   → 
                                 
                                 t 
                               
                             
                           
                           , 
                           
                             0 
                             u 
                           
                           , 
                           
                             
                               
                                 
                                     
                                   
                                     
                                       
                                         η 
                                         → 
                                       
                                       
                                         del 
                                         , 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                         , 
                                         t 
                                       
                                     
                                     , 
                                     
                                       0 
                                       z 
                                     
                                   
                                   ) 
                                 
                                 
                                   B 
                                   * 
                                 
                               
                               : 
                               t 
                             
                             = 
                             1 
                           
                           , 
                           ⋯ 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                           , 
                           
                             
 
                           
                           ⁢ 
                           
                             
                               
                                 ( 
                                 
                                   
                                     
                                       μ 
                                       
                                         del 
                                         , 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                         , 
                                         
                                           L 
                                           + 
                                           1 
                                         
                                       
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       
                                         s 
                                         
                                           del 
                                           , 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               1 
                                             
                                             ) 
                                           
                                           , 
                                           
                                             L 
                                             + 
                                             1 
                                           
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         1 
                                       
                                     
                                     + 
                                     
                                       ψ 
                                       ⁢ 
                                       
                                         
                                           e 
                                           → 
                                         
                                         ι 
                                       
                                     
                                   
                                   , 
                                   
                                     0 
                                     u 
                                   
                                   , 
                                   
                                     
                                       η 
                                       → 
                                     
                                     
                                       del 
                                       , 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           2 
                                         
                                         ) 
                                       
                                       , 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                   
                                   , 
                                   
                                     
                                         
                                       
                                         0 
                                         z 
                                       
                                       ) 
                                     
                                     
                                       ?? 
                                       * 
                                     
                                   
                                 
                                 ) 
                               
                               ⁢ 
                               
                                 
 
                               
                               ⁢ 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   ran 
                                   , 
                                   1 
                                   , 
                                   j 
                                 
                                 * 
                               
                             
                             := 
                             
                               ( 
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         - 
                                         
                                           s 
                                           
                                             ran 
                                             , 
                                             1 
                                             , 
                                             j 
                                             , 
                                             0 
                                           
                                         
                                       
                                       , 
                                       
                                         0 
                                         
                                           u 
                                           0 
                                         
                                       
                                       , 
                                       0 
                                       , 
                                       
                                         
                                           η 
                                           → 
                                         
                                         
                                           ran 
                                           , 
                                           1 
                                           , 
                                           j 
                                           , 
                                           0 
                                         
                                       
                                       , 
                                       
                                         0 
                                         
                                           z 
                                           0 
                                         
                                       
                                     
                                     ) 
                                   
                                   
                                     ?? 
                                     0 
                                     * 
                                   
                                 
                                 , 
                                 
                                   ( 
                                   
                                     
                                       
                                         μ 
                                         
                                           ran 
                                           , 
                                           1 
                                           , 
                                           j 
                                           , 
                                           t 
                                         
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             - 
                                             1 
                                           
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       
                                         
                                           s 
                                           
                                             ran 
                                             , 
                                             1 
                                             , 
                                             j 
                                             , 
                                             t 
                                           
                                         
                                         ⁢ 
                                         
                                           
                                             e 
                                             → 
                                           
                                           1 
                                         
                                       
                                       + 
                                       
                                         
                                           θ 
                                           
                                             ran 
                                             , 
                                             1 
                                             , 
                                             j 
                                             , 
                                             t 
                                           
                                         
                                         ⁢ 
                                         
                                           
                                             v 
                                             → 
                                           
                                           t 
                                         
                                       
                                     
                                     , 
                                     
                                       0 
                                       u 
                                     
                                     , 
                                     
                                       
                                         η 
                                         → 
                                       
                                       
                                         ran 
                                         , 
                                         1 
                                         , 
                                         j 
                                         , 
                                         t 
                                       
                                     
                                     , 
                                     
                                       
                                         
                                           
                                               
                                             
                                               0 
                                               z 
                                             
                                             ) 
                                           
                                           
                                             ?? 
                                             * 
                                           
                                         
                                         : 
                                         t 
                                       
                                       = 
                                       1 
                                     
                                     , 
                                     ⋯ 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     L 
                                   
                                   ) 
                                 
                                 , 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     k 
                     
                       L 
                       , 
                       ran 
                       , 
                       2 
                       , 
                       τ 
                     
                     * 
                   
                   := 
                   
                     ( 
                     
                       
                         
                           ( 
                           
                             
                               - 
                               
                                 s 
                                 
                                   ran 
                                   , 
                                   2 
                                   , 
                                   τ 
                                   , 
                                   0 
                                 
                               
                             
                             , 
                             
                               0 
                               
                                 u 
                                 0 
                               
                             
                             , 
                             0 
                             , 
                             
                               
                                 η 
                                 → 
                               
                               
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                                 , 
                                 0 
                               
                             
                             , 
                             
                               0 
                               
                                 z 
                                 0 
                               
                             
                           
                           ) 
                         
                         
                           ?? 
                           0 
                           * 
                         
                       
                       , 
                       
                         ( 
                         
                           
                             
                               μ 
                               
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                                 , 
                                 t 
                               
                             
                             ⁡ 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   - 
                                   1 
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               
                                 s 
                                 
                                   ran 
                                   , 
                                   2 
                                   , 
                                   τ 
                                   , 
                                   ι 
                                 
                               
                               ⁢ 
                               
                                 
                                   e 
                                   → 
                                 
                                 1 
                               
                             
                             + 
                             
                               
                                 θ 
                                 
                                   ran 
                                   , 
                                   2 
                                   , 
                                   τ 
                                   , 
                                   ι 
                                 
                               
                               ⁢ 
                               
                                 
                                   v 
                                   → 
                                 
                                 t 
                               
                             
                           
                           , 
                           
                             0 
                             u 
                           
                           , 
                           
                             
                               η 
                               → 
                             
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                               , 
                               ι 
                             
                           
                           , 
                           
                             
                               
                                 
                                     
                                   
                                     0 
                                     z 
                                   
                                   ) 
                                 
                                 
                                   ?? 
                                   * 
                                 
                               
                               : 
                               t 
                             
                             = 
                             1 
                           
                           , 
                           ⋯ 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                           , 
                           
                             
                               ( 
                               
                                 
                                   
                                     μ 
                                     
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                       , 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                       , 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ⁢ 
                                   
                                     
                                       e 
                                       → 
                                     
                                     1 
                                   
                                 
                                 , 
                                 
                                   0 
                                   u 
                                 
                                 , 
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                     , 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 
                                   0 
                                   z 
                                 
                               
                               ) 
                             
                             
                               B 
                               * 
                             
                           
                         
                         ) 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           sk 
                           L 
                         
                         := 
                         
                           
                             k 
                             
                               L 
                               , 
                               dec 
                               , 
                             
                             * 
                           
                           ⁢ 
                           
                             
                               { 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   del 
                                   , 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 * 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               , 
                               
                                   
                               
                               ⁢ 
                               ⋯ 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 d 
                                 ; 
                                 
                                   ι 
                                   = 
                                   1 
                                 
                               
                               , 
                               2 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           { 
                           
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 1 
                                 , 
                                 j 
                               
                               * 
                             
                             , 
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 2 
                                 , 
                                 ι 
                               
                               * 
                             
                           
                           } 
                         
                         
                           
                             
                               j 
                               = 
                               1 
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               
                                 2 
                                 ⁢ 
                                 L 
                               
                               ; 
                               
                                 τ 
                                 = 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             
                                 
                             
                             ⁢ 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             d 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             sk 
                             L 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     The function and operation of the encryption device  200  will be described. 
     The encryption device  200  includes a public parameter acquisition unit  210 , an information input unit  220 , a cipher data generation unit  230 , and a data transmission unit  240 . The cipher data generation unit  230  includes a random number generation unit  231  and a cipher element generation unit  232 . 
     With reference to  FIG. 27 , the process of the Enc algorithm to be executed by the encryption device  200  will be described. 
     (S 1001 : Master Public Key Acquisition Step) 
     Using the communication device and via the network, for example, the public parameter acquisition unit  210  obtains the master public key pk generated by the key generation device  100 . 
     (S 1002 : Information Input Step) 
     Using the input device, the information input unit  220  takes as input attribute information (x{right arrow over ( )} 1 , . . . , x{right arrow over ( )} L ), where x{right arrow over ( )} i :=x i,1 , . . . , x i,L  for each integer i=1, . . . , L. Note that the attribute of a person capable of decrypting an encrypted message is input as the attribute information. 
     Using the input device, the information input unit  220  also takes as input a message m to be encrypted. 
     (S 1003 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  231  generates random numbers, as indicated in Formula 178. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     ω 
                     , 
                     
                       ζ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       := 
                       
                         φ 
                         
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           0 
                           , 
                           
                             z 
                             0 
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         
                           z 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       := 
                       
                         φ 
                         
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           t 
                           , 
                           z 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         ?? 
                         q 
                         z 
                       
                     
                     , 
                     
                       
                         
                           
                             σ 
                             t 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           
                             ?? 
                             q 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         t 
                       
                       = 
                       1 
                     
                     , 
                     ⋯ 
                     ⁢ 
                     
                         
                     
                     , 
                     L 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     178 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1004 : Cipher Element c1 Generation Step) 
     Using the processing device, the cipher element generation unit  232  generates a cipher element c 1  which is an element of a ciphertext ct, as indicated in Formula 179.
 
 c   1 :=((ω,0 u     0   ,ζ,0 w     0   ,{right arrow over (φ)} 0 )     0   ,(σ t (1 ,t ),ω {right arrow over (x)}   t ,0 u ,0 w ,{right arrow over (φ)} t )   :t= 1 , . . . ,L )  [Formula 179]
 
     (S 1005 : Cipher Element c2 Generation Step) 
     Using the processing device, the cipher element generation unit  232  generates a cipher element c 2  which is an element of the ciphertext ct, as indicated in Formula 180.
 
 c   2   :=g   T   ζ   m−   [Formula 180]
 
     (S 1006 : Data Transmission Step) 
     Using the communication device and via the network, for example, the data transmission unit  240  transmits the ciphertext ct including the cipher element c 1  and the cipher element c 2  to the decryption device  300 . As a matter of course, the ciphertext ct may be transmitted to the decryption device  300  by another method. 
     In brief, in (S 1001 ) through (S 1005 ), the encryption device  200  executes the Enc algorithm indicated in Formula 181, and thus generates the ciphertext ct. In (S 1006 ), the encryption device  200  transmits the generated ciphertext ct to the decryption device  300 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Enc 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               m 
                               ∈ 
                               
                                 ?? 
                                 T 
                               
                             
                             , 
                             
                               
                                 ( 
                                 
                                   
                                     
                                       x 
                                       → 
                                     
                                     1 
                                   
                                   , 
                                   ⋯ 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     
                                       x 
                                       → 
                                     
                                     L 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               
                                 
                                   ?? 
                                   q 
                                   n 
                                 
                                 × 
                                 ⋯ 
                                 × 
                                 
                                   ?? 
                                   q 
                                   n 
                                 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ω 
                       , 
                       
                         ζ 
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
                           
                             φ 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           
                             z 
                             0 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           t 
                         
                         = 
                         1 
                       
                       , 
                       ⋯ 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             φ 
                             → 
                           
                           t 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                           z 
                         
                       
                       , 
                       
                         
                           σ 
                           t 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           ?? 
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           1 
                         
                         := 
                         
                           ( 
                           
                             
                               
                                 ( 
                                 
                                   ω 
                                   , 
                                   
                                     0 
                                     
                                       u 
                                       0 
                                     
                                   
                                   , 
                                   ζ 
                                   , 
                                   
                                     0 
                                     
                                       w 
                                       0 
                                     
                                   
                                   , 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     0 
                                   
                                 
                                 ) 
                               
                               
                                 ?? 
                                 0 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         
                                           σ 
                                           t 
                                         
                                         ⁡ 
                                         
                                           ( 
                                           
                                             1 
                                             , 
                                             t 
                                           
                                           ) 
                                         
                                       
                                       , 
                                       
                                         ω 
                                         ⁢ 
                                         
                                             
                                         
                                         ⁢ 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                       , 
                                       
                                         0 
                                         u 
                                       
                                       , 
                                       
                                         0 
                                         w 
                                       
                                       , 
                                       
                                         
                                           φ 
                                           → 
                                         
                                         t 
                                       
                                     
                                     ) 
                                   
                                   ?? 
                                 
                                 ⁢ 
                                 
                                   : 
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 t 
                               
                               = 
                               1 
                             
                             , 
                             ⋯ 
                             ⁢ 
                             
                                 
                             
                             , 
                             L 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           c 
                           2 
                         
                         := 
                         
                           
                             g 
                             T 
                             ζ 
                           
                           ⁢ 
                           m 
                         
                       
                       , 
                       
                         ct 
                         := 
                         
                           ( 
                           
                             
                               c 
                               1 
                             
                             , 
                             
                               c 
                               2 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     181 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the decryption device  300  will be described. 
     The decryption device  300  includes a decryption key acquisition unit  310 , a data receiving unit  320 , a pairing operation unit  350 , and a message computation unit  360 . 
     With reference to  FIG. 28 , the process of the Dec algorithm to be executed by the decryption device  300  will be described. 
     (S 1101 : Decryption Key Acquisition Step) 
     Using the communication device and via the network, for example, the decryption key acquisition unit  310  obtains the decryption key sk L . The decryption key acquisition unit  310  also obtains the public parameter pk generated by the key generation device  100 . 
     (S 1102 : Data Reception Step) 
     Using the communication device and via the network, for example, the data receiving unit  320  receives the ciphertext ct transmitted by the encryption device  200 . 
     (S 1103 : Pairing Operation Step) 
     Using the processing device, the pairing operation unit  350  performs a pairing operation indicated in Formula 182, and thus computes a session key K=g T   ζ .
 
 e ( c   1   ,k*   L,dec )  [Formula 182]
 
     (S 1104 : Message Computation Step) 
     Using the processing device, the message computation unit  360  computes a message m′ (=m) by dividing the cipher element c2 by the session key K. 
     In brief, in (S 1101 ) through (S 1104 ), the decryption device  300  executes the Dec algorithm indicated in Formula 183, and thus computes the message m′ (=m).
 
 Dec ( pk,k*   L,dec   ,ct ):
 
 m′:=c   2   /e ( c   1   ,k*   L,dec ),
 
return  m′.   [Formula 183]
 
     The function and operation of the key delegation device  400  will be described. 
     The key delegation device  400  includes a decryption key acquisition unit  410 , an information input unit  420 , a delegation key generation unit  430 , and a key distribution unit  440 . The delegation key generation unit  430  includes a random number generation unit  431 , a lower-level key element generation unit  432 , a lower-level randomizing element generation unit  433 , and a lower-level delegation element generation unit  434 . 
     With reference to  FIG. 29 , the process of the Delegate L  algorithm to be executed by the key delegation device  400  will be described. 
     (S 1201 : Decryption Key Acquisition Step) 
     Using the communication device and via the network, for example, the decryption key acquisition unit  410  obtains the decryption key sk L . The decryption key acquisition unit  410  also obtains the public parameter pk generated by the key generation device  100 . 
     (S 1202 : Information Input Step) 
     Using the input device, the information input unit  420  takes as input predicate information v{right arrow over ( )} L+1 :=(v L+1,i  (i=1, . . . , n L+1 )). Note that the attribute of a person to whom the key is to be delegated is input as the predicate information. 
     (S 1203 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  431  generates random numbers, as indicated in Formula 184. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           j 
                           ′ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           
                             ( 
                             
                               L 
                               + 
                               1 
                             
                             ) 
                           
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         τ 
                         = 
                         
                           L 
                           + 
                           2 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         d 
                         ; 
                         
                           ι 
                           = 
                           1 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         n 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         ′ 
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         ′ 
                       
                       , 
                       
                         ϕ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         ϕ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                       
                       , 
                       
                         
                           ψ 
                           ′ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         p 
                         dec 
                         * 
                       
                       , 
                       
                         p 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         * 
                       
                       , 
                       
                         p 
                         
                           ran 
                           , 
                           1 
                           , 
                           
                             j 
                             ′ 
                           
                         
                         * 
                       
                       , 
                       
                         
                           p 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                           
                           * 
                         
                         ⁢ 
                         
                           ⟵ 
                           R 
                         
                         ⁢ 
                         
                           
                             CoreDel 
                             L 
                           
                           ⁡ 
                           
                             ( 
                             
                               pk 
                               , 
                               
                                 sk 
                                 L 
                               
                               , 
                               
                                 v 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       where 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           CoreDel 
                           L 
                         
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         t 
                         ′ 
                       
                       , 
                       ξ 
                       , 
                       
                         
                           α 
                           j 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           L 
                           + 
                           1 
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         j 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           L 
                         
                         + 
                         1 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       return 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           p 
                           * 
                         
                         := 
                         
                           
                             
                               ∑ 
                               
                                 t 
                                 = 
                                 1 
                               
                               
                                 L 
                                 + 
                                 1 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   μ 
                                   t 
                                   ′ 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       tb 
                                       1 
                                       * 
                                     
                                     - 
                                     
                                       b 
                                       2 
                                       * 
                                     
                                   
                                   ) 
                                 
                               
                               
                                 〈 
                                 t 
                                 〉 
                               
                             
                           
                           + 
                           
                             ξ 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     n 
                                   
                                   ⁢ 
                                   
                                     v 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 
                                   k 
                                   L 
                                   * 
                                 
                                 , 
                                 
                                   del 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         L 
                                         + 
                                         1 
                                       
                                       , 
                                       i 
                                     
                                     ) 
                                   
                                 
                               
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 1 
                               
                               
                                 2 
                                 ⁢ 
                                 L 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 j 
                               
                               ⁢ 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   ran 
                                   , 
                                   1 
                                   , 
                                   j 
                                 
                                 * 
                               
                             
                           
                           + 
                           
                             
                               α 
                               
                                 
                                   2 
                                   ⁢ 
                                   L 
                                 
                                 + 
                                 1 
                               
                             
                             ⁢ 
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 2 
                                 , 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               * 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         r 
                         dec 
                         * 
                       
                       , 
                       
                         
                           
                             r 
                             
                               ran 
                               , 
                               1 
                               , 
                               
                                 j 
                                 ′ 
                               
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           span 
                         
                         ⁢ 
                         
                           〈 
                           
                             
                               
                                 ( 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         1 
                                       
                                     
                                     * 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         
                                           w 
                                           0 
                                         
                                       
                                     
                                     * 
                                   
                                 
                                 ) 
                               
                               
                                 〈 
                                 0 
                                 〉 
                               
                             
                             , 
                             
                               
                                 
                                   { 
                                   
                                     
                                       ( 
                                       
                                         
                                           b 
                                           
                                             2 
                                             + 
                                             n 
                                             + 
                                             u 
                                             + 
                                             1 
                                           
                                           * 
                                         
                                         , 
                                         … 
                                         ⁢ 
                                         
                                             
                                         
                                         , 
                                         
                                           b 
                                           
                                             2 
                                             + 
                                             n 
                                             + 
                                             u 
                                             + 
                                             w 
                                           
                                           * 
                                         
                                       
                                       ) 
                                     
                                     
                                       〈 
                                       t 
                                       〉 
                                     
                                   
                                   } 
                                 
                                 ⁢ 
                                 t 
                               
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               L 
                               + 
                               1 
                             
                           
                           〉 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         r 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         * 
                       
                       , 
                       
                         
                           
                             r 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           span 
                         
                         ⁢ 
                         
                           〈 
                           
                             
                               ( 
                               
                                 
                                   b 
                                   
                                     0 
                                     , 
                                     
                                       1 
                                       + 
                                       
                                         u 
                                         0 
                                       
                                       + 
                                       1 
                                       + 
                                       1 
                                     
                                   
                                   * 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         
                                           w 
                                           0 
                                         
                                       
                                     
                                     * 
                                   
                                   
                                     〈 
                                     0 
                                     〉 
                                   
                                 
                                 , 
                                 
                                   
                                     
                                       { 
                                       
                                         
                                           ( 
                                           
                                             
                                               b 
                                               
                                                 2 
                                                 + 
                                                 n 
                                                 + 
                                                 u 
                                                 + 
                                                 1 
                                               
                                               * 
                                             
                                             , 
                                             … 
                                             ⁢ 
                                             
                                                 
                                             
                                             , 
                                             
                                               b 
                                               
                                                 2 
                                                 + 
                                                 n 
                                                 + 
                                                 u 
                                                 + 
                                                 w 
                                               
                                               * 
                                             
                                           
                                           ) 
                                         
                                         
                                           〈 
                                           t 
                                           〉 
                                         
                                       
                                       } 
                                     
                                     ⁢ 
                                     t 
                                   
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               〉 
                             
                             , 
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     184 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1204 : Lower-Level Key Element Generation Step) 
     Using the processing device, the lower-level key element generation unit  432  generates a lower-level key element k* L+1,dec  which is an element of a delegation key sk L+1 , as indicated in Formula 185.
 
 k*   L+1,dec   :=k*   L,dec   +p*   dec   +r*   dec   [Formula 185]
 
     (S 1205 : First Lower-Level Randomizing Element Generation Step) 
     Using the processing device, the lower-level randomizing element generation unit  433  generates a first lower-level randomizing element k* L+1,ran,1,j′  which is an element of the delegation key sk L+1 , for each integer j′=1, . . . , 2(L+1), as indicated in Formula 186.
 
 k*   L+1,ran,1,j′   :=p*   ran,1,j′   +r*   ran,1,j′   [Formula 186]
 
     (S 1206 : Second Lower-Level Randomizing Element Generation Step) 
     Using the processing device, the lower-level randomizing element generation unit  433  generates a second lower-level randomizing element k* L+1,ran,2,τ  which is an element of the delegation key sk L+1 , for each integer τ=L+2, . . . , d, as indicated in Formula 187.
 
 k*   L+1,ran,2,τ   :=p*   ran,2,τ +μ′ ran,2,τ (τ b*   1   −b*   2 ) (τ)  
 
+φ ran,2,τ   k*   L,ran,2,τ   +r*   ran,2,τ   [Formula 187]
 
     (S 1207 : Lower-Level Delegation Element Generation Step) 
     Using the processing device, the lower-level delegation element generation unit  434  generates a lower-level delegation element k* L+1,del,(τ,ι)  which is an element of the delegation key sk L+1 , for each integer τ=L+2, . . . , d and each integer ι=1, . . . , n with respect to each integer z, as indicated in Formula 188.
 
 k*   L+1,del(τ,ι)   :=p*   del(τ,ι) +μ′ del(τ,ι) (τ b*   1   −b*   2 ) (τ)  
 
+φ del,(τ,ι)   k*   L,ran,2,τ +ψ′k* L,del(τ,ι)   +r*   del(τ,ι)   [Formula 188]
 
     (S 1208 : Key Distribution Step) 
     Using the communication device and via the network, for example, the key distribution unit  150  distributes the delegation key sk L+1  (lower-level decryption key) having, as elements, the lower-level key element k* L+1,dec , the first lower-level randomizing element k* L+1,ran,1,j′ , the second lower-level randomizing element k* L+1,ran,2,τ , and the lower-level delegation element k* L+1,del,(τ,ι)  to the lower-level decryption device  300  in secrecy. As a matter of course, the delegation key sk L+1  may be distributed to the lower-level decryption device  300  by another method. 
     In brief, in (S 1201 ) through (S 1207 ), the key delegation device  400  executes the Delegate L  algorithm indicated in Formula 189, and thus generates the delegation key sk L+1 . In (S 1208 ), the key delegation device  400  distributes the generated delegation key sk L+1  to the lower-level decryption device  300 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           Delegate 
                           L 
                         
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               
                                 v 
                                 → 
                               
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           j 
                           ′ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           
                             ( 
                             
                               L 
                               + 
                               1 
                             
                             ) 
                           
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         τ 
                         = 
                         
                           L 
                           + 
                           2 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         d 
                         ; 
                         
                           ι 
                           = 
                           1 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         n 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         ′ 
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         ′ 
                       
                       , 
                       
                         ϕ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         ϕ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                       
                       , 
                       
                         
                           ψ 
                           ′ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         p 
                         dec 
                         * 
                       
                       , 
                       
                         p 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         * 
                       
                       , 
                       
                         p 
                         
                           ran 
                           , 
                           1 
                           , 
                           
                             j 
                             ′ 
                           
                         
                         * 
                       
                       , 
                       
                         
                           
                             p 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             R 
                           
                           ⁢ 
                           
                             CoreDel 
                             L 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       where 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           CoreDel 
                           L 
                         
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         t 
                         ′ 
                       
                       , 
                       ξ 
                       , 
                       
                         
                           α 
                           j 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           L 
                           + 
                           1 
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         j 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           L 
                         
                         + 
                         1 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       return 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           p 
                           * 
                         
                         := 
                         
                           
                             
                               ∑ 
                               
                                 t 
                                 = 
                                 1 
                               
                               
                                 L 
                                 + 
                                 1 
                               
                             
                             ⁢ 
                             
                               
                                 μ 
                                 t 
                                 ′ 
                               
                               ⁢ 
                               
                                 
                                   ( 
                                   
                                     
                                       tb 
                                       1 
                                       * 
                                     
                                     - 
                                     
                                       b 
                                       2 
                                       * 
                                     
                                   
                                   ) 
                                 
                                 
                                   〈 
                                   t 
                                   〉 
                                 
                               
                             
                           
                           + 
                           
                             ξ 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   
                                     ∑ 
                                     
                                       i 
                                       = 
                                       1 
                                     
                                     n 
                                   
                                   ⁢ 
                                   
                                     v 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     
                                       del 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             L 
                                             + 
                                             1 
                                           
                                           , 
                                           i 
                                         
                                         ) 
                                       
                                     
                                   
                                   * 
                                 
                               
                               ) 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 1 
                               
                               
                                 2 
                                 ⁢ 
                                 L 
                               
                             
                             ⁢ 
                             
                               
                                 α 
                                 j 
                               
                               ⁢ 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   ran 
                                   , 
                                   1 
                                   , 
                                   j 
                                 
                                 * 
                               
                             
                           
                           + 
                           
                             
                               α 
                               
                                 
                                   2 
                                   ⁢ 
                                   L 
                                 
                                 + 
                                 1 
                               
                             
                             ⁢ 
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 2 
                                 , 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               * 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         r 
                         dec 
                         * 
                       
                       , 
                       
                         
                           
                             r 
                             
                               ran 
                               , 
                               1 
                               , 
                               
                                 j 
                                 ′ 
                               
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           span 
                         
                         ⁢ 
                         
                           〈 
                           
                             
                               
                                 ( 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         1 
                                       
                                     
                                     * 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         
                                           w 
                                           0 
                                         
                                       
                                     
                                     * 
                                   
                                 
                                 ) 
                               
                               
                                 〈 
                                 0 
                                 〉 
                               
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       
                                         b 
                                         
                                           2 
                                           + 
                                           n 
                                           + 
                                           u 
                                           + 
                                           1 
                                         
                                         * 
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         b 
                                         
                                           2 
                                           + 
                                           n 
                                           + 
                                           u 
                                           + 
                                           w 
                                         
                                         * 
                                       
                                     
                                     ) 
                                   
                                   
                                     〈 
                                     t 
                                     〉 
                                   
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                             
                           
                           〉 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         r 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         * 
                       
                       , 
                       
                         
                           
                             r 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             U 
                           
                           ⁢ 
                           span 
                         
                         ⁢ 
                         
                           〈 
                           
                             
                               
                                 ( 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         1 
                                       
                                     
                                     * 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       
                                         1 
                                         + 
                                         
                                           u 
                                           0 
                                         
                                         + 
                                         1 
                                         + 
                                         
                                           w 
                                           0 
                                         
                                       
                                     
                                     * 
                                   
                                 
                                 ) 
                               
                               
                                 〈 
                                 0 
                                 〉 
                               
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     ( 
                                     
                                       
                                         b 
                                         
                                           2 
                                           + 
                                           n 
                                           + 
                                           u 
                                           + 
                                           1 
                                         
                                         * 
                                       
                                       , 
                                       … 
                                       ⁢ 
                                       
                                           
                                       
                                       , 
                                       
                                         b 
                                         
                                           2 
                                           + 
                                           n 
                                           + 
                                           u 
                                           + 
                                           w 
                                         
                                         * 
                                       
                                     
                                     ) 
                                   
                                   
                                     〈 
                                     t 
                                     〉 
                                   
                                 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   L 
                                   + 
                                   1 
                                 
                                 , 
                                 τ 
                               
                             
                           
                           〉 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           
                             
                               L 
                               + 
                               1 
                             
                             , 
                             dec 
                           
                           * 
                         
                         := 
                         
                           
                             k 
                             
                               L 
                               , 
                               dec 
                             
                             * 
                           
                           + 
                           
                             p 
                             dec 
                             * 
                           
                           + 
                           
                             r 
                             dec 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           k 
                           
                             
                               L 
                               + 
                               1 
                             
                             , 
                             
                               dec 
                               ⁡ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           * 
                         
                         := 
                         
                           
                             p 
                             
                               del 
                               ⁡ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             * 
                           
                           + 
                           
                             
                               
                                 μ 
                                 
                                   del 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                                 * 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     τ 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       b 
                                       1 
                                       * 
                                     
                                   
                                   - 
                                   
                                     b 
                                     2 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             
                               ( 
                               τ 
                               ) 
                             
                           
                           + 
                           
                             
                               ϕ 
                               
                                 del 
                                 , 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             ⁢ 
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                               
                               * 
                             
                           
                           + 
                           
                             
                               ψ 
                               ′ 
                             
                             ⁢ 
                             
                               k 
                               
                                 L 
                                 , 
                                 
                                   del 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       ι 
                                     
                                     ) 
                                   
                                 
                               
                               * 
                             
                           
                           + 
                           
                             r 
                             
                               del 
                               ⁡ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           k 
                           
                             
                               L 
                               + 
                               1 
                             
                             , 
                             ran 
                             , 
                             
                               1 
                               ⁢ 
                               
                                 j 
                                 ′ 
                               
                             
                           
                           * 
                         
                         := 
                         
                           
                             p 
                             
                               ran 
                               , 
                               1 
                               , 
                               
                                 j 
                                 ′ 
                               
                             
                             * 
                           
                           + 
                           
                             r 
                             
                               ran 
                               , 
                               1 
                               , 
                               
                                 j 
                                 ′ 
                               
                             
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           k 
                           
                             
                               L 
                               + 
                               1 
                             
                             , 
                             ran 
                             , 
                             2 
                             , 
                             τ 
                           
                           * 
                         
                         := 
                         
                           
                             p 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                           + 
                           
                             
                               
                                 μ 
                                 
                                   ran 
                                   , 
                                   2 
                                   , 
                                   τ 
                                 
                                 * 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     τ 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       b 
                                       1 
                                       * 
                                     
                                   
                                   - 
                                   
                                     b 
                                     2 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             
                               ( 
                               τ 
                               ) 
                             
                           
                           + 
                           
                             
                               ϕ 
                               
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                               
                             
                             ⁢ 
                             
                               k 
                               
                                 L 
                                 , 
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                               
                               * 
                             
                           
                           + 
                           
                             r 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           sk 
                           
                             L 
                             + 
                             1 
                           
                         
                         := 
                         
                           ( 
                           
                             
                               k 
                               
                                 
                                   L 
                                   + 
                                   1 
                                 
                                 , 
                                 dec 
                               
                               * 
                             
                             , 
                             
                               
                                 { 
                                 
                                   k 
                                   
                                     
                                       L 
                                       + 
                                       1 
                                     
                                     , 
                                     
                                       del 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           ι 
                                         
                                         ) 
                                       
                                     
                                   
                                   * 
                                 
                                 } 
                               
                               
                                 
                                   τ 
                                   = 
                                   
                                     L 
                                     + 
                                     2 
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   d 
                                   ; 
                                   
                                     ι 
                                     = 
                                     1 
                                   
                                 
                                 , 
                                 2 
                               
                             
                             , 
                             
                               
                                 { 
                                 
                                   
                                     k 
                                     
                                       L 
                                       , 
                                       ran 
                                       , 
                                       1 
                                       , 
                                       
                                         j 
                                         ′ 
                                       
                                     
                                     * 
                                   
                                   , 
                                   
                                     k 
                                     
                                       L 
                                       , 
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                     
                                     * 
                                   
                                 
                                 } 
                               
                               
                                 
                                   
                                     j 
                                     ′ 
                                   
                                   = 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   
                                     2 
                                     ⁢ 
                                     
                                       ( 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                       ) 
                                     
                                   
                                   ; 
                                   
                                     τ 
                                     = 
                                     
                                       L 
                                       + 
                                       2 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 d 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       return 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         sk 
                         
                           L 
                           + 
                           1 
                         
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     189 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, as in the cryptographic systems  10  according to Embodiments 2 and 3, in the cryptographic system  10  according to Embodiment 4, the index parts are provided, so that the bases that are used for every attribute category can be constructed as the common bases (basis B and basis B*). As a result, only the basis B and the basis B* need to be included in a public parameter, eliminating the need for reissuing the public parameter when an attribute category is to be added at a later stage. 
     As in Embodiments 2 and 3, for the index parts, it is required that 0 be obtained as a result of an inner-product operation of the index parts. Therefore, although the 2-dimensional index parts, namely the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 , are employed in the above description, the index parts are not limited to 2-dimensional and may be 3-dimensional or higher-dimensional. The values assigned to the index parts are not limited to those described above, and a different assignment arrangement may be employed. 
     The HIPE scheme based on the functional encryption scheme has been described above. As indicated in Formula 190 through Formula 195, however, the scheme can be modified into an HIPE scheme based on the attribute-based encryption scheme. Note that N 0  is 1+1+1+1+1=5, and N 1  is 2+2+8+2+2=16 in Formula 190 through Formula 195. That is, u 0 =1, w 0 =1, z 0 =1, n=2, u=8, w=2, and z=2. Even in this case, security can be proven. 
     
       
         
           
             
               
                 
                   
                     
                       
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               Setup 
                               ⁡ 
                               
                                 ( 
                                 
                                   1 
                                   λ 
                                 
                                 ) 
                               
                             
                             ⁢ 
                             
                               : 
                             
                           
                           ⁢ 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               
                                 ( 
                                 
                                   param 
                                   , 
                                   
                                     ( 
                                     
                                       
                                         0 
                                       
                                       , 
                                       
                                         0 
                                         * 
                                       
                                     
                                     ) 
                                   
                                   , 
                                   
                                     ( 
                                     
                                       , 
                                       
                                         * 
                                       
                                     
                                     ) 
                                   
                                 
                                 ) 
                               
                               ⁢ 
                               
                                 ⟵ 
                                 R 
                               
                               ⁢ 
                               
                                 
                                   ?? 
                                   ob 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     1 
                                     λ 
                                   
                                   ) 
                                 
                               
                             
                             , 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     0 
                                   
                                   := 
                                 
                                 ^ 
                               
                               ⁢ 
                               
                                 ( 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       1 
                                     
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       3 
                                     
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       5 
                                     
                                   
                                 
                                 ) 
                               
                             
                             , 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 ^ 
                               
                               := 
                               
                                 ( 
                                 
                                   
                                     b 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     b 
                                     4 
                                   
                                   , 
                                   
                                     b 
                                     15 
                                   
                                   , 
                                   
                                     b 
                                     16 
                                   
                                 
                                 ) 
                               
                             
                             , 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 
                                   ^ 
                                 
                                 
                                   0 
                                   , 
                                   pk 
                                 
                                 * 
                               
                               := 
                               
                                 b 
                                 
                                   0 
                                   , 
                                   4 
                                 
                                 * 
                               
                             
                             , 
                             
                               
                                 
                                   ^ 
                                 
                                 
                                   0 
                                   , 
                                   sk 
                                 
                                 * 
                               
                               := 
                               
                                 ( 
                                 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       1 
                                     
                                     * 
                                   
                                   , 
                                   
                                     b 
                                     
                                       0 
                                       , 
                                       3 
                                     
                                     * 
                                   
                                 
                                 ) 
                               
                             
                             , 
                           
                         
                       
                     
                   
                   
                     
                       
                         
                             
                         
                         ⁢ 
                         
                           
                             
                               
                                 ^ 
                               
                               pk 
                               * 
                             
                             := 
                             
                               ( 
                               
                                 
                                   b 
                                   1 
                                   * 
                                 
                                 , 
                                 
                                   b 
                                   2 
                                   * 
                                 
                                 , 
                                 
                                   b 
                                   13 
                                   * 
                                 
                                 , 
                                 
                                   b 
                                   14 
                                   * 
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               
                                 ^ 
                               
                               sk 
                               * 
                             
                             := 
                             
                               ( 
                               
                                 
                                   b 
                                   3 
                                   * 
                                 
                                 , 
                                 
                                   b 
                                   4 
                                   * 
                                 
                               
                               ) 
                             
                           
                           , 
                           
                             
 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           return 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     190 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         pk 
                         := 
                         
                           ( 
                           
                             
                               1 
                               λ 
                             
                             , 
                             param 
                             , 
                             
                               
                                 
                                   
                                     0 
                                   
                                   , 
                                 
                                 ^ 
                               
                               ⁢ 
                               
                                 ^ 
                               
                             
                             , 
                             
                               
                                 ^ 
                               
                               
                                 0 
                                 , 
                                 pk 
                               
                               * 
                             
                             , 
                             
                               
                                 ^ 
                               
                               pk 
                               0 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         sk 
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   
                                     ^ 
                                   
                                   
                                     0 
                                     , 
                                     sk 
                                   
                                   * 
                                 
                                 , 
                                 
                                   
                                     ^ 
                                   
                                   sk 
                                   * 
                                 
                               
                               ) 
                             
                             . 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 ?? 
                                 ob 
                               
                               ⁡ 
                               
                                 ( 
                                 
                                   1 
                                   λ 
                                 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                             : 
                           
                         
                       
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         := 
                         
                           
                             ( 
                             
                               q 
                               , 
                               , 
                               
                                 T 
                               
                               , 
                               g 
                               , 
                               e 
                             
                             ) 
                           
                           ⁢ 
                           
                             ⟵ 
                             R 
                           
                           ⁢ 
                           
                             
                               ?? 
                               bpg 
                             
                             ⁡ 
                             
                               ( 
                               
                                 1 
                                 λ 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         ψ 
                         ⁢ 
                         
                           ⟵ 
                           R 
                         
                         ⁢ 
                         
                           q 
                           × 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           N 
                           0 
                         
                         := 
                         5 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           N 
                           1 
                         
                         := 
                         16 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       for 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         0 
                       
                       , 
                       1 
                       , 
                     
                   
                   ⁢ 
                   
                     
 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       := 
                       
                         
                           ( 
                           
                             q 
                             , 
                             
                               t 
                             
                             , 
                             
                               T 
                             
                             , 
                             
                               t 
                             
                             , 
                             e 
                           
                           ) 
                         
                         := 
                         
                           
                             ?? 
                             dpvs 
                           
                           ⁡ 
                           
                             ( 
                             
                               
                                 1 
                                 λ 
                               
                               , 
                               
                                 N 
                                 t 
                               
                               , 
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         X 
                         t 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ) 
                           
                           
                             i 
                             , 
                             
                               j 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               N 
                               t 
                             
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           GL 
                           ⁡ 
                           
                             ( 
                             
                               
                                 N 
                                 t 
                               
                               , 
                               
                                 q 
                               
                             
                             ) 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         X 
                         t 
                         * 
                       
                       := 
                       
                         
                           
                             ( 
                             
                               ϑ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ) 
                           
                           
                             i 
                             , 
                             
                               j 
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               N 
                               t 
                             
                           
                         
                         := 
                         
                           ψ 
                           · 
                           
                             
                               ( 
                               
                                 X 
                                 t 
                                 T 
                               
                               ) 
                             
                             
                               - 
                               1 
                             
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     hereafter 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         χ 
                         → 
                       
                       
                         t 
                         , 
                         i 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   and 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ϑ 
                         → 
                       
                       
                         t 
                         , 
                         i 
                       
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     denote 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     the 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     i 
                     ⁢ 
                     
                       - 
                     
                     ⁢ 
                     th 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     rows 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     of 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       X 
                       t 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     and 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       X 
                       t 
                       * 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   for 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       i 
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       N 
                       t 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     respectively 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         b 
                         
                           t 
                           , 
                           i 
                         
                       
                       := 
                       
                         
                           
                             ( 
                             
                               
                                 χ 
                                 → 
                               
                               
                                 t 
                                 , 
                                 i 
                               
                             
                             ) 
                           
                           
                             t 
                           
                         
                         = 
                         
                           
                             ∑ 
                             
                               j 
                               = 
                               1 
                             
                             
                               N 
                               t 
                             
                           
                           ⁢ 
                           
                             
                               χ 
                               
                                 t 
                                 , 
                                 i 
                                 , 
                                 j 
                               
                             
                             ⁢ 
                             
                               a 
                               
                                 t 
                                 , 
                                 j 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         i 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           t 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               t 
                             
                             , 
                             
                               N 
                               t 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           b 
                           
                             t 
                             , 
                             i 
                           
                           * 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   ϑ 
                                   → 
                                 
                                 
                                   t 
                                   , 
                                   i 
                                 
                               
                               ) 
                             
                             
                               t 
                             
                           
                           = 
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 1 
                               
                               
                                 N 
                                 t 
                               
                             
                             ⁢ 
                             
                               
                                 ϑ 
                                 
                                   t 
                                   , 
                                   i 
                                   , 
                                   j 
                                 
                               
                               ⁢ 
                               
                                 a 
                                 
                                   t 
                                   , 
                                   j 
                                 
                               
                             
                           
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         i 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         N 
                         t 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           t 
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               b 
                               
                                 t 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 t 
                                 , 
                                 
                                   N 
                                   t 
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           g 
                           T 
                         
                         := 
                         
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 g 
                                 , 
                                 g 
                               
                               ) 
                             
                           
                           ψ 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         param 
                         := 
                         
                           ( 
                           
                             
                               
                                 { 
                                 } 
                               
                               
                                 
                                   t 
                                   = 
                                   0 
                                 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               g 
                               T 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       return 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           param 
                           , 
                           , 
                           
                             * 
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         KeyGen 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             sk 
                             , 
                             
                               
                                 ( 
                                 
                                   
                                     v 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     v 
                                     L 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               
                                 q 
                                 L 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         j 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           L 
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         τ 
                         = 
                         
                           L 
                           + 
                           1 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         d 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         ι 
                         = 
                         1 
                       
                       , 
                       
                         2 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ψ 
                       , 
                       
                         μ 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           ran 
                           , 
                           1 
                           , 
                           j 
                           , 
                           t 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         θ 
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           θ 
                           
                             ran 
                             , 
                             1 
                             , 
                             j 
                             , 
                             t 
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         μ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           ι 
                         
                       
                       , 
                       
                         s 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         s 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                           , 
                           t 
                         
                       
                       , 
                       
                           
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         θ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           θ 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                             , 
                             t 
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         L 
                         + 
                         1 
                       
                       , 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     191 
                   
                   ] 
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           s 
                           
                             dec 
                             , 
                             0 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               t 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                             s 
                             
                               dec 
                               , 
                               t 
                             
                           
                         
                       
                       , 
                       
                         
                           s 
                           
                             del 
                             , 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 ι 
                               
                               ) 
                             
                             , 
                             0 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               t 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                             s 
                             
                               del 
                               , 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                               , 
                               t 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           
                             ran 
                             , 
                             1 
                             , 
                             j 
                             , 
                             0 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               t 
                               = 
                               1 
                             
                             L 
                           
                           ⁢ 
                           
                             s 
                             
                               ran 
                               , 
                               1 
                               , 
                               j 
                               , 
                               t 
                             
                           
                         
                       
                       , 
                       
                         
                           s 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                             , 
                             0 
                           
                         
                         := 
                         
                           
                             ∑ 
                             
                               t 
                               = 
                               1 
                             
                             
                               L 
                               + 
                               1 
                             
                           
                           ⁢ 
                           
                             s 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                               , 
                               t 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           η 
                           → 
                         
                         
                           dec 
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           
                             η 
                             → 
                           
                           
                             ran 
                             , 
                             1 
                             , 
                             j 
                             , 
                             t 
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                           2 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           η 
                           → 
                         
                         
                           del 
                           , 
                           
                             ( 
                             
                               t 
                               , 
                               ι 
                             
                             ) 
                           
                           , 
                           t 
                         
                       
                       , 
                       
                         
                           
                             η 
                             → 
                           
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                             , 
                             t 
                           
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                           2 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         0 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         L 
                         + 
                         1 
                       
                       , 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         
                           k 
                           
                             L 
                             , 
                             dec 
                           
                           * 
                         
                         := 
                         
                           ( 
                           
                             
                               
                                 ( 
                                 
                                   
                                     - 
                                     
                                       s 
                                       
                                         dec 
                                         , 
                                         0 
                                       
                                     
                                   
                                   , 
                                   0 
                                   , 
                                   1 
                                   , 
                                   
                                     η 
                                     
                                       dec 
                                       , 
                                       0 
                                     
                                   
                                   , 
                                   0 
                                 
                                 ) 
                               
                               
                                 0 
                                 * 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         
                                           μ 
                                           
                                             dec 
                                             , 
                                             t 
                                           
                                         
                                         ⁡ 
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               - 
                                               1 
                                             
                                           
                                           ) 
                                         
                                       
                                       , 
                                       
                                         
                                           s 
                                           
                                             dec 
                                             , 
                                             t 
                                           
                                         
                                         + 
                                         
                                           
                                             θ 
                                             
                                               dec 
                                               , 
                                               t 
                                             
                                           
                                           ⁢ 
                                           
                                             v 
                                             t 
                                           
                                         
                                       
                                       , 
                                       
                                         - 
                                         
                                           θ 
                                           
                                             dec 
                                             , 
                                             t 
                                           
                                         
                                       
                                       , 
                                       
                                         0 
                                         8 
                                       
                                       , 
                                       
                                         
                                           η 
                                           → 
                                         
                                         
                                           dec 
                                           , 
                                           t 
                                         
                                       
                                       , 
                                       
                                         0 
                                         2 
                                       
                                     
                                     ) 
                                   
                                   
                                     * 
                                   
                                 
                                 ⁢ 
                                 
                                   : 
                                 
                                 ⁢ 
                                 t 
                               
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             L 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           k 
                           
                             L 
                             , 
                             
                               del 
                               ⁡ 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           * 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         - 
                                         
                                           s 
                                           
                                             del 
                                             , 
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 ι 
                                               
                                               ) 
                                             
                                             , 
                                             0 
                                           
                                         
                                       
                                       , 
                                       0 
                                       , 
                                       0 
                                       , 
                                       
                                         η 
                                         
                                           del 
                                           , 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                           , 
                                           0 
                                         
                                       
                                       , 
                                       0 
                                     
                                     ) 
                                   
                                   ⁢ 
                                   
                                     0 
                                     * 
                                   
                                   ⁢ 
                                   
                                     ( 
                                     
                                       
                                         
                                           
                                             
                                               μ 
                                               
                                                 del 
                                                 , 
                                                 
                                                   ( 
                                                   
                                                     τ 
                                                     , 
                                                     ι 
                                                   
                                                   ) 
                                                 
                                                 , 
                                                 t 
                                               
                                             
                                             ⁡ 
                                             
                                               ( 
                                               
                                                 t 
                                                 , 
                                                 
                                                   - 
                                                   1 
                                                 
                                               
                                               ) 
                                             
                                           
                                           ⁢ 
                                           
                                             s 
                                             
                                               del 
                                               , 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                               , 
                                               t 
                                             
                                           
                                         
                                         + 
                                         
                                           
                                             θ 
                                             
                                               del 
                                               , 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                               , 
                                               t 
                                             
                                           
                                           ⁢ 
                                           
                                             v 
                                             t 
                                           
                                         
                                       
                                       , 
                                       
                                         - 
                                         
                                           θ 
                                           
                                             
                                               del 
                                               ⁡ 
                                               
                                                 ( 
                                                 
                                                   τ 
                                                   , 
                                                   ι 
                                                 
                                                 ) 
                                               
                                             
                                             , 
                                             t 
                                           
                                         
                                       
                                       , 
                                       
                                         0 
                                         8 
                                       
                                       , 
                                       
                                         
                                           η 
                                           → 
                                         
                                         
                                           del 
                                           , 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                           , 
                                           t 
                                         
                                       
                                       , 
                                       
                                         0 
                                         2 
                                       
                                     
                                     ) 
                                   
                                   ⁢ 
                                   
                                     * 
                                   
                                   ⁢ 
                                   
                                     : 
                                   
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   t 
                                 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               L 
                               , 
                               
                                 
                                   ( 
                                   
                                     
                                       
                                         μ 
                                         
                                           del 
                                           , 
                                           
                                             ( 
                                             
                                               τ 
                                               , 
                                               ι 
                                             
                                             ) 
                                           
                                           , 
                                           
                                             L 
                                             + 
                                             1 
                                           
                                         
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           
                                             - 
                                             1 
                                           
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       π 
                                       
                                         del 
                                         , 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                         , 
                                         
                                           L 
                                           + 
                                           1 
                                         
                                         , 
                                         1 
                                       
                                     
                                     , 
                                     
                                       π 
                                       
                                         del 
                                         , 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             ι 
                                           
                                           ) 
                                         
                                         , 
                                         
                                           L 
                                           + 
                                           1 
                                         
                                         , 
                                         2 
                                       
                                     
                                     , 
                                     
                                       0 
                                       8 
                                     
                                     , 
                                     
                                       
                                         η 
                                         → 
                                       
                                       
                                         del 
                                         , 
                                         
                                           ( 
                                           
                                             τ 
                                             , 
                                             2 
                                           
                                           ) 
                                         
                                         , 
                                         
                                           L 
                                           + 
                                           1 
                                         
                                       
                                     
                                     , 
                                     
                                       0 
                                       2 
                                     
                                   
                                   ) 
                                 
                                 ⁢ 
                                 
                                   η 
                                   
                                     del 
                                     , 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         2 
                                       
                                       ) 
                                     
                                     , 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               , 
                               
                                 0 
                                 2 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             * 
                           
                         
                       
                     
                     ) 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     where 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         ( 
                         
                           
                             π 
                             
                               del 
                               , 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                               , 
                               
                                 L 
                                 + 
                                 1 
                               
                               , 
                               ι 
                             
                           
                           , 
                           
                             π 
                             
                               del 
                               , 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                               , 
                               
                                 L 
                                 + 
                                 1 
                               
                               , 
                               2 
                             
                           
                         
                         ) 
                       
                       := 
                       
                         { 
                         
                           
                             
                               
                                 ( 
                                 
                                   
                                     
                                       s 
                                       
                                         del 
                                         , 
                                         
                                           
                                             
                                               ( 
                                               
                                                 τ 
                                                 , 
                                                 1 
                                               
                                               ) 
                                             
                                             ⁢ 
                                             L 
                                           
                                           + 
                                           1 
                                         
                                       
                                     
                                     + 
                                     ψ 
                                   
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             
                               
                                 
                                   
                                     if 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     ι 
                                   
                                   = 
                                   1 
                                 
                                 , 
                               
                             
                           
                           
                             
                               
                                 ( 
                                 
                                   
                                     s 
                                     
                                       del 
                                       , 
                                       
                                         ( 
                                         
                                           τ 
                                           , 
                                           2 
                                         
                                         ) 
                                       
                                       , 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                   
                                   , 
                                   ψ 
                                 
                                 ) 
                               
                             
                             
                               
                                 
                                   
                                     if 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     ι 
                                   
                                   = 
                                   2 
                                 
                                 , 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     192 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       
                         k 
                         
                           L 
                           , 
                           ran 
                           , 
                           1 
                           , 
                           j 
                         
                         * 
                       
                       := 
                       
                         ( 
                         
                           
                             
                               ( 
                               
                                 
                                   - 
                                   
                                     s 
                                     
                                       ran 
                                       , 
                                       1 
                                       , 
                                       j 
                                       , 
                                       0 
                                     
                                   
                                 
                                 , 
                                 0 
                                 , 
                                 0 
                                 , 
                                 
                                   η 
                                   
                                     ran 
                                     , 
                                     1 
                                     , 
                                     j 
                                     , 
                                     0 
                                   
                                 
                                 , 
                                 0 
                               
                               ) 
                             
                             
                               0 
                               * 
                             
                           
                           , 
                           
                             
                               
                                 ( 
                                 
                                   
                                     
                                       μ 
                                       
                                         ran 
                                         , 
                                         1 
                                         , 
                                         j 
                                         , 
                                         t 
                                       
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       s 
                                       
                                         ran 
                                         , 
                                         1 
                                         , 
                                         j 
                                         , 
                                         t 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         
                                           ran 
                                           , 
                                           1 
                                           , 
                                           j 
                                           , 
                                           t 
                                         
                                       
                                       ⁢ 
                                       
                                         v 
                                         t 
                                       
                                     
                                   
                                   , 
                                   
                                     - 
                                     
                                       θ 
                                       
                                         ran 
                                         , 
                                         1 
                                         , 
                                         j 
                                         , 
                                         t 
                                       
                                     
                                   
                                   , 
                                   
                                     0 
                                     8 
                                   
                                   , 
                                   
                                     
                                       η 
                                       → 
                                     
                                     
                                       ran 
                                       , 
                                       1 
                                       , 
                                       j 
                                       , 
                                       t 
                                     
                                   
                                   , 
                                   
                                     0 
                                     2 
                                   
                                 
                                 ) 
                               
                               ⁢ 
                               
                                 * 
                               
                               ⁢ 
                               
                                 : 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               t 
                             
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         
                           L 
                           , 
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         * 
                       
                       := 
                       
                         ( 
                         
                           
                             
                               ( 
                               
                                 
                                   - 
                                   
                                     s 
                                     
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                       , 
                                       0 
                                     
                                   
                                 
                                 , 
                                 0 
                                 , 
                                 0 
                                 , 
                                 
                                   η 
                                   
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                     , 
                                     0 
                                   
                                 
                                 , 
                                 0 
                               
                               ) 
                             
                             
                               0 
                               * 
                             
                           
                           , 
                           
                             
                               
                                 ( 
                                 
                                   
                                     
                                       μ 
                                       
                                         ran 
                                         , 
                                         2 
                                         , 
                                         τ 
                                         , 
                                         t 
                                       
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       s 
                                       
                                         ran 
                                         , 
                                         2 
                                         , 
                                         τ 
                                         , 
                                         t 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         
                                           ran 
                                           , 
                                           2 
                                           , 
                                           τ 
                                           , 
                                           t 
                                         
                                       
                                       ⁢ 
                                       
                                         v 
                                         t 
                                       
                                     
                                   
                                   , 
                                   
                                     - 
                                     
                                       θ 
                                       
                                         ran 
                                         , 
                                         2 
                                         , 
                                         τ 
                                         , 
                                         t 
                                       
                                     
                                   
                                   , 
                                   
                                     0 
                                     8 
                                   
                                   , 
                                   
                                     
                                       η 
                                       → 
                                     
                                     
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                       , 
                                       t 
                                     
                                   
                                   , 
                                   
                                     0 
                                     2 
                                   
                                 
                                 ) 
                               
                               ⁢ 
                               
                                 * 
                               
                               ⁢ 
                               
                                 : 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               t 
                             
                             = 
                             1 
                           
                           , 
                           … 
                           ⁢ 
                           
                               
                           
                           , 
                           L 
                           , 
                           
                             
                               ( 
                               
                                 
                                   
                                     μ 
                                     
                                       ran 
                                       , 
                                       2 
                                       , 
                                       τ 
                                       , 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       τ 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   s 
                                   
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                     , 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 0 
                                 , 
                                 
                                   0 
                                   8 
                                 
                                 , 
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                     , 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 
                                   0 
                                   2 
                                 
                               
                               ) 
                             
                             ⁢ 
                             
                               * 
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         sk 
                         L 
                       
                       := 
                       
                         ( 
                         
                           
                             k 
                             
                               L 
                               , 
                               dec 
                             
                             * 
                           
                           , 
                           
                             
                               { 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   
                                     del 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 * 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 d 
                                 ; 
                                 
                                   ι 
                                   = 
                                   1 
                                 
                               
                               , 
                               2 
                             
                           
                           , 
                           
                             
                               { 
                               
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     ran 
                                     , 
                                     1 
                                     , 
                                     j 
                                   
                                   * 
                                 
                                 , 
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                   
                                   * 
                                 
                               
                               } 
                             
                             
                               
                                 j 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   2 
                                   ⁢ 
                                   L 
                                 
                                 ; 
                                 
                                   τ 
                                   = 
                                   
                                     L 
                                     + 
                                     1 
                                   
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     return 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       sk 
                       L 
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Enc 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               m 
                               ∈ 
                               
                                 T 
                               
                             
                             , 
                             
                               
                                 ( 
                                 
                                   
                                     x 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     x 
                                     L 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               
                                 q 
                                 L 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       ω 
                       , 
                       ζ 
                       , 
                       
                         φ 
                         0 
                       
                       , 
                       
                         φ 
                         
                           t 
                           , 
                           1 
                         
                       
                       , 
                       
                         φ 
                         
                           t 
                           , 
                           2 
                         
                       
                       , 
                       
                         
                           σ 
                           t 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       L 
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           1 
                         
                         := 
                         
                           ( 
                           
                             
                               
                                 ( 
                                 
                                   ω 
                                   , 
                                   0 
                                   , 
                                   ζ 
                                   , 
                                   0 
                                   , 
                                   
                                     φ 
                                     0 
                                   
                                 
                                 ) 
                               
                               
                                 0 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     ( 
                                     
                                       
                                         
                                           
                                             σ 
                                             1 
                                           
                                           ⁡ 
                                           
                                             ( 
                                             
                                               1 
                                               , 
                                               t 
                                             
                                             ) 
                                           
                                         
                                         ⁢ 
                                         
                                           ω 
                                           ⁡ 
                                           
                                             ( 
                                             
                                               1 
                                               , 
                                               
                                                 x 
                                                 t 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                       , 
                                       
                                         0 
                                         8 
                                       
                                       , 
                                       
                                         0 
                                         2 
                                       
                                       , 
                                       
                                         φ 
                                         
                                           t 
                                           , 
                                           1 
                                         
                                       
                                       , 
                                       
                                         φ 
                                         
                                           t 
                                           , 
                                           2 
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 ⁢ 
                                 
                                   : 
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 t 
                               
                               = 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             L 
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           c 
                           2 
                         
                         := 
                         
                           
                             g 
                             T 
                             ζ 
                           
                           ⁢ 
                           m 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ct 
                         := 
                         
                           ( 
                           
                             
                               c 
                               1 
                             
                             , 
                             
                               c 
                               2 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ct 
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     193 
                   
                   ] 
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Dec 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               
                                 k 
                                 
                                   L 
                                   , 
                                   dec 
                                   , 
                                 
                                 * 
                               
                               ⁢ 
                               ct 
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           m 
                           ′ 
                         
                         := 
                         
                           
                             c 
                             2 
                           
                           / 
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   c 
                                   1 
                                 
                                 , 
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     dec 
                                   
                                   * 
                                 
                               
                               ) 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             m 
                             ′ 
                           
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     194 
                   
                   ] 
                 
               
             
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         
                           Delegate 
                           L 
                         
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           j 
                           ′ 
                         
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           
                             ( 
                             
                               L 
                               + 
                               1 
                             
                             ) 
                           
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         τ 
                         = 
                         
                           L 
                           + 
                           2 
                         
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         d 
                         ; 
                         
                           ι 
                           = 
                           1 
                         
                       
                       , 
                       
                         2 
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         ′ 
                       
                       , 
                       
                         μ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         ′ 
                       
                       , 
                       
                         ϕ 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         ϕ 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                       
                       , 
                       
                         
                           ψ 
                           ′ 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         p 
                         dec 
                         * 
                       
                       , 
                       
                         p 
                         
                           del 
                           , 
                           
                             ( 
                             
                               τ 
                               , 
                               ι 
                             
                             ) 
                           
                         
                         * 
                       
                       , 
                       
                         p 
                         
                           ran 
                           , 
                           1 
                           , 
                           
                             j 
                             ′ 
                           
                         
                         * 
                       
                       , 
                       
                         
                           
                             p 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                           ⁢ 
                           
                             ⟵ 
                             R 
                           
                           ⁢ 
                           
                             CoreDel 
                             L 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       where 
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           CoreDel 
                           L 
                         
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               L 
                             
                             , 
                             
                               v 
                               
                                 L 
                                 + 
                                 1 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         μ 
                         t 
                         ′ 
                       
                       , 
                       ξ 
                       , 
                       
                         
                           α 
                           j 
                         
                         ⁢ 
                         
                           ⟵ 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     for 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         t 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           L 
                           + 
                           1 
                         
                         ; 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         j 
                         = 
                         1 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         
                           2 
                           ⁢ 
                           L 
                         
                         + 
                         1 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       return 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     195 
                   
                   ] 
                 
               
             
             
               
                 
                   
                     
                       p 
                       * 
                     
                     := 
                     
                       
                         
                           ∑ 
                           
                             t 
                             = 
                             1 
                           
                           
                             L 
                             + 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             μ 
                             t 
                             ′ 
                           
                           ⁢ 
                           
                             
                               ( 
                               
                                 
                                   tb 
                                   1 
                                   * 
                                 
                                 - 
                                 
                                   b 
                                   2 
                                   * 
                                 
                               
                               ) 
                             
                             
                               〈 
                               t 
                               〉 
                             
                           
                         
                       
                       + 
                       
                         ξ 
                         ⁡ 
                         
                           ( 
                           
                             
                               
                                 v 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               ⁢ 
                               
                                 k 
                                 
                                   L 
                                   , 
                                   
                                     del 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         
                                           L 
                                           + 
                                           1 
                                         
                                         , 
                                         1 
                                       
                                       ) 
                                     
                                   
                                 
                                 * 
                               
                             
                             - 
                             
                               k 
                               
                                 L 
                                 , 
                                 
                                   del 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       
                                         L 
                                         + 
                                         1 
                                       
                                       , 
                                       2 
                                     
                                     ) 
                                   
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       + 
                       
                         
                           ∑ 
                           
                             j 
                             = 
                             1 
                           
                           
                             2 
                             ⁢ 
                             L 
                           
                         
                         ⁢ 
                         
                           
                             α 
                             j 
                           
                           ⁢ 
                           
                             k 
                             
                               L 
                               , 
                               ran 
                               , 
                               1 
                               , 
                               j 
                             
                             * 
                           
                         
                       
                       + 
                       
                         
                           α 
                           
                             
                               2 
                               ⁢ 
                               L 
                             
                             + 
                             1 
                           
                         
                         ⁢ 
                         
                           k 
                           
                             L 
                             , 
                             ran 
                             , 
                             2 
                             , 
                             
                               L 
                               + 
                               1 
                             
                           
                           * 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     r 
                     dec 
                     * 
                   
                   , 
                   
                     
                       
                         r 
                         
                           ran 
                           , 
                           1 
                           , 
                           
                             j 
                             ′ 
                           
                         
                         * 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       span 
                     
                     ⁢ 
                     
                       〈 
                       
                         
                           
                             ( 
                             
                               b 
                               
                                 0 
                                 , 
                                 4 
                               
                               * 
                             
                             ) 
                           
                           
                             〈 
                             0 
                             〉 
                           
                         
                         , 
                         
                           
                             { 
                             
                               
                                 
                                   ( 
                                   
                                     b 
                                     13 
                                     * 
                                   
                                   ) 
                                 
                                 
                                   〈 
                                   t 
                                   〉 
                                 
                               
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   ( 
                                   
                                     b 
                                     14 
                                     * 
                                   
                                   ) 
                                 
                                 
                                   〈 
                                   t 
                                   〉 
                                 
                               
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               1 
                             
                             , 
                             … 
                             , 
                             
                               L 
                               + 
                               1 
                             
                           
                         
                       
                       〉 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     r 
                     
                       del 
                       , 
                       
                         ( 
                         
                           τ 
                           , 
                           ι 
                         
                         ) 
                       
                     
                     * 
                   
                   , 
                   
                     
                       
                         r 
                         
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         * 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       span 
                     
                     ⁢ 
                     
                       〈 
                       
                         
                           
                             ( 
                             
                               b 
                               
                                 0 
                                 , 
                                 4 
                               
                               * 
                             
                             ) 
                           
                           
                             〈 
                             0 
                             〉 
                           
                         
                         , 
                         
                           
                             { 
                             
                               
                                 
                                   ( 
                                   
                                     b 
                                     13 
                                     * 
                                   
                                   ) 
                                 
                                 
                                   〈 
                                   t 
                                   〉 
                                 
                               
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   ( 
                                   
                                     b 
                                     14 
                                     * 
                                   
                                   ) 
                                 
                                 
                                   〈 
                                   t 
                                   〉 
                                 
                               
                             
                             } 
                           
                           
                             
                               t 
                               = 
                               1 
                             
                             , 
                             … 
                             , 
                             
                               L 
                               + 
                               1 
                             
                             , 
                             τ 
                           
                         
                       
                       〉 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       
                         
                           L 
                           + 
                           1 
                         
                         , 
                         dec 
                       
                       * 
                     
                     := 
                     
                       
                         k 
                         
                           L 
                           , 
                           dec 
                         
                         * 
                       
                       + 
                       
                         p 
                         dec 
                         * 
                       
                       + 
                       
                         r 
                         dec 
                         * 
                       
                     
                   
                   , 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         k 
                         
                           
                             L 
                             + 
                             1 
                           
                           , 
                           
                             dec 
                             ⁡ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                         
                         * 
                       
                       := 
                       
                         
                           p 
                           
                             del 
                             ⁡ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                           * 
                         
                         + 
                         
                           
                             
                               μ 
                               
                                 del 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                               ′ 
                             
                             ⁡ 
                             
                               ( 
                               
                                 
                                   τ 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     b 
                                     1 
                                     * 
                                   
                                 
                                 - 
                                 
                                   b 
                                   2 
                                   * 
                                 
                               
                               ) 
                             
                           
                           
                             ( 
                             τ 
                             ) 
                           
                         
                         + 
                         
                           
                             ϕ 
                             
                               del 
                               , 
                               
                                 ( 
                                 
                                   τ 
                                   , 
                                   ι 
                                 
                                 ) 
                               
                             
                           
                           ⁢ 
                           
                             k 
                             
                               L 
                               , 
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                         
                         + 
                         
                           
                             ψ 
                             ′ 
                           
                           ⁢ 
                           
                             k 
                             
                               L 
                               , 
                               
                                 del 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     τ 
                                     , 
                                     ι 
                                   
                                   ) 
                                 
                               
                             
                             * 
                           
                         
                         + 
                         
                           r 
                           
                             del 
                             ⁡ 
                             
                               ( 
                               
                                 τ 
                                 , 
                                 ι 
                               
                               ) 
                             
                           
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         
                           
                             L 
                             + 
                             1 
                           
                           , 
                           ran 
                           , 
                           
                             1 
                             ⁢ 
                             
                               j 
                               ′ 
                             
                           
                         
                         * 
                       
                       := 
                       
                         
                           p 
                           
                             ran 
                             , 
                             1 
                             , 
                             
                               j 
                               ′ 
                             
                           
                           * 
                         
                         + 
                         
                           r 
                           
                             ran 
                             , 
                             1 
                             , 
                             
                               j 
                               ′ 
                             
                           
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         k 
                         
                           
                             L 
                             + 
                             1 
                           
                           , 
                           ran 
                           , 
                           2 
                           , 
                           τ 
                         
                         * 
                       
                       := 
                       
                         
                           p 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                           
                           * 
                         
                         + 
                         
                           
                             
                               μ 
                               
                                 ran 
                                 , 
                                 2 
                                 , 
                                 τ 
                               
                               * 
                             
                             ⁡ 
                             
                               ( 
                               
                                 
                                   τ 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     b 
                                     1 
                                     * 
                                   
                                 
                                 - 
                                 
                                   b 
                                   2 
                                   * 
                                 
                               
                               ) 
                             
                           
                           
                             ( 
                             τ 
                             ) 
                           
                         
                         + 
                         
                           
                             ϕ 
                             
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                           
                           ⁢ 
                           
                             k 
                             
                               L 
                               , 
                               ran 
                               , 
                               2 
                               , 
                               τ 
                             
                             * 
                           
                         
                         + 
                         
                           r 
                           
                             ran 
                             , 
                             2 
                             , 
                             τ 
                           
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         sk 
                         
                           L 
                           + 
                           1 
                         
                       
                       := 
                       
                         ( 
                         
                           
                             k 
                             
                               
                                 L 
                                 + 
                                 1 
                               
                               , 
                               dec 
                             
                             * 
                           
                           , 
                           
                             
                               { 
                               
                                 k 
                                 
                                   
                                     L 
                                     + 
                                     1 
                                   
                                   , 
                                   
                                     del 
                                     ⁡ 
                                     
                                       ( 
                                       
                                         τ 
                                         , 
                                         ι 
                                       
                                       ) 
                                     
                                   
                                 
                                 * 
                               
                               } 
                             
                             
                               
                                 τ 
                                 = 
                                 
                                   L 
                                   + 
                                   2 
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 d 
                                 ; 
                                 
                                   ι 
                                   = 
                                   1 
                                 
                               
                               , 
                               2 
                             
                           
                           , 
                           
                             
                               { 
                               
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     ran 
                                     , 
                                     1 
                                     , 
                                     
                                       j 
                                       ′ 
                                     
                                   
                                   * 
                                 
                                 , 
                                 
                                   k 
                                   
                                     L 
                                     , 
                                     ran 
                                     , 
                                     2 
                                     , 
                                     τ 
                                   
                                   * 
                                 
                               
                               } 
                             
                             
                               
                                 
                                   j 
                                   ′ 
                                 
                                 = 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 
                                   2 
                                   ⁢ 
                                   
                                     ( 
                                     
                                       L 
                                       + 
                                       1 
                                     
                                     ) 
                                   
                                 
                                 ; 
                                 
                                   τ 
                                   = 
                                   
                                     L 
                                     + 
                                     2 
                                   
                                 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               d 
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     return 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       sk 
                       
                         L 
                         + 
                         1 
                       
                     
                     . 
                   
                 
               
               
                 
                     
                 
               
             
           
         
       
     
     Embodiment 5 
     This embodiment describes a signature scheme. In particular, this embodiment describes a signature scheme based on the CP-FE scheme described in Embodiment 3. 
     First, the construction of the signature scheme will be described. 
     Second, the configuration of a cryptographic system  10  that implements the signature scheme will be described. 
     Third, the signature scheme will be described in detail. 
     &lt;1. Construction of Signature Scheme&gt; 
     The signature scheme consists of four algorithms: Setup, KeyGen, Sig, and Ver. 
     (Setup) 
     A Setup algorithm is a probabilistic algorithm that takes as input a security parameter λ, and outputs a public parameter pk and a master key sk. 
     (KeyGen) 
     A KeyGen algorithm is a probabilistic algorithm that takes as input an attribute set Γ:={(t, x{right arrow over ( )} t )|x{right arrow over ( )} t εF q   n , 1≦t≦d}, the public parameter pk, and the master key sk, and outputs a signature key sk Γ . 
     (Sig) 
     A Sig algorithm is a probabilistic algorithm that takes as input a message m, the signature key sk Γ , an access structure S:=(M, ρ), and the public parameter pk, and outputs signature data sig. 
     (Ver) 
     A Ver algorithm is an algorithm that takes as input the message m, the access structure S:=(M, ρ), the signature data sig, and the public parameter pk, and outputs a value “1” indicating success of verification of the signature, or a value “0” indicating failure of verification of the signature. 
     &lt;2. Configuration of Cryptographic System  10  that Implements Signature Scheme&gt; 
       FIG. 30  is a configuration diagram of the cryptographic system  10  that implements the signature scheme according to Embodiment 5. 
     The cryptographic system  10  includes a key generation device  100 , a signature device  500 , and a verification device  600 . 
     The key generation device  100  executes the Setup algorithm taking as input a security parameter λ, and thus generates a public parameter pk and a master key sk. Then, the key generation device  100  publishes the generated public parameter pk. The key generation device  100  also executes the KeyGen algorithm taking as input an attribute set Γ, and thus generates a signature key sk Γ , and distributes the signature key sk Γ  to the signature device  500  in secrecy. 
     The signature device  500  executes the Sig algorithm taking as input a message m, an access structure S, the public parameter pk, and the signature key sk Γ , and thus generates signature information s{right arrow over ( )}*. The signature device  500  transmits the generated signature information s{right arrow over ( )}*, the message m, and the access structure S to the verification device  600 . 
     The verification device  600  executes the Ver algorithm taking as input the signature information s{right arrow over ( )}*, the message m, the access structure S, and the public parameter pk, and outputs a value “1” or a value “0”. 
     &lt;3. Signature Scheme in Detail&gt; 
     With reference to  FIGS. 31 to 37 , the signature scheme will be described, and the function and operation of the cryptographic system  10  that implements the signature scheme will be described. 
       FIG. 31  is a configuration diagram of the key generation device  100  according to Embodiment 5.  FIG. 32  is a configuration diagram of the signature device  500  according to Embodiment 5.  FIG. 33  is a configuration diagram of the verification device  600  according to Embodiment 5. 
       FIGS. 34 and 35  show flowcharts illustrating the operation of the key generation device  100 .  FIG. 34  is a flowchart illustrating the process of the Setup algorithm.  FIG. 35  is a flowchart illustrating the process of the KeyGen algorithm.  FIG. 36  is a flowchart illustrating the operation of the signature device  500  and illustrating the process of the Sig algorithm.  FIG. 37  is a flowchart illustrating the operation of the verification device  600  and illustrating the process of the Ver algorithm. 
     In the following description, H:=(KH λ , H hk   λ,D ) is a collision resistant hash function (see Non-Patent Literature 30). A collision resistant hash function is a hash function for which it is difficult to find two inputs that hash to the same output. 
     Specifically, a collision resistant hash function family H associated with the algorithm G bpg  and a polynomial poly(λ) specify two items: 
     1. A family of key spaces is indexed by λ. Each such key space is a probability space on bit strings denoted by KH λ . There must exist a probabilistic polynomial-time algorithm whose output distribution on input 1 λ  is equal to KH λ . 
     2. A family of hash functions is indexed by λ, hk randomly selected from KH λ , and D:={0, 1} poly(λ) , where each such function H hk   λ,D  maps an element of D to an element of F q   x  with q being the first element of output param G  of algorithm G bpg (1 λ ). There must exist a deterministic polynomial-time algorithm that outputs H hk   λ,D (d) on input 1 λ , hk, and dεD. 
     The function and operation of the key generation device  100  will be described. 
     The key generation device  100  includes a master key generation unit  110 , a master key storage unit  120 , an information input unit  130 , a decryption key generation unit  140 , and a key distribution unit  150 . The decryption key generation unit  140  includes a random number generation unit  143  and a key element generation unit  144 . 
     With reference to  FIG. 34 , the process of the Setup algorithm will be described. 
     (S 1301 ) is basically the same as (S 101 ) in Embodiment 2 shown in  FIG. 9 . There are differences, however, in that the process of (4) through (8) is executed for t=0, 1, and d+1 and that N 0  is 1+u 0 +w 0 +z 0 . Note that N d+1  is 2+u d+1 +w d+1 +z d+1  and that u d+1 , w d+1 , and z d+1  are integers of 1 or more. 
     (S 1302 : Hash Key Generation Step) 
     Using the processing device, the master key generation unit  110  computes Formula 196, and thus generates a hash key hk randomly. 
     
       
         
           
             
               
                 
                   hk 
                   ⁢ 
                   
                     ⟵ 
                     R 
                   
                   ⁢ 
                   
                     KH 
                     λ 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     196 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1303 : Public Parameter Generation Step) 
     Using the processing device, the master key generation unit  110  generates a subbasis B^ 0  of the basis B 0 , a subbasis B^ of the basis B, a subbasis B^ d+1  of the basis B d+1 , a subbasis B^* 0  of the basis B* 0 , a subbasis B^* of the basis B*, and a subbasis B^* d+1  of the basis B* d+1 , as indicated in Formula 197, the bases B 0 , B, B d+1 , B* 0 , B^*, and B* d+1  having been generated in (S 1301 ).
 
   0 :=( b   0,1   ,b   0,1+u     0     +w     0     +1   , . . . ,b   0,1+u     0     +w     0     +z     0   )
 
 :=( b   1   , . . . ,b   2+n   ,b   2+n+u+w+1   , . . . ,b   2+n+u+w+z ),
 
   d+1 :=( b   d+1,1   ,b   d+1,2   ,b   d+1,2+u     d+1     +w     d+1     +1   , . . . ,b   d+1,2+u     d+1     +w     d+1   +z d+1 )
 
 * 0 :=( b*   0,1+u     0     +1   , . . . ,b   0,1+u     0     +w     0   ),
 
 *:=( b*   1   , . . . ,b   2+n   ,b   2+n+u+1   , . . . ,b   2+n+u+w ),
 
 * d+1 :=( b*   d+1,1   ,b*   d+1,2   ,b*   d+1,2+u     d+1     + 1 , . . . ,b*   d+1,2+u     d+1     +w     d+1   )  [Formula 197]
 
     The master key generation unit  110  generates a public parameter pk by putting together the generated subbasis B^ 0 , subbasis B^, subbasis B^ d+1 , subbasis B^* 0 , subbasis B^*, and subbasis B^* d+1 , the security parameter λ(1 λ ) inputted in (S 1301 ), param generated in (S 1301 ), and the hash key hk generated in (S 1302 ). 
     (S 1304 : Master Key Generation Step) 
     The master key generation unit  110  generates a master key sk which is constituted by a basis vector b* 0,1  of the basis B^* 0 . 
     (S 1305 : Master Key Storage Step) 
     The master key storage unit  120  stores the public parameter pk generated in (S 1303 ) in the storage device. The master key storage unit  120  also stores the master key sk generated in (S 1304 ) in the storage device. 
     In brief, in (S 1301 ) through (S 1304 ), the key generation device  100  executes the Setup algorithm indicated in Formula 198, and thus generates the public parameter pk and the master key sk. In (S 1305 ), the key generation device  100  stores the generated public parameter pk and master key sk in the storage device. 
     The public parameter is published via the network, for example, and is made available for the signature device  500  and the verification device  600 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       Setup 
                       ⁡ 
                       
                         ( 
                         
                           1 
                           λ 
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         hk 
                         ⁢ 
                         
                           ⟵ 
                           R 
                         
                         ⁢ 
                         
                           KH 
                           λ 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           ( 
                           
                             param 
                             , 
                             
                               ( 
                               
                                 
                                   0 
                                 
                                 , 
                                 
                                   0 
                                   * 
                                 
                               
                               ) 
                             
                             , 
                             
                               ( 
                               
                                 , 
                                 
                                   * 
                                 
                               
                               ) 
                             
                             , 
                             
                               ( 
                               
                                 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                                 , 
                                 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                   * 
                                 
                               
                               ) 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                           ⟵ 
                           R 
                         
                         ⁢ 
                         
                           
                             ?? 
                             ob 
                           
                           ⁡ 
                           
                             ( 
                             
                               1 
                               λ 
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               0 
                             
                             := 
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                   + 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             := 
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               1 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                                 + 
                                 1 
                               
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                                 + 
                                 z 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 d 
                                 + 
                                 1 
                               
                             
                             := 
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 1 
                               
                             
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 2 
                               
                             
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   1 
                                 
                               
                             
                             , 
                             … 
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             
                                 
                             
                             ⁢ 
                             
                               
                                 0 
                                 * 
                               
                               := 
                             
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   1 
                                 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 0 
                                 , 
                                 
                                   1 
                                   + 
                                   
                                     u 
                                     0 
                                   
                                   + 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             
                               * 
                             
                             := 
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               1 
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 1 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 2 
                                 + 
                                 n 
                                 + 
                                 u 
                                 + 
                                 w 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           
                             
                               
                                 d 
                                 + 
                                 1 
                               
                               * 
                             
                             := 
                           
                           ^ 
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 1 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 2 
                               
                               * 
                             
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   1 
                                 
                               
                               * 
                             
                             , 
                             … 
                             ⁢ 
                             
                                 
                             
                             , 
                             
                               b 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 
                                   2 
                                   + 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   + 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               * 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         sk 
                         := 
                         
                           b 
                           
                             0 
                             , 
                             1 
                           
                           * 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         pk 
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   1 
                                   λ 
                                 
                                 , 
                                 hk 
                                 , 
                                 param 
                                 , 
                                 
                                   
                                     0 
                                   
                                   ^ 
                                 
                                 , 
                                 
                                   ^ 
                                 
                                 , 
                                 
                                   
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                   ^ 
                                 
                                 , 
                                 
                                   
                                     0 
                                     * 
                                   
                                   ^ 
                                 
                                 , 
                                 
                                   
                                     
                                       
                                         * 
                                       
                                       , 
                                     
                                     ^ 
                                   
                                   ⁢ 
                                   
                                     
                                       
                                         d 
                                         + 
                                         1 
                                       
                                       * 
                                     
                                     ^ 
                                   
                                 
                               
                               ) 
                             
                             . 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             return 
                           
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           sk 
                         
                       
                       , 
                       
                         pk 
                         . 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     198 
                   
                   ] 
                 
               
             
           
         
       
     
     With reference to  FIG. 35 , the process of the KeyGen algorithm will be described. 
     (S 1401 : Information Input Step) 
     Using the input device, the information input unit  130  takes as input an attribute set Γ:={(t, x{right arrow over ( )} t :=(x t,1 , . . . , x t,n εF q   n ))|1≦t≦d}. Note that attribute information of the user of a signature key sk Γ  is set in the attribute set Γ, for example. 
     (S 1402 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  143  generates random numbers, as indicated in Formula 199. 
     
       
         
           
             
               
                 
                   
                     
                       δ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         × 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       := 
                       
                         φ 
                         
                           0 
                           , 
                           1 
                         
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           0 
                           , 
                           
                             w 
                             0 
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       := 
                       
                         φ 
                         
                           t 
                           , 
                           1 
                         
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           t 
                           , 
                           w 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         w 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   for 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       t 
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     d 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           1 
                         
                       
                       := 
                       
                         φ 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           1 
                           , 
                           1 
                         
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           1 
                           , 
                           
                             w 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           2 
                         
                       
                       := 
                       
                         φ 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           2 
                           , 
                           1 
                         
                       
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     
                       
                         φ 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           2 
                           , 
                           
                             w 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                     
                     , 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     199 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1403 : Key Element Generation Step) 
     Using the processing device, the key element generation unit  144  generates an element k* 0  of the signature key sk Γ , as indicated in Formula 200. 
     
       
         
           
             
               
                 
                   
                     k 
                     0 
                     * 
                   
                   := 
                   
                     
                       ( 
                       
                         δ 
                         , 
                         
                           
                             0 
                             
                               u 
                               0 
                             
                           
                           
                             ︷ 
                             
                               u 
                               0 
                             
                           
                         
                         , 
                         
                           
                             
                               φ 
                               → 
                             
                             0 
                           
                           
                             ︷ 
                             
                               w 
                               0 
                             
                           
                         
                         , 
                         
                           
                             0 
                             
                               z 
                               0 
                             
                           
                           
                             ︷ 
                             
                               z 
                               0 
                             
                           
                         
                       
                       ) 
                     
                     
                       0 
                       * 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     200 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the key element generation unit  144  also generates an element k* t  of the signature key sk Γ  for each integer t included in the attribute set Γ, as indicated in Formula 201. 
     
       
         
           
             
               
                 
                   
                     
                       k 
                       t 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     1 
                                     , 
                                     t 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   δ 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     x 
                                     t 
                                   
                                 
                                 → 
                               
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           , 
                           
                             
                               0 
                               u 
                             
                             
                               ︷ 
                               u 
                             
                           
                           , 
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 z 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                         
                         ) 
                       
                       
                         * 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                         
 
                       
                       ( 
                       
                         t 
                         , 
                         
                           
                             x 
                             → 
                           
                           t 
                         
                       
                       ) 
                     
                     ∈ 
                     Γ 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     201 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the key element generation unit  144  also generates elements k* d+1  and k* d+2  of the signature key sk Γ , as indicated in Formula 202. 
     
       
         
           
             
               
                 
                   
                     
                       k 
                       
                         
                           d 
                           + 
                           1 
                         
                         , 
                         1 
                       
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               δ 
                               ⁡ 
                               
                                 ( 
                                 
                                   1 
                                   , 
                                   0 
                                 
                                 ) 
                               
                             
                             
                               ︷ 
                               2 
                             
                           
                           , 
                           
                             
                               
                                 
                                   0 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   
                                     
                                       d 
                                       + 
                                       1 
                                     
                                     , 
                                     1 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 
                                   z 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                           
                         
                         ) 
                       
                       
                         
                           d 
                           + 
                           1 
                         
                         * 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       k 
                       
                         
                           d 
                           + 
                           1 
                         
                         , 
                         2 
                       
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               δ 
                               ⁡ 
                               
                                 ( 
                                 
                                   0 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                             
                               ︷ 
                               2 
                             
                           
                           , 
                           
                             
                               
                                 
                                   0 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                             ⁢ 
                             
                               
                                 
                                   
                                     φ 
                                     → 
                                   
                                   
                                     
                                       d 
                                       + 
                                       1 
                                     
                                     , 
                                     2 
                                   
                                 
                                 , 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 
                                   z 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                 
                               
                             
                           
                         
                         ) 
                       
                       
                         
                           d 
                           + 
                           1 
                         
                         * 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     202 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1404 : Key Distribution Step) 
     Using the communication device and via the network, for example, the key distribution unit  150  distributes the signature key sk Γ  having, as elements, the attribute set Γ inputted in (S 1401 ) and k* 0 , k* t , k* d+1 , and k* d+2  generated in (S 1403 ) to the signature device  500  in secrecy. As a matter of course, the signature key sk Γ  may be distributed to the signature device  500  by another method. 
     In brief, in (S 1401 ) through (S 1403 ), the key generation device  100  executes the KeyGen algorithm indicated in Formula 203, and thus generates the signature key sk Γ . In (S 1404 ), the key generation device  100  distributes the generated signature key sk Γ  to the signature device  500 . 
     
       
         
           
             
               
                 
                   
                     KeyGen 
                     ⁡ 
                     
                       ( 
                       
                         pk 
                         , 
                         sk 
                         , 
                         
                           Γ 
                           := 
                           
                             { 
                             
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       
                                         x 
                                         → 
                                       
                                       t 
                                     
                                     := 
                                     
                                       
                                         ( 
                                         
                                           
                                             x 
                                             
                                               t 
                                               , 
                                               1 
                                             
                                           
                                           , 
                                           … 
                                           ⁢ 
                                           
                                               
                                           
                                           , 
                                           
                                             x 
                                             
                                               t 
                                               , 
                                               n 
                                             
                                           
                                         
                                         ) 
                                       
                                       ∈ 
                                       
                                         
                                           q 
                                           n 
                                         
                                         ⁢ 
                                         \ 
                                         ⁢ 
                                         
                                           { 
                                           
                                             0 
                                             → 
                                           
                                           } 
                                         
                                       
                                     
                                   
                                 
                                 ) 
                               
                               ❘ 
                               
                                 1 
                                 ≤ 
                                 t 
                                 ≤ 
                                 d 
                               
                             
                             } 
                           
                         
                       
                       ) 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       δ 
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         × 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         0 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           0 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           φ 
                           → 
                         
                         t 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         w 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   for 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       t 
                       = 
                       1 
                     
                     , 
                     … 
                     ⁢ 
                     
                         
                     
                     , 
                     d 
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         φ 
                         → 
                       
                       
                         
                           d 
                           + 
                           1 
                         
                         , 
                         1 
                       
                     
                     , 
                     
                       
                         
                           φ 
                           → 
                         
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           2 
                         
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         q 
                         
                           w 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         0 
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             δ 
                             , 
                             
                               
                                 0 
                                 
                                   u 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   u 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 0 
                               
                               
                                 ︷ 
                                 
                                   w 
                                   0 
                                 
                               
                             
                             , 
                             
                               
                                 0 
                                 
                                   z 
                                   0 
                                 
                               
                               
                                 ︷ 
                                 
                                   z 
                                   0 
                                 
                               
                             
                           
                           ) 
                         
                         
                           0 
                           * 
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       k 
                       t 
                       * 
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     1 
                                     , 
                                     t 
                                   
                                   ) 
                                 
                               
                               , 
                               
                                 
                                   δ 
                                   ⁢ 
                                   
                                       
                                   
                                   ⁢ 
                                   
                                     x 
                                     t 
                                   
                                 
                                 → 
                               
                             
                             
                               ︷ 
                               
                                 2 
                                 + 
                                 n 
                               
                             
                           
                           , 
                           
                             
                               0 
                               u 
                             
                             
                               ︷ 
                               u 
                             
                           
                           , 
                           
                             
                               
                                 
                                   φ 
                                   → 
                                 
                                 t 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             ⁢ 
                             
                               
                                 0 
                                 z 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                         
                         ) 
                       
                       
                         * 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   for 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               x 
                               → 
                             
                             t 
                           
                         
                         ) 
                       
                       ∈ 
                       Γ 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           1 
                         
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     1 
                                     , 
                                     0 
                                   
                                   ) 
                                 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     0 
                                     
                                       u 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     
                                       
                                         d 
                                         + 
                                         1 
                                       
                                       , 
                                       1 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         
                           
                             d 
                             + 
                             1 
                           
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         k 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           2 
                         
                         * 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 δ 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     0 
                                     , 
                                     1 
                                   
                                   ) 
                                 
                               
                               
                                 ︷ 
                                 2 
                               
                             
                             , 
                             
                               
                                 
                                   
                                     0 
                                     
                                       u 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   
                                     
                                       φ 
                                       → 
                                     
                                     
                                       
                                         d 
                                         + 
                                         1 
                                       
                                       , 
                                       2 
                                     
                                   
                                   , 
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               ⁢ 
                               
                                 
                                   0 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                             
                           
                           ) 
                         
                         
                           
                             d 
                             + 
                             1 
                           
                           * 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       T 
                       := 
                       
                         
                           { 
                           
                             0 
                             , 
                             
                               ( 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 1 
                               
                               ) 
                             
                             , 
                             
                               ( 
                               
                                 
                                   d 
                                   + 
                                   1 
                                 
                                 , 
                                 2 
                               
                               ) 
                             
                           
                           } 
                         
                         ⋃ 
                         
                           { 
                           
                             
                               t 
                               ❘ 
                               
                                 1 
                                 ≤ 
                                 t 
                                 ≤ 
                                 d 
                               
                             
                             , 
                             
                               
                                 ( 
                                 
                                   t 
                                   , 
                                   
                                     
                                       x 
                                       → 
                                     
                                     t 
                                   
                                 
                                 ) 
                               
                               ∈ 
                               Γ 
                             
                           
                           } 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     return 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       sk 
                       Γ 
                     
                     := 
                     
                       
                         ( 
                         
                           Γ 
                           , 
                           
                             
                               { 
                               
                                 k 
                                 t 
                                 * 
                               
                               } 
                             
                             
                               t 
                               ∈ 
                               T 
                             
                           
                         
                         ) 
                       
                       . 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     203 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the signature device  500  will be described. 
     The signature device  500  includes a signature key acquisition unit  510 , an information input unit  520 , a complementary coefficient computation unit  530 , a signature data generation unit  540 , and a data transmission unit  550 . The signature data generation unit  540  includes a random number generation unit  541  and a signature element generation unit  542 . 
     With reference to  FIG. 36 , the process of the Sig algorithm will be described. 
     (S 1501 : Signature Key Acquisition Step) 
     Using the communication device and via the network, for example, the signature key acquisition unit  510  obtains the signature key sk Γ  generated by the key generation device  100 . The signature key acquisition unit  510  also obtains the public parameter pk generated by the key generation device  100 . 
     (S 1502 : Information Input Step) 
     Using the input device, the information input unit  520  takes as input an access structure S:=(M, ρ). Note that a matrix M of the access structure S is to be set according to the conditions of a system to be implemented. 
     Using the input device, the information input unit  520  also takes as input a message m to which a signature is to be appended. 
     (S 1503 : Span Program Computation Step) 
     Using the processing device, the complementary coefficient computation unit  530  checks whether or not the access structure S inputted in (S 1502 ) accepts the attribute set Γ included in the signature key sk Γ  obtained in (S 1501 ). 
     The method for checking whether or not the access structure accepts the attribute set is the same as that described in “5. Concept for implementing functional encryption in Embodiment 1”. 
     If the access structure S accepts the attribute set Γ (accept in S 1503 ), the complementary coefficient computation unit  530  advances the process to (S 1504 ). If the access structure S rejects the attribute set Γ (reject in S 1503 ), the complementary coefficient computation unit  530  ends the process. 
     (S 1504 : Complementary Coefficient Computation Step) 
     Using the processing device, the complementary coefficient computation unit  530  computes I and a constant (complementary coefficient) α i  for each integer i included in I such that Formula 204 is satisfied.
 
Σ i=I α i   M   i :={right arrow over (1)}
 
and  I ⊂ {iε{ 1 , . . . ,L }|[ρ( i )=( t,{right arrow over (v)}   i ) ( t,{right arrow over (x)}   t )εΓ   {right arrow over (v)}   i   ·{right arrow over (x)}   t =0]
 
 [ρ( i )= ( t,{right arrow over (v)}   i ) ( t,{right arrow over (x)}   t )εΓ   {right arrow over (v)}   i   ·{right arrow over (x)}   t ≠0]}  [Formula 204]
 
     (S 1505 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  541  generates random numbers, as indicated in Formula 205. 
     
       
         
           
             
               
                 
                   
                     ξ 
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       q 
                       × 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       ( 
                       
                         β 
                         i 
                       
                       ) 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     
                       { 
                       
                         
                           
                             ( 
                             
                               
                                 β 
                                 1 
                               
                               , 
                               … 
                               ⁢ 
                               
                                   
                               
                               , 
                               
                                 β 
                                 L 
                               
                             
                             ) 
                           
                           ❘ 
                           
                             
                               ∑ 
                               
                                 i 
                                 = 
                                 1 
                               
                               L 
                             
                             ⁢ 
                             
                               
                                 β 
                                 i 
                               
                               ⁢ 
                               
                                 M 
                                 i 
                               
                             
                           
                         
                         = 
                         
                           0 
                           → 
                         
                       
                       } 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     205 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1506 : Signature Element Generation Step) 
     Using the processing device, the signature element generation unit  542  generates a signature element s* 0  which is an element of signature data sig, as indicated in Formula 206.
 
 s*   0   :=ξk*   0   +r*   0   [Formula 206]
 
     Note that r* 0  is defined by Formula 207 (see Formula 110 through Formula 112 and explanations thereof). 
     
       
         
           
             
               
                 
                   
                     
                       r 
                       0 
                       * 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     span 
                   
                   ⁢ 
                   
                     〈 
                     
                       
                         b 
                         
                           0 
                           , 
                           
                             1 
                             + 
                             
                               u 
                               0 
                             
                             + 
                             1 
                           
                         
                         * 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         b 
                         
                           0 
                           , 
                           
                             1 
                             + 
                             
                               u 
                               0 
                             
                             + 
                             
                               w 
                               0 
                             
                           
                         
                         * 
                       
                     
                     〉 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     207 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the signature element generation unit  542  also generates a signature element s*, which is an element of the signature data sig for each integer i=1, . . . , L, as indicated in Formula 208.
 
 s*   i :=γ i   ·ξk*   t +Σ l=1   n   y   i,l   ·b*   t,l   +r*   i , for 1≦ i≦L   [Formula 208]
 
     Note that r* i  is defined by Formula 209. 
     
       
         
           
             
               
                 
                   
                     
                       r 
                       i 
                       * 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     span 
                   
                   ⁢ 
                   
                     〈 
                     
                       
                         b 
                         
                           t 
                           , 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             1 
                           
                         
                         * 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         b 
                         
                           t 
                           , 
                           
                             2 
                             + 
                             n 
                             + 
                             u 
                             + 
                             w 
                           
                         
                         * 
                       
                     
                     〉 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     209 
                   
                   ] 
                 
               
             
           
         
       
     
     Note that γ i  and y{right arrow over ( )} i :=y i,i′  (i′=1, . . . , n) are defined by Formula 210. 
     
       
         
           
             
               
                 
                   
                     
                       γ 
                       i 
                     
                     , 
                     
                       
                         
                           y 
                           → 
                         
                         i 
                       
                       := 
                       
                         
                           ( 
                           
                             
                               y 
                               
                                 i 
                                 , 
                                 1 
                               
                             
                             , 
                             … 
                             , 
                             
                               y 
                               
                                 i 
                                 , 
                                 n 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         are 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         defined 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         as 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   if 
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         i 
                         ∈ 
                         
                           I 
                           ⋀ 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         γ 
                         i 
                       
                       := 
                       
                         α 
                         i 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           y 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         { 
                         
                           
                             
                               
                                 y 
                                 → 
                               
                               i 
                             
                             ❘ 
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               · 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                           
                           = 
                           
                             
                               0 
                               ⋀ 
                               
                                 y 
                                 
                                   i 
                                   , 
                                   1 
                                 
                               
                             
                             = 
                             
                               β 
                               i 
                             
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     if 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         i 
                         ∈ 
                         
                           I 
                           ⋀ 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         γ 
                         i 
                       
                       := 
                       
                         
                           α 
                           i 
                         
                         
                           
                             
                               v 
                               → 
                             
                             i 
                           
                           · 
                           
                             
                               x 
                               → 
                             
                             i 
                           
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           y 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         { 
                         
                           
                             
                               
                                 y 
                                 → 
                               
                               i 
                             
                             ❘ 
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               · 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                           
                           = 
                           
                             β 
                             i 
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     if 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         i 
                         ∉ 
                         
                           I 
                           ⋀ 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         γ 
                         i 
                       
                       := 
                       0 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           y 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         { 
                         
                           
                             
                               
                                 y 
                                 → 
                               
                               i 
                             
                             ❘ 
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               · 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                           
                           = 
                           
                             
                               0 
                               ⋀ 
                               
                                 y 
                                 
                                   i 
                                   , 
                                   1 
                                 
                               
                             
                             = 
                             
                               β 
                               i 
                             
                           
                         
                         } 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     if 
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         i 
                         ∉ 
                         
                           I 
                           ⋀ 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         γ 
                         i 
                       
                       := 
                       0 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           y 
                           → 
                         
                         i 
                       
                       ⁢ 
                       
                         ⟵ 
                         U 
                       
                       ⁢ 
                       
                         { 
                         
                           
                             
                               
                                 y 
                                 → 
                               
                               i 
                             
                             ❘ 
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               · 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                           
                           = 
                           
                             β 
                             i 
                           
                         
                         } 
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     210 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the signature element generation unit  542  also generates a signature element s* L+1  which is an element of the signature data sig, as indicated in Formula 211.
 
 s*   L+1 :=ξ( k*   d+1,1   +H   hk   λ,D ( m ∥ )· k*   d+1,2 )+ r*   L+1   [Formula 211]
 
     Note that r* L+1  is defined by Formula 212. 
     
       
         
           
             
               
                 
                   
                     
                       r 
                       
                         L 
                         + 
                         1 
                       
                       * 
                     
                     ⁢ 
                     
                       ⟵ 
                       U 
                     
                     ⁢ 
                     span 
                   
                   ⁢ 
                   
                     〈 
                     
                       
                         b 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           
                             2 
                             + 
                             
                               u 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                             + 
                             1 
                           
                         
                         * 
                       
                       , 
                       … 
                       ⁢ 
                       
                           
                       
                       , 
                       
                         b 
                         
                           
                             d 
                             + 
                             1 
                           
                           , 
                           
                             2 
                             + 
                             
                               u 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                             + 
                             
                               w 
                               
                                 d 
                                 + 
                                 1 
                               
                             
                           
                         
                         * 
                       
                     
                     〉 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     212 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1507 : Data Transmission Step) 
     Using the communication device and via the network, for example, the data transmission unit  550  transmits the signature data sig including the signature element s* 0 , the signature element s* i  (i=1, . . . , L), the signature element s* L+1 , the message m, and the access structure S:=(M, ρ) to the verification device  600 . As a matter of course, the signature data sig may be transmitted to the verification device  600  by another method. 
     In brief, in (S 1501 ) through (S 1506 ), the signature device  500  executes the Sig algorithm indicated in Formula 213, and thus generates the signature data sig. In (S 1507 ), the signature device  500  transmits the generated signature data sig to the verification device  600 . 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         Sig 
                         ⁡ 
                         
                           ( 
                           
                             pk 
                             , 
                             
                               sk 
                               Γ 
                             
                             , 
                             m 
                             , 
                             
                               := 
                               
                                 ( 
                                 
                                   M 
                                   , 
                                   ρ 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                       ⁢ 
                       
                         : 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           If 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 M 
                                 , 
                                 ρ 
                               
                               ) 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             accepts 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             Γ 
                           
                           := 
                           
                             { 
                             
                               ( 
                               
                                 t 
                                 , 
                                 
                                   
                                     x 
                                     → 
                                   
                                   t 
                                 
                               
                               ) 
                             
                             } 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         then 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         compute 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         I 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         and 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             { 
                             
                               α 
                               i 
                             
                             } 
                           
                           
                             i 
                             ∈ 
                             I 
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         such 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         that 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           ∑ 
                           
                             i 
                             ∈ 
                             I 
                           
                           
                               
                           
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             α 
                             i 
                           
                           ⁢ 
                           
                             M 
                             i 
                           
                         
                       
                       := 
                       
                         1 
                         → 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     and 
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         I 
                         ⊆ 
                         
                           { 
                           
                             
                               i 
                               ∈ 
                               
                                 { 
                                 
                                   1 
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   L 
                                 
                                 } 
                               
                             
                             ❘ 
                             
                               
                                 [ 
                                 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                   = 
                                   
                                     
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                         ⋀ 
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                       
                                       ∈ 
                                       
                                         
                                           Γ 
                                           ⋀ 
                                           
                                             
                                               v 
                                               → 
                                             
                                             i 
                                           
                                         
                                         · 
                                         
                                           
                                             x 
                                             → 
                                           
                                           t 
                                         
                                       
                                     
                                     = 
                                     0 
                                   
                                 
                                 ] 
                               
                               ⋁ 
                               
                                 [ 
                                 
                                   
                                     ρ 
                                     ⁡ 
                                     
                                       ( 
                                       i 
                                       ) 
                                     
                                   
                                   = 
                                   
                                     ⫬ 
                                     
                                       
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           ) 
                                         
                                         ⋀ 
                                         
                                           ( 
                                           
                                             t 
                                             , 
                                             
                                               
                                                 x 
                                                 → 
                                               
                                               t 
                                             
                                           
                                           ) 
                                         
                                       
                                       ∈ 
                                       
                                         
                                           
                                             Γ 
                                             ⋀ 
                                             
                                               
                                                 v 
                                                 → 
                                               
                                               i 
                                             
                                           
                                           · 
                                           
                                             
                                               x 
                                               → 
                                             
                                             t 
                                           
                                         
                                         ≠ 
                                         0 
                                       
                                     
                                   
                                 
                                 ] 
                               
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ξ 
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           x 
                         
                       
                       , 
                       
                         
                           ( 
                           
                             β 
                             i 
                           
                           ) 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           { 
                           
                             
                               
                                 ( 
                                 
                                   
                                     β 
                                     1 
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     β 
                                     L 
                                   
                                 
                                 ) 
                               
                               ❘ 
                               
                                 
                                   ∑ 
                                   
                                     i 
                                     = 
                                     1 
                                   
                                   L 
                                 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     β 
                                     i 
                                   
                                   ⁢ 
                                   
                                     M 
                                     i 
                                   
                                 
                               
                             
                             = 
                             
                               0 
                               → 
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           0 
                           * 
                         
                         := 
                         
                           
                             ξ 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               k 
                               0 
                               * 
                             
                           
                           + 
                           
                             r 
                             0 
                             * 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         where 
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             r 
                             0 
                             * 
                           
                           ⁢ 
                           
                             ← 
                             U 
                           
                           ⁢ 
                           
                             span 
                             ⁢ 
                             
                               〈 
                               
                                 
                                   b 
                                   
                                     0 
                                     , 
                                     
                                       1 
                                       + 
                                       
                                         u 
                                         0 
                                       
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   b 
                                   
                                     0 
                                     , 
                                     
                                       1 
                                       + 
                                       
                                         u 
                                         0 
                                       
                                       + 
                                       
                                         w 
                                         0 
                                       
                                     
                                   
                                   * 
                                 
                               
                               〉 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           i 
                           * 
                         
                         := 
                         
                           
                             
                               
                                 γ 
                                 i 
                               
                               · 
                               ξ 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               k 
                               t 
                               * 
                             
                           
                           + 
                           
                             
                               ∑ 
                               
                                 t 
                                 = 
                                 1 
                               
                               n 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 y 
                                 
                                   i 
                                   , 
                                   t 
                                 
                               
                               · 
                               
                                 b 
                                 
                                   t 
                                   , 
                                   i 
                                 
                                 * 
                               
                             
                           
                           + 
                           
                             r 
                             i 
                             * 
                           
                         
                       
                       , 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           1 
                         
                         ≤ 
                         i 
                         ≤ 
                         L 
                       
                       , 
                       
                           
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         where 
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           
                             r 
                             i 
                             * 
                           
                           ⁢ 
                           
                             ← 
                             U 
                           
                           ⁢ 
                           
                             span 
                             ⁢ 
                             
                               〈 
                               
                                 
                                   b 
                                   
                                     t 
                                     , 
                                     
                                       2 
                                       + 
                                       n 
                                       + 
                                       u 
                                       + 
                                       1 
                                     
                                   
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   b 
                                   
                                     t 
                                     , 
                                     
                                       2 
                                       + 
                                       n 
                                       + 
                                       u 
                                       + 
                                       w 
                                     
                                   
                                   * 
                                 
                               
                               〉 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         and 
                         ⁢ 
                         
                           
 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           γ 
                           i 
                         
                       
                       , 
                       
                         
                           
                             y 
                             → 
                           
                           i 
                         
                         := 
                         
                           
                             
                               
                                 ( 
                                 
                                   
                                     y 
                                     
                                       i 
                                       , 
                                       1 
                                     
                                   
                                   , 
                                   … 
                                   ⁢ 
                                   
                                       
                                   
                                   , 
                                   
                                     y 
                                     
                                       i 
                                       , 
                                       n 
                                     
                                   
                                 
                                 ) 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               are 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               defined 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               as 
                               ⁢ 
                               
                                 
 
                               
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               if 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               i 
                             
                             ∈ 
                             
                               I 
                               ⋀ 
                               
                                 ρ 
                                 ⁡ 
                                 
                                   ( 
                                   i 
                                   ) 
                                 
                               
                             
                           
                           = 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
                           γ 
                           i 
                         
                         := 
                         
                           α 
                           i 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             y 
                             → 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           { 
                           
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               ❘ 
                               
                                 
                                   
                                     y 
                                     → 
                                   
                                   i 
                                 
                                 · 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                             
                             = 
                             
                               
                                 0 
                                 ⋀ 
                                 
                                   y 
                                   
                                     i 
                                     , 
                                     1 
                                   
                                 
                               
                               = 
                               
                                 β 
                                 i 
                               
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                           ∈ 
                           
                             I 
                             ⋀ 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                         
                         = 
                         
                           ⫬ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           γ 
                           i 
                         
                         := 
                         
                           
                             α 
                             i 
                           
                           
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                             · 
                             
                               
                                 x 
                                 → 
                               
                               t 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             y 
                             → 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           { 
                           
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               ❘ 
                               
                                 
                                   
                                     y 
                                     → 
                                   
                                   i 
                                 
                                 · 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                             
                             = 
                             
                               β 
                               i 
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                           ∉ 
                           
                             I 
                             ⋀ 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                         
                         = 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
                           γ 
                           i 
                         
                         := 
                         0 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             y 
                             ← 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           { 
                           
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               ❘ 
                               
                                 
                                   
                                     y 
                                     → 
                                   
                                   i 
                                 
                                 · 
                                 
                                   v 
                                   i 
                                 
                               
                             
                             = 
                             
                               
                                 0 
                                 ⋀ 
                                 
                                   y 
                                   
                                     i 
                                     , 
                                     1 
                                   
                                 
                               
                               = 
                               
                                 β 
                                 i 
                               
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             i 
                           
                           ∉ 
                           
                             I 
                             ⋀ 
                             
                               ρ 
                               ⁡ 
                               
                                 ( 
                                 i 
                                 ) 
                               
                             
                           
                         
                         = 
                         
                           ⫬ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           γ 
                           i 
                         
                         := 
                         0 
                       
                       , 
                       
                         
                           
                             y 
                             → 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           { 
                           
                             
                               
                                 
                                   y 
                                   → 
                                 
                                 i 
                               
                               ❘ 
                               
                                 
                                   
                                     y 
                                     → 
                                   
                                   i 
                                 
                                 · 
                                 
                                   
                                     v 
                                     → 
                                   
                                   i 
                                 
                               
                             
                             = 
                             
                               β 
                               i 
                             
                           
                           } 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           
                             L 
                             + 
                             1 
                           
                           * 
                         
                         := 
                         
                           ξ 
                           ( 
                           
                             
                               
                                 k 
                                 
                                   
                                     d 
                                     + 
                                     1 
                                   
                                   , 
                                   1 
                                 
                                 * 
                               
                               + 
                               
                                 
                                   H 
                                   hk 
                                   
                                     λ 
                                     , 
                                     D 
                                   
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     m 
                                     ⁢ 
                                     
                                       
                                          
                                         ) 
                                       
                                       · 
                                       
                                         k 
                                         
                                           
                                             d 
                                             + 
                                             1 
                                           
                                           , 
                                           2 
                                         
                                         * 
                                       
                                     
                                   
                                   ) 
                                 
                               
                               + 
                               
                                 r 
                                 
                                   L 
                                   + 
                                   1 
                                 
                                 * 
                               
                             
                             , 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 where 
                                 ⁢ 
                                 
                                   
 
                                 
                                 ⁢ 
                                 
                                   r 
                                   
                                     L 
                                     + 
                                     1 
                                   
                                   * 
                                 
                               
                               ⁢ 
                               
                                 ← 
                                 U 
                               
                               ⁢ 
                               
                                 span 
                                 ⁢ 
                                 
                                   〈 
                                   
                                     
                                       b 
                                       
                                         
                                           d 
                                           + 
                                           1 
                                         
                                         , 
                                         
                                           2 
                                           + 
                                           
                                             u 
                                             
                                               d 
                                               + 
                                               1 
                                             
                                           
                                           + 
                                           1 
                                         
                                       
                                     
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       
                                         b 
                                         
                                           
                                             d 
                                             + 
                                             1 
                                           
                                           , 
                                           
                                             2 
                                             + 
                                             
                                               u 
                                               
                                                 d 
                                                 + 
                                                 1 
                                               
                                             
                                           
                                         
                                         * 
                                       
                                       + 
                                       
                                         w 
                                         
                                           d 
                                           + 
                                           1 
                                         
                                       
                                     
                                   
                                   〉 
                                 
                               
                             
                             , 
                             
                               
 
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               
                                 return 
                                 ⁢ 
                                 
                                     
                                 
                                 ⁢ 
                                 
                                   
                                     s 
                                     → 
                                   
                                   * 
                                 
                               
                               := 
                               
                                 
                                   ( 
                                   
                                     
                                       s 
                                       0 
                                       * 
                                     
                                     , 
                                     … 
                                     ⁢ 
                                     
                                         
                                     
                                     , 
                                     
                                       s 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                       * 
                                     
                                   
                                   ) 
                                 
                                 . 
                               
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     213 
                   
                   ] 
                 
               
             
           
         
       
     
     The function and operation of the verification device  600  will be described. 
     The verification device  600  includes a public parameter acquisition unit  610 , a data receiving unit  620 , a verification data generation unit  630 , and a pairing operation unit  640 . The verification data generation unit  630  includes an f vector generation unit  631 , an s vector generation unit  632 , a random number generation unit  633 , and a verification element generation unit  634 . 
     With reference to  FIG. 37 , the process of the Ver algorithm will be described. 
     (S 1601 : Public Parameter Acquisition Step) 
     Using the communication device and via the network, for example, the public parameter acquisition unit  610  obtains the public parameter pk generated by the key generation device  100 . 
     (S 1602 : Signature Data Reception Step) 
     Using the communication device and via the network, for example, the data receiving unit  620  receives the signature data sig transmitted by the signature device  500 . 
     (S 1603 : f Vector Generation Step) 
     Using the processing device, the f vector generation unit  631  randomly generates a vector f{right arrow over ( )} having r pieces of elements, as indicated in Formula 214. 
     
       
         
           
             
               
                 
                   
                     f 
                     → 
                   
                   ⁢ 
                   
                     ← 
                     U 
                   
                   ⁢ 
                   
                     q 
                     r 
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     214 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1604 : s Vector Generation Step) 
     Using the processing device and based on the (L rows×r columns) matrix M of the access structure S included in the signature data sig received in (S 1602 ) and the vector f{right arrow over ( )} having r pieces of elements generated in (S 1603 ), the s vector generation unit  632  generates a vector s{right arrow over ( )} T , as indicated in Formula 215.
 
 {right arrow over (s)}   T :=( s   1   , . . . ,s   L ) T   :=M·{right arrow over (f)}   T   [Formula 215]
 
     Using the processing device and based on the vector f{right arrow over ( )} generated in (S 1603 ), the s vector generation unit  632  also generates a value s 0 , as indicated in Formula 216. Note that 1{right arrow over ( )} is a vector which has a value 1 in all its elements.
 
 s   0 :={right arrow over (1)} ·{right arrow over (f)}   T   [Formula 216]
 
     (S 1605 : Random Number Generation Step) 
     Using the processing device, the random number generation unit  633  generates random numbers, as indicated in Formula 217. 
     
       
         
           
             
               
                 
                   
                     
                       
                         η 
                         → 
                       
                       0 
                     
                     := 
                     
                       η 
                       
                         0 
                         , 
                         1 
                       
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     
                       η 
                       
                         0 
                         , 
                         
                           z 
                           0 
                         
                       
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                       
                         z 
                         0 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         η 
                         → 
                       
                       
                         L 
                         + 
                         1 
                       
                     
                     := 
                     
                       η 
                       
                         
                           L 
                           + 
                           1 
                         
                         , 
                         1 
                       
                     
                   
                   , 
                   … 
                   ⁢ 
                   
                       
                   
                   , 
                   
                     
                       η 
                       
                         
                           L 
                           + 
                           1 
                         
                         , 
                         
                           z 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                       
                         z 
                         
                           d 
                           + 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     θ 
                     
                       L 
                       + 
                       1 
                     
                   
                   , 
                   
                     
                       s 
                       
                         L 
                         + 
                         1 
                       
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       for 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       1 
                     
                     ≤ 
                     i 
                     ≤ 
                     L 
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       
                         ( 
                         
                           t 
                           , 
                           
                             
                               v 
                               → 
                             
                             i 
                           
                         
                         ) 
                       
                       ⁢ 
                       
                         μ 
                         i 
                       
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       θ 
                       i 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                       z 
                     
                   
                   , 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       if 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         ρ 
                         ⁡ 
                         
                           ( 
                           i 
                           ) 
                         
                       
                     
                     = 
                     
                       ⫬ 
                       
                         
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             μ 
                             i 
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       i 
                     
                     ⁢ 
                     
                       ← 
                       U 
                     
                     ⁢ 
                     
                       q 
                       z 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     217 
                   
                   ] 
                 
               
             
           
         
       
     
     (S 1606 : Verification Element Generation Step) 
     Using the processing device, the verification element generation unit  634  generates a verification element c 0  which is an element of a verification key, as indicated in Formula 218. 
     
       
         
           
             
               
                 
                   
                     c 
                     0 
                   
                   := 
                   
                     
                       ( 
                       
                         
                           
                             - 
                             
                               s 
                               0 
                             
                           
                           - 
                           
                             s 
                             
                               L 
                               + 
                               1 
                             
                           
                         
                         , 
                         
                           
                             0 
                             
                               u 
                               0 
                             
                           
                           
                             ︷ 
                             
                               u 
                               0 
                             
                           
                         
                         , 
                         
                           
                             0 
                             
                               w 
                               0 
                             
                           
                           
                             ︷ 
                             
                               w 
                               0 
                             
                           
                         
                         , 
                         
                           
                             
                               η 
                               → 
                             
                             0 
                           
                           
                             ︷ 
                             
                               z 
                               0 
                             
                           
                         
                       
                       ) 
                     
                     ⁢ 
                     
                       0 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     218 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the verification element generation unit  634  also generates a verification element c i  which is an element of the verification key for each integer i=1, . . . , L, as indicated in Formula 219. 
     
       
         
           
             
               
                 
                   
                     
                       
                         for 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         1 
                       
                       ≤ 
                       i 
                       ≤ 
                       L 
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ( 
                         
                           t 
                           , 
                           
                             v 
                             i 
                           
                         
                         ) 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           i 
                           * 
                         
                       
                       ∉ 
                       
                         t 
                       
                     
                     , 
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       0 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         else 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           c 
                           i 
                         
                       
                       := 
                       
                         
                           ( 
                           
                             
                               
                                 
                                   
                                     
                                       μ 
                                       i 
                                     
                                     ⁡ 
                                     
                                       ( 
                                       
                                         t 
                                         , 
                                         
                                           - 
                                           1 
                                         
                                       
                                       ) 
                                     
                                   
                                   , 
                                   
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         e 
                                         1 
                                       
                                     
                                     + 
                                     
                                       
                                         θ 
                                         i 
                                       
                                       ⁢ 
                                       
                                         v 
                                         → 
                                       
                                     
                                   
                                 
                                 
                                   ︷ 
                                   
                                     2 
                                     + 
                                     n 
                                   
                                 
                               
                               i 
                             
                             , 
                             
                               
                                 0 
                                 u 
                               
                               
                                 ︷ 
                                 u 
                               
                             
                             , 
                             
                               
                                 0 
                                 w 
                               
                               
                                 ︷ 
                                 w 
                               
                             
                             , 
                             
                               
                                 η 
                                 → 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           ρ 
                           ⁡ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                       
                       = 
                       
                         ⫬ 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       
                         if 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           s 
                           i 
                           * 
                         
                       
                       ∉ 
                       
                         t 
                       
                     
                     , 
                     
                       return 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       0 
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       else 
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         c 
                         i 
                       
                     
                     := 
                     
                       
                         ( 
                         
                           
                             
                               
                                 
                                   
                                     μ 
                                     i 
                                   
                                   ⁡ 
                                   
                                     ( 
                                     
                                       t 
                                       , 
                                       
                                         - 
                                         1 
                                       
                                     
                                     ) 
                                   
                                 
                                 , 
                                 
                                   
                                     s 
                                     i 
                                   
                                   ⁢ 
                                   
                                     v 
                                     → 
                                   
                                 
                               
                               
                                 ︷ 
                                 
                                   2 
                                   + 
                                   n 
                                 
                               
                             
                             i 
                           
                           , 
                           
                             
                               0 
                               u 
                             
                             
                               ︷ 
                               u 
                             
                           
                           , 
                           
                             
                               0 
                               w 
                             
                             
                               ︷ 
                               w 
                             
                           
                           , 
                           
                             
                               
                                 η 
                                 → 
                               
                               
                                 ︷ 
                                 z 
                               
                             
                             i 
                           
                         
                         ) 
                       
                       ⁢ 
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     219 
                   
                   ] 
                 
               
             
           
         
       
     
     Using the processing device, the verification element generation unit  634  also generates a verification element c L+1  which is an element of the verification key, as indicated in Formula 220. 
     
       
         
           
             
                 
             
             ⁢ 
             
               [ 
               
                 Formula 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 220 
               
               ] 
             
           
         
       
       
         
           
             
               c 
               
                 L 
                 + 
                 1 
               
             
             := 
             
               
                 ( 
                 
                   
                     
                       
                         
                           s 
                           
                             L 
                             + 
                             1 
                           
                         
                         - 
                         
                           
                             θ 
                             
                               L 
                               + 
                               1 
                             
                           
                           ⁢ 
                           
                             
                               H 
                               hk 
                               
                                 λ 
                                 , 
                                 D 
                               
                             
                             ( 
                             
                               
                                 m 
                                 ⁢ 
                                 
                                    
                                   ) 
                                 
                               
                               , 
                               
                                 θ 
                                 
                                   L 
                                   + 
                                   1 
                                 
                               
                               , 
                             
                           
                         
                       
                       
                         ︷ 
                         2 
                       
                     
                     ⁢ 
                     
                       
                         0 
                         
                           u 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                       
                         ︷ 
                         
                           u 
                           
                             d 
                             + 
                             1 
                           
                         
                       
                     
                   
                   , 
                   
                     
                       0 
                       
                         w 
                         
                           d 
                           + 
                           1 
                         
                       
                     
                     
                       ︷ 
                       
                         w 
                         
                           d 
                           + 
                           1 
                         
                       
                     
                   
                   , 
                   
                     
                       
                         η 
                         → 
                       
                       
                         L 
                         + 
                         1 
                       
                     
                     
                       ︷ 
                       
                         z 
                         
                           d 
                           + 
                           1 
                         
                       
                     
                   
                 
                 ) 
               
               ⁢ 
               
                 
                   d 
                   + 
                   1 
                 
               
             
           
         
       
     
     (S 1607 : First Pairing Operation Step) 
     Using the processing device, the pairing operation unit  640  computes a pairing operation e (b 0,1 , s* 0 ). 
     If the result of computing the pairing operation e (b 0,1 , s* 0 ) is a value 1, the pairing operation unit  640  outputs a value 0 indicating failure of verification of the signature and ends the process. If the result of computing the pairing operation e (b 0,1 , s* 0 ) is other than a value 1, the pairing operation unit  640  advances the process to S 1608 . 
     (S 1608 : Second Pairing Operation Step) 
     Using the processing device, the pairing operation unit  640  computes a pairing operation indicated in Formula 221.
 
Π i=0   L+1   e ( c   i   ,s*   i )  [Formula 221]
 
     If the result of computing the pairing operation indicated in Formula 221 is a value 1, the pairing operation unit  640  outputs a value 1 indicating success of verification of the signature. If the result is any other value, the pairing operation unit  640  outputs a value 0 indicating failure of verification of the signature. 
     In brief, in (S 1601 ) through (S 1608 ), the verification device  600  executes the Ver algorithm indicated in Formula 222, and thus verifies the signature data sig. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     
                       Ver 
                       ⁡ 
                       
                         ( 
                         
                           pk 
                           , 
                           m 
                           , 
                           
                             := 
                             
                               ( 
                               
                                 M 
                                 , 
                                 ρ 
                               
                               ) 
                             
                           
                           , 
                           
                             
                               s 
                               → 
                             
                             * 
                           
                         
                         ) 
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           f 
                           → 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           r 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             s 
                             → 
                           
                           T 
                         
                         := 
                         
                           
                             
                               ( 
                               
                                 
                                   s 
                                   1 
                                 
                                 , 
                                 … 
                                 ⁢ 
                                 
                                     
                                 
                                 , 
                                 
                                   s 
                                   L 
                                 
                               
                               ) 
                             
                             T 
                           
                           := 
                           
                             M 
                             · 
                             
                               
                                 f 
                                 → 
                               
                               T 
                             
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           s 
                           0 
                         
                         := 
                         
                           
                             1 
                             → 
                           
                           · 
                           
                             
                               f 
                               → 
                             
                             T 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           
                             η 
                             → 
                           
                           0 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           
                             z 
                             0 
                           
                         
                       
                       , 
                       
                         
                           
                             η 
                             → 
                           
                           
                             L 
                             + 
                             1 
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           
                             z 
                             
                               d 
                               + 
                               1 
                             
                           
                         
                       
                       , 
                       
                         
                           
                             θ 
                             
                               L 
                               + 
                               1 
                             
                           
                           ⁢ 
                           
                             s 
                             
                               L 
                               + 
                               1 
                             
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           c 
                           0 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   - 
                                   
                                     s 
                                     0 
                                   
                                 
                                 - 
                                 
                                   s 
                                   
                                     L 
                                     + 
                                     1 
                                   
                                 
                               
                               , 
                               
                                 
                                   0 
                                   
                                     u 
                                     0 
                                   
                                 
                                 
                                   ︷ 
                                   
                                     u 
                                     0 
                                   
                                 
                               
                               , 
                               
                                 
                                   0 
                                   
                                     w 
                                     0 
                                   
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     0 
                                   
                                 
                               
                               , 
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   0 
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     0 
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             0 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           for 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           1 
                         
                         ≤ 
                         i 
                         ≤ 
                         L 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           ρ 
                           ⁢ 
                           
                             ( 
                             i 
                             ) 
                           
                         
                         = 
                         
                           ( 
                           
                             t 
                             , 
                             
                               
                                 v 
                                 → 
                               
                               i 
                             
                           
                           ) 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             s 
                             i 
                             * 
                           
                         
                         ∉ 
                         
                           t 
                         
                       
                       , 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         0 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         else 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           μ 
                           i 
                         
                       
                       , 
                       
                         
                           θ 
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
                           
                             η 
                             → 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           z 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           c 
                           i 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     
                                       
                                         μ 
                                         i 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             - 
                                             1 
                                           
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       
                                         
                                           s 
                                           i 
                                         
                                         ⁢ 
                                         
                                           e 
                                           1 
                                         
                                       
                                       + 
                                       
                                         
                                           θ 
                                           i 
                                         
                                         ⁢ 
                                         
                                           v 
                                           → 
                                         
                                       
                                     
                                   
                                   
                                     ︷ 
                                     
                                       2 
                                       + 
                                       n 
                                     
                                   
                                 
                                 i 
                               
                               , 
                               
                                 
                                   0 
                                   u 
                                 
                                 
                                   ︷ 
                                   u 
                                 
                               
                               , 
                               
                                 
                                   0 
                                   w 
                                 
                                 
                                   ︷ 
                                   w 
                                 
                               
                               , 
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   ︷ 
                                   z 
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             ρ 
                             ⁡ 
                             
                               ( 
                               i 
                               ) 
                             
                           
                         
                         = 
                         
                           ⫬ 
                           
                             ( 
                             
                               t 
                               , 
                               
                                 
                                   v 
                                   → 
                                 
                                 i 
                               
                             
                             ) 
                           
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             s 
                             i 
                             * 
                           
                         
                         ∉ 
                         
                           t 
                         
                       
                       , 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         0 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           else 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             μ 
                             i 
                           
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                         
                       
                       , 
                       
                         
                           
                             η 
                             → 
                           
                           i 
                         
                         ⁢ 
                         
                           ← 
                           U 
                         
                         ⁢ 
                         
                           q 
                           z 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           c 
                           i 
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     
                                       
                                         μ 
                                         i 
                                       
                                       ⁡ 
                                       
                                         ( 
                                         
                                           t 
                                           , 
                                           
                                             - 
                                             1 
                                           
                                         
                                         ) 
                                       
                                     
                                     , 
                                     
                                       
                                         s 
                                         i 
                                       
                                       ⁢ 
                                       
                                         v 
                                         → 
                                       
                                     
                                   
                                   
                                     ︷ 
                                     
                                       2 
                                       + 
                                       n 
                                     
                                   
                                 
                                 i 
                               
                               , 
                               
                                 
                                   0 
                                   u 
                                 
                                 
                                   ︷ 
                                   u 
                                 
                               
                               , 
                               
                                 
                                   0 
                                   w 
                                 
                                 
                                   ︷ 
                                   w 
                                 
                               
                               , 
                               
                                 
                                   η 
                                   → 
                                 
                                 
                                   ︷ 
                                   z 
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                         
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                         
                           c 
                           
                             L 
                             + 
                             1 
                           
                         
                         := 
                         
                           
                             ( 
                             
                               
                                 
                                   
                                     
                                       s 
                                       
                                         L 
                                         + 
                                         1 
                                       
                                     
                                     - 
                                     
                                       
                                         θ 
                                         
                                           L 
                                           + 
                                           1 
                                         
                                       
                                       ⁢ 
                                       
                                         
                                           H 
                                           hk 
                                           
                                             λ 
                                             , 
                                             D 
                                           
                                         
                                         ( 
                                         
                                           
                                             m 
                                             ⁢ 
                                             
                                                
                                               ) 
                                             
                                           
                                           , 
                                           
                                             θ 
                                             
                                               L 
                                               + 
                                               1 
                                             
                                           
                                           , 
                                         
                                       
                                     
                                   
                                   
                                     ︷ 
                                     2 
                                   
                                 
                                 ⁢ 
                                 
                                   
                                     0 
                                     
                                       u 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                   
                                     ︷ 
                                     
                                       u 
                                       
                                         d 
                                         + 
                                         1 
                                       
                                     
                                   
                                 
                               
                               , 
                               
                                 
                                   0 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                                 
                                   ︷ 
                                   
                                     w 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                               , 
                               
                                 
                                   
                                     η 
                                     → 
                                   
                                   
                                     L 
                                     + 
                                     1 
                                   
                                 
                                 
                                   ︷ 
                                   
                                     z 
                                     
                                       d 
                                       + 
                                       1 
                                     
                                   
                                 
                               
                             
                             ) 
                           
                           ⁢ 
                           
                             
                               d 
                               + 
                               1 
                             
                           
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           0 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             e 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   b 
                                   
                                     0 
                                     , 
                                     1 
                                   
                                 
                                 , 
                                 
                                   s 
                                   0 
                                   * 
                                 
                               
                               ) 
                             
                           
                         
                         = 
                         1 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         
                           return 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           1 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           if 
                           ⁢ 
                           
                               
                           
                           ⁢ 
                           
                             
                               ∏ 
                               
                                 i 
                                 = 
                                 0 
                               
                               
                                 L 
                                 + 
                                 1 
                               
                             
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     i 
                                   
                                   , 
                                   
                                     s 
                                     i 
                                     * 
                                   
                                 
                                 ) 
                               
                             
                           
                         
                         = 
                         1 
                       
                       , 
                       
                         
 
                       
                       ⁢ 
                       
                           
                       
                       ⁢ 
                       
                         return 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         0 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           otherwise 
                           . 
                         
                       
                     
                   
                 
               
               
                 
                   [ 
                   
                     Formula 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     222 
                   
                   ] 
                 
               
             
           
         
       
     
     As described above, as in the cryptographic systems  10  according to Embodiments 2 to 4, in the cryptographic system  10  according to Embodiment 5, the index parts are provided, so that the bases that are used for every attribute category can be constructed as the common bases (basis B and basis B*). As a result, only the basis B and the basis B* need to be included in a public parameter, eliminating the need for reissuing the public parameter when an attribute category is to be added at a later stage. 
     As in Embodiments 2 to 4, for the index parts, it is required that 0 be obtained as a result of an inner-product operation of the index parts. Therefore, although the 2-dimensional index parts, namely the basis vectors b* 1  and b* 2  and the basis vectors b 1  and b 2 , are employed in the above description, the index parts are not limited to 2-dimensional and may be 3-dimensional or higher-dimensional. The values assigned to the index parts are not limited to those described above, and a different assignment arrangement may be employed. 
     The signature scheme based on the functional encryption scheme has been described above. However, as explained in Embodiment 3 that the functional encryption scheme can be modified into an attribute-based encryption scheme, so the signature scheme based on the functional encryption scheme can be modified into a signature scheme based on the attribute-based encryption scheme. 
     Embodiment 6 
     This embodiment describes a multi-authority functional encryption scheme and a multi-authority signature scheme. 
     Multi-authority signifies the presence of a plurality of authorities who generate the user&#39;s decryption key (or signature key). 
     In an ordinary functional encryption, the security of the whole system depends on one certain party (authority). For example, in the cryptographic system  10  described in Embodiment 2 or 3, the security of the whole system depends on the key generation device  100 . If the master secret key sk which is the secret key of the key generation device  100  is compromised, the security of the whole system will be broken. 
     With the multi-authority scheme, however, even if the security of some authority is broken or the secret key (master key) of some authority is compromised, only part of the system stops functioning, and the remaining portion of the system can function properly. 
       FIG. 38  is an explanatory drawing of the multi-authority. In  FIG. 38 , a narrowly-defined cryptographic process is used as an example. 
     In  FIG. 38 , a government office manages attributes such as address, telephone number, and age. The police manage attributes such as type of driver&#39;s license. Company A manages attributes such as position in Company A and belonging department in Company A. A decryption key 1 associated with the attributes managed by the government office is issued by the government office. A decryption key 2 associated with the attributes managed by the police is issued by the police. A decryption key 3 associated with the attributes managed by Company A is issued by Company A. 
     A decryptor who decrypts a ciphertext decrypts the ciphertext using a decryption key formed by putting together the decryption keys 1, 2, and 3 issued by the respective authorities such as the government office, the police, and Company A. That is, when seen from the decryptor, a decryption key formed by putting together the decryption keys issued by the respective authorities is the single decryption key issued to him or her. 
     For example, in a case where the master key of Company A is compromised, although the cryptographic processing system does not function regarding the attributes of Company A, it functions regarding the attributes managed by the other authorities. That is, concerning the attributes managed by Company A there is a risk of decryption by a user having attributes other than the specified attributes. However, concerning attributes other than those managed by Company A, decryption is possible only by a user having the specified attributes. 
     As is seen from the example of  FIG. 38 , according to the functional encryption, it is normal that a plurality of authorities are present, and that each authority manages a certain category (subspace) or definition range in the attributes and issues (a part of) a decryption key regarding the attribute of the user in this category. 
     When any party can serve as an authority and issue (a part of) a decryption key without interacting with the other parties, and each user can obtain (a part of) the decryption key without interacting with the other parties, this scheme is called a decentralized multi-authority scheme. 
     For example, if a central authority exists, the scheme is not decentralized. A central authority is an authority superior to the other authorities. If the security of the central authority is broken, the security of every authority will be broken. 
     Non-Patent Literature 31 describes a decentralized multi-authority functional encryption scheme, and Non-Patent Literature 30 describes a non-decentralized multi-authority signature scheme. As in the case of the encryption scheme and the signature scheme described in the above embodiments, the schemes described in Non-Patent Literature 30 and Non-Patent Literature 31 can be constructed such that there is no need to reissue a public parameter when an attribute category is to be added. 
       FIG. 39  is an explanatory drawing of a functional encryption scheme that allows for addition of an attribute category in a case of multi-authority. 
     In  FIG. 39 , as in  FIG. 38 , a government office manages attributes such as address, telephone number, and age. The police manage attributes such as type of driver&#39;s license. Company A manages attributes such as position in Company A and belonging department in Company A. A decryption key 1 associated with the attributes managed by the government office is issued by the government office. A decryption key 2 associated with the attributes managed by the police is issued by the police. A decryption key 3 associated with the attributes managed by Company A is issued by Company A. 
     Note here that the government office generates a basis B^ 1  and a basis B^* 1  as a public parameter pk and a master secret key sk, respectively. Using the basis B^* 1 , the government office generates the decryption key 1 concerning the attributes such as address, telephone number, and age. Similarly, the police generate a basis B^ 2  and a basis B^* 2  as a public parameter pk and a master secret key sk, respectively. Using the basis B^* 2 , the police generate the decryption key 2 concerning the attributes such as type of driver&#39;s license. Similarly, Company A generates a basis B^ 3  and a basis B^* 3  as a public parameter pk and a master secret key sk, respectively. Using the basis B^* 3 , Company A generates the decryption key 3 concerning the attributes such as position in Company A and belonging department in Company A. 
     A sender generates a ciphertext by setting the attributes such as address, telephone number, and age using the basis B^ 1 , setting the attributes such as type of driver&#39;s license using basis B^ 2 , and setting the attributes such as position in Company A and belonging department in Company A using basis B^ 3 . A decryptor decrypts the ciphertext using the decryption keys 1 to 3. 
     For example, when an attribute category managed by the government office is to be added, the attribute category can be added without reissuing the public parameter pk of the government office. 
     The functional encryption scheme that allows for addition of an attribute category has been described herein. However, the same concept can basically be applied to the signature scheme adapted from the functional encryption scheme. 
     Embodiment 7 
     In the above embodiments, the method for implementing the processes of the cryptographic primitives in the dual vector spaces has been described. In Embodiment 7, a method for implementing the processes of the cryptographic primitives in dual additive groups will be described. 
     More specifically, in the above embodiments, the processes of the cryptographic primitives are implemented in the cyclic group of the prime order q. When a ring R is expressed using a composite M as indicated in Formula 223, the processes of the cryptographic primitives described in the above embodiments can also be applied to an additive group having the ring R as a coefficient.
 
 := / M         [Formula 223]
 
where
 
 : an integer; and
 
M: a composite number
 
     By changing F q  to R in the algorithms described in the above embodiments, the processes of the cryptographic primitives in dual additive groups can be implemented. 
     From the view point of security proof, in the above embodiments, ρ(i) for each integer i=1, . . . , L may be limited to a positive tuple (t, v{right arrow over ( )}) or negative tuple  (t, v{right arrow over ( )}) for respectively different identification information t. 
     In other words, when ρ(i)=(t, v{right arrow over ( )}) or ρ(i)= (t, v{right arrow over ( )}), let a function {tilde over (ρ)} be map of {1, . . . , L}→{1, . . . , d} such that {tilde over (ρ)}(i)=t. In this case, {tilde over (ρ)} may be limited to injection. Note that ρ(i) is ρ(i) in the access structure S:=(M, ρ(i)) described above. 
     A hardware configuration of the cryptographic system  10  (the key generation device  100 , the encryption device  200 , the decryption device  300 , the key delegation device  400 , the signature device  500 , and the verification device  600 ) according to the embodiments will be described. 
       FIG. 40  is a diagram showing an example of a hardware configuration of the key generation device  100 , the encryption device  200 , the decryption device  300 , the key delegation device  400 , the signature device  500 , and the verification device  600 . 
     As shown in  FIG. 40 , each of the key generation device  100 , the encryption device  200 , the decryption device  300 , the key delegation device  400 , the signature device  500 , and the verification device  600  includes the CPU  911  (also referred to as a Central Processing Unit, central processing device, processing device, arithmetic device, microprocessor, microcomputer, or processor) that executes programs. The CPU  911  is connected via a bus  912  to the ROM  913 , the RAM  914 , an LCD  901  (Liquid Crystal Display), the keyboard  902  (K/B), the communication board  915 , and the magnetic disk device  920 , and controls these hardware devices. In place of the magnetic disk device  920  (fixed disk device), a storage device such as an optical disk device or memory card read/write device may be employed. The magnetic disk device  920  is connected via a predetermined fixed disk interface. 
     The ROM  913  and the magnetic disk device  920  are examples of a nonvolatile memory. The RAM  914  is an example of a volatile memory. The ROM  913 , the RAM  914 , and the magnetic disk device  920  are examples of a storage device (memory). The keyboard  902  and the communication board  915  are examples of an input device. The keyboard  902  is an example of a communication device. The LCD  901  is an example of a display device. 
     The magnetic disk device  920 , the ROM  913 , or the like stores an operating system  921  (OS), a window system  922 , programs  923 , and files  924 . The programs  923  are executed by the CPU  911 , the operating system  921 , and the window system  922 . 
     The programs  923  store software and programs that execute the functions described in the above description as the “master key generation unit  110 ”, the “master key storage unit  120 ”, the “information input unit  130 ”, the “decryption key generation unit  140 ”, the “key distribution unit  150 ”, the “public parameter acquisition unit  210 ”, the “information input unit  220 ”, the “cipher data generation unit  230 ”, the “data transmission unit  240 ”, the “decryption key acquisition unit  310 ”, the “data receiving unit  320 ”, the “span program computation unit  330 ”, the “complementary coefficient computation unit  340 ”, the “pairing operation unit  350 ”, the “message computation unit  360 ”, the “decryption key acquisition unit  410 ”, the “information input unit  420 ”, the “delegation key generation unit  430 ”, the “key distribution unit  440 ”, the “signature key acquisition unit  510 ”, the “information input unit  520 ”, the “complementary coefficient computation unit  530 ”, the “signature data generation unit  540 ”, the “data transmission unit  550 ”, the “public parameter acquisition unit  610 ”, the “data receiving unit  620 ”, the “verification data generation unit  630 ”, the “pairing operation unit  640 ”, and the like. The programs  923  store other programs as well. The programs are read and executed by the CPU  911 . 
     The files  924  store information, data, signal values, variable values, and parameters such as the “public parameter pk”, the “master secret key sk”, the “decryption keys sk S  and sk Γ ”, the “ciphertexts ct Γ  and ct S ”, the “access structure S”, the “attribute information”, and the “message m”, as the items of a “file” and “database”. The “file” and “database” are stored in a recording medium such as a disk or memory. The information, data, signal values, variable values, and parameters stored in the recording medium such as the disk or memory are read out to the main memory or cache memory by the CPU  911  through a read/write circuit, and used for operations of the CPU  911  such as extraction, search, look-up, comparison, calculation, computation, processing, output, printing, and display. The information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, or buffer memory during the operations of the CPU  911  including extraction, search, look-up, comparison, calculation, computation, processing, output, printing, and display. 
     The arrows in the flowcharts in the above description mainly indicate input/output of data and signals. The data and signal values are stored in the memory of the RAM  914 , the recording medium such as an optical disk, or in an IC chip. The data and signals are transmitted online via a transmission medium such as the bus  912 , signal lines, or cables, or via electric waves. 
     What is described as “unit” in the above description may be “circuit”, “device”, “equipment”, “means”, or “function”, and may also be “step”, “procedure”, or “process”. What is described as “device” may be “circuit”, “equipment”, “means”, or “function”, and may also be “step”, “procedure”, or “process”. What is described as “process” may be “step”. In other words, what is described as “unit” may be realized by firmware stored in the ROM  913 . Alternatively, what is described as “unit” may be implemented solely by software, or solely by hardware such as an element, a device, a substrate, or a wiring line, or by a combination of software and firmware, or by a combination including firmware. The firmware and software are stored as programs in the recording medium such as the ROM  913 . The programs are read by the CPU  911  and are executed by the CPU  911 . That is, each program causes the computer or the like to function as each “unit” described above. Alternatively, each program causes the computer or the like to execute a procedure or a method of each “unit” described above. 
     REFERENCE SIGNS LIST 
       10 : cryptographic system;  100 : key generation device;  110 : master key generation unit;  120 : master key storage unit;  130 : information input unit;  140 : decryption key generation unit;  141 : f vector generation unit;  142 : s vector generation unit;  143 : random number generation unit;  144 : key element generation unit;  145 : randomizing element generation unit;  146 : delegation element generation unit;  150 : key distribution unit;  200 : encryption device;  210 : public parameter acquisition unit;  220 : information input unit;  230 : cipher data generation unit;  231 : random number generation unit;  232 : cipher element generation unit;  240 : data transmission unit;  300 : decryption device;  310 : decryption key acquisition unit;  320 : data receiving unit;  330 : span program computation unit;  340 : complementary coefficient computation unit;  350 : pairing operation unit;  360 : message computation unit;  400 : key delegation device;  410 : decryption key acquisition unit;  420 : information input unit;  430 : delegation key generation unit;  431 : random number generation unit;  432 : lower-level key element generation unit;  433 : lower-level randomizing element generation unit;  434 : lower-level delegation element generation unit;  440 : key distribution unit;  500 : signature device;  510 : signature key acquisition unit;  520 : information input unit;  530 : complementary coefficient computation unit;  540 : signature data generation unit;  541 : random number generation unit;  542 : signature element generation unit;  550 : data transmission unit;  600 : verification device;  610 : public parameter acquisition unit;  620 : data receiving unit;  630 : verification data generation unit;  631 : f vector generation unit;  632 : s vector generation unit;  633 : random number generation unit;  634 : verification element generation unit;  640 : pairing operation unit