Abstract:
A public-key cryptographic scheme of high efficiency capable of verifying security in a standard model. In order to retain security against adaptive chosen ciphertext attacks, a ciphertext is generated by a combination of a plaintext and random numbers so that an illegal ciphertext input to a (simulated) deciphering oracle is rejected.

Description:
FIELD OF THE INVENTION  
         [0001]    The present invention relates to a public-key cryptographic scheme and cryptographic communications using public-key cryptography.  
         DESCRIPTION OF THE RELATED ART  
         [0002]    Various types of public-key cryptographic schemes have been proposed to date. Of these schemes, the most famous and most practical public-key cryptographic scheme is described in:  
           [0003]    a document 1: “R. L. Rivest, A. Shamir, L. Adleman: A method for obtaining digital signatures and public-key cryptosystems, Commun. of the ACM, Vol. 21, No. 2, pp. 120-126, 1978”.  
           [0004]    Efficient public-key cryptographic schemes using elliptic curves are known as described in:  
           [0005]    a document 2: “V. S. Miller: Use of Elliptic Curves in Cryptography, Proc. of Crypto&#39;85, LNCS218, Sprinter-Verlag, pp. 417-426 (1985);  
           [0006]    a document 3: “N. Koblitz: Elliptic Curve Cryptosystems, Math. Comp., 48, 177, pp. 203-209 (1987)”; and the like.  
           [0007]    Known cryptographic schemes capable of verifying security against chosen plaintext attacks include:  
           [0008]    a document 4: “M. O. Rabin: Digital Signatures and Public-Key Encryptions as Intractable as Factorization, MIT, Technical Report, MIT/LCS/TR-212 (1979)”;  
           [0009]    a document 5: “T. ElGamal: A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms, IEEE Trans. On Information Theory, IT-31, 4, pp. 469-472 (1985)”;  
           [0010]    a document 6: “S. Goldwasser and S. Micali: Probabilistic Encryption, JCSS, 28, 2, pp. 270-299 (1984);  
           [0011]    a document 7: “M. Blum and S. Goldwasser: An Efficient probabilistic public-key encryption scheme which hides all partial information, Proc. of Crypto&#39;84, LNCS196, Springer-Verlag, pp. 289-299 (1985)”;  
           [0012]    a document 8: S. Goldwasser and M. Bellare: Lecture Notes on Cryptography, http://www-cse.ucsd.edu/users/mihir/(1997)”; and  
           [0013]    a document 9: “T. Okamoto and S. Uchiyama: A new Public-Key Cryptosystem as Secure as Factoring, Proc. of Eurocrypt&#39;98, LNCS1403, Springer-Verlag, pp. 308-318 (1998)”.  
           [0014]    Known cryptographic schemes capable of verifying security against chosen ciphertext attacks include:  
           [0015]    a document 10: “D. Dolve, C. Dwork and M. Naor: Non-malleable cryptography, In 23rd Annual ACM Symposium on Theory of Computing, pp. 542-552 (1991)”;  
           [0016]    a document 11: “M. Naor and M. Yung: Public-key cryptosystems probably secure against chosen ciphertext attacks, Proc. of STOC, ACM Press, pp. 427-437 (1990)”;  
           [0017]    a document 12: “M. Bellare and P. Rogaway: Optimal Asymmetric Encryption How to Encrypt with RSA, Proc. of Eurocrypt&#39;94, LNCS950, Springer-verlag, pp. 92-111 (1994)”; and  
           [0018]    a document 13: “R. Cramer and V. Shoup: A practical PUblic Key Cryptosystem Probably Secure against Adaptive Chosen Ciphertext Attack, Proc. of Crypto&#39;98, LNCS1462, Springer-Verlag, pp. 13-25 (1998)”.  
           [0019]    A document 14: “M. Bellare, A. Desai, D. Pointcheval and P. Rogaway: Relations Among Notions of Security for Public-Key Encryption Schemes, Proc. of Crypto&#39;98, LNSC1462, Sprinter-Verlag, pp. 26-45 (1998)”, indicates the equivalency between IND-CCA2 (semantically secure (indistinguishable) against adaptive chosen ciphertext attacks) and NM-CCA2 (non-malleable against adaptive chosen ciphertext attacks). A public-key cryptographic scheme satisfying this condition is presently considered most secure.  
           [0020]    Although the public-key cryptographic scheme described in the document 12 is practical, security is verified on the assumption that an ideal random function exists. Since it is impossible to configure an ideal random function in a real system, the ideal random function is replaced with a practical hash function in order to apply the scheme of the document  12  to the real system. Therefore, security cannot be verified in the real system.  
           [0021]    The document  13  provides a public-key cryptographic scheme capable of verifying IND-CCA2 on the assumption that a general one-way hash function exists instead of an ideal random function. Since the general one-way hash function can be configured really (under a cryptographic assumption), the scheme described in the document  13  can verify security in a standard model. However, when it is applied to a real system, a practical hash function such as SHA-1 is used by assuming it as a general hash function in order to improve the efficiency. Therefore, a strong assumption is incorporated in order to verify security. Although the document  13  proposes a public-key cryptographic scheme which does not assume the existence of a general one-way hash function, the efficiency of this scheme is inferior to a scheme which assumes the existence of a general one-way hash function.  
         SUMMARY OF THE INVENTION  
         [0022]    It is a main object of the present invention to provide a public-key cryptographic scheme which is practical and capable of verifying security (IND-CCA2) against strongest attacks or adaptive chosen ciphertext attacks in a standard model (a real computer model not assuming the existence of an ideal function).  
           [0023]    It is another object of the present invention to provide a public-key cryptographic scheme which is practical and capable of verifying security even if it is applied to a real system, by assuming only the difficulty of the Diffe-Hellman decision problem.  
           [0024]    It is another object of the invention to provide a cryptographic communication method using the public-key cryptographic scheme of the invention, a program, an apparatus and a system for executing the method.  
           [0025]    In order to achieve the above objects of the invention, a ciphertext is created by using a combination of a plaintext and random numbers in order to reject an illegal ciphertext input to a (simulated) deciphering oracle and to guarantee security against adaptive chosen ciphertext attacks. The environment given a deciphering oracle means an environment which unconditionally gives the deciphered results of any ciphertext excepting a target ciphertext. According to one of specific public-key cryptographic schemes, the following secret-key is created:  
           [0026]    x 1 , x 2 , y 11 , y 12 , y 21 , y 22 , z∈           q    
           [0027]    and the following public key is created:  
           [0028]    p, q: prime number (q is a prime factor of p-1)  
           [0029]    g 1 , g 2  ∈E : ord p (g 1 )=ord p (g 2 )=q  
           [0030]    c=g 1   x     1   g 2   g     2    mod p, d 1 =g 1   y11 g 2   y12  mod p, d 2 =g 1   y21 g 2   y22  mod p, h=g 1   z  mod p,  
           [0031]    k 1 , k 2 , k 3 : positive constant (10 k     1     +k     2   &lt;q, 10 k     3   &lt;q, 10 k     1     +k     2     +k     3   &lt;p)  
           [0032]    (ord( ) indicates an order)  
           [0033]    A sender generates a random number α=α 1 ∥α 2  (|α 1 =k 1 , |α 2 |=k 2 ) for a plaintext m (|m|=k 3  where |x| indicates the number of digits of x), and calculates:  
           {tilde over (m)}α∥m  
           [0034]    A random number r∈Zq is selected, and the following is calculated:  
           u 1   =g   1   r    mod p, u   2 =g 2   r  mod p, e={tilde over (m)}h r  mod p, v=g 1   α     1   c r d 1   αr d 2   mr  modp  
           [0035]    A ciphertext (u 1  u 2 , e, v) is transmitted to a receiver.  
           [0036]    By using a secret-key of the receiver and the received ciphertext, the receiver calculates α′ 1 , α′ 2 , m′(|α 1 |=k 1 , |α 2 |=k 2 ), and |m′|=k 3  which satisfy:  
           α′ 1 λα′ 2   |m′=e/u   1   z    mod p    
           [0037]    If the following is satisfied;  
           
         g′ 
         1 
         α′ 
         u 
         1 
         x 
         
           1 
         
         +α′y11 
         +m′y21 
         u 
         2 
         x 
         
           2 
         
         +α′y12+m′y22 
         ≡v (mod p)  
       
           [0038]    m′ is output as the deciphered results (where α′=α′ 1 ∥α′ 2 ), whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0039]    [0039]FIG. 1 is a diagram showing the structure of a system according to an embodiment of the invention.  
         [0040]    [0040]FIG. 2 is a diagram showing the internal structure of a sender side apparatus of the embodiment.  
         [0041]    [0041]FIG. 3 is a diagram showing the internal structure of a receiver side apparatus of the embodiment.  
         [0042]    [0042]FIG. 4 is a diagram showing the outline of a second embodiment of the invention.  
         [0043]    [0043]FIG. 5 is a diagram showing the outline of a fourth embodiment of the invention.  
         [0044]    [0044]FIG. 6 is a diaram showing the outline of a sixth embodiment of the invention. 
     
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS  
       [0045]    Embodiments of the invention will be described with reference to the accompanying drawings.  
         [0046]    [0046]FIG. 1 is a diagram showing the structure of a system according to an embodiment of the invention. This system is constituted of a sender side apparatus  100  and a receiver side apparatus  200 . The sender side apparatus  100  and receiver side apparatus  200  are connected by a communication line  300 .  
         [0047]    [0047]FIG. 2 is a diagram showing the internal structure of the sender side apparatus  100  of the embodiment. The sender side apparatus  100  has a random number generator unit  101 , an exponentiation unit  102 , a calculation unit  103 , a modular calculation unit  104 , a memory unit  105 , a communication unit  106 , an input unit  107  and an encipher unit  108 . A plaintext m to be enciphered is input from the input unit  107 , created on the sender side apparatus  100 , or supplied from the communication unit  106  or an unrepresented storage unit.  
         [0048]    [0048]FIG. 3 is a diagram showing the internal structure of the receiver side apparatus  200  of the embodiment. The receiver side apparatus  200  has a key generator unit  201 , an exponentiation unit  202 , a modular calculation unit  203 , a calculation unit  204 , a memory unit  205 , a communication unit  206  and a decipher unit  207 . Although not shown, the receiver side apparatus has an output unit for supplying the user (receiver) of the apparatus with the deciphered results by means of display, sounds and the like.  
         [0049]    The sender side apparatus  100  and receiver side apparatus  200  may be a computer having a CPU and a memory.  
         [0050]    The random number generator unit  101 , exponentiation units  102  and  202 , modular calculation units  104  and  204 , key generator unit  201 , encipher unit  108  and decipher unit  207  each may be a custom processor matching the length of bits to be processed, or may be realized by software programs running on a central processing unit (CPU).  
         [0051]    Processes for key generation, encipher/decipher and ciphertext transmission/reception to be described in the following embodiments are realized by software programs running on the CPU. The software programs use the above-mentioned units.  
         [0052]    Each software program is stored in a computer readable storage medium such as a portable storage medium and a communication medium on the communication line.  
         [0053]    I First Embodiment  
         [0054]    This embodiment describes a public-key cryptographic scheme.  
         [0055]    1. Key Generating Process  
         [0056]    In response to an operation by a receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information constituted of seven numbers:  1   x   1 , x 2 , y 11 , y 12 , y 21 , y 22 , z∈           q    
         [0057]    and public information:  
         [0058]    G, C′: finite (multiplicative) group G ⊂ G′ 
         [0059]    q: prime number (the order of G)  
         [0060]    g 1 ,g 2∈ E G  
         [0061]    c=g 1   x g 2   x     2   , d 1 =g 1   y11 g 2   y   12 , d 2 =g 1   y21 g 2   y22 , h=9g 1   z ,  
         [0062]    π: X 1 ×X 2 ×M→G 1 : one-to-one mapping  
         [0063]    π −1 : Im(π)→X 1 ×X 2 ×M  
         [0064]    where the group G is a partial group of the group G′, X 1  and X 2  are an infinite set of positive integers which satisfy:  
         α 1 ∥α 2   &lt;q (∀α 1   ∈X   1 , ∀α 2   ∈X   2 )  
         [0065]    M is a plaintext space, and ∥ represents a concatenation of bit trains. The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0066]    2. Encipher/Decipher Process  
         [0067]    (1) In response to an operation by a sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α 1 ∈X 1 , α 2 ∈X 2 , r∈Zq for the plaintext m (m∈M), and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
         u 1 =g 1   r , u 2 =g 2   r , e=π(α 1 ,α 2 ,m)h r , v=g 1   α     1   c r d 1   αr d 2   mr    
         [0068]    where α=α 1 ∥α 2 . In response to an operation by the sender A, the communication apparatus  106  of the sender side apparatus  100  transmits the ciphertext (u 1 , u 2 , e, v) to the receiver side apparatus  200  via the communication line  300 .  
         [0069]    (2) In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate, from the received ciphertext and by using the secret information, all α′ 2 , α′ 2 , m′ (α′ 1 ∈X 1 , α′ 2 ∈X 2 , m′∈M) which satisfy:  
         π(α′ 1 , α′ 2   , m ′)= e/u   1   z    
         [0070]    If the following is satisfied:  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       m   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       m   ′          y   22             =   υ                         
 
         [0071]    m′ is output as the deciphered results (where α′=α′ 1 ∥α′ 2 ), whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results.  
         [0072]    With the scheme of this embodiment, it is possible to be semantically secure against adaptive chosen ciphertext attacks on the assumption of the Diffie-Hellman decision problem in G. The Diffie-Hellman decision problem is a problem of deciding whether a given sequence δ belongs to which one of the sets:  
           D ={( g   1   ,g   2   ,g   1   r   , g   2   r )| r∈             q   }, R ={( g   1   ,g   2   ,g   1   r     1     , g   2   r     2   )| r   1   , r   2   ∈         q, r   1 ≠r 2 } 
         [0073]    relative to g 1 , g 2 ∈G:  
         [0074]    If it is difficult to solve the Diffie-Hellman decision problem at a probability better than ½, it is said that the Diffie-Hellman decision problem is difficult (for the Diffie-Hellman decision problem, refer to the document  13  and the like).  
         [0075]    The procedure of verifying security shows that if an algorithm capable of attacking the embodiment method exists, by using this algorithm (specifically, by the method similar to the method described in the document  12 ), an algorithm for solving the Diffie-Hellman decision problem can be configured.  
         [0076]    Even if the algorithm for solving the Diffie-Hellman decision problem exists, since an algorithm capable of attacking the embodiment method is not still found, attacking the embodiment method is more difficult than solving at least the Diffie-Hellman decision problem.  
         [0077]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus 100 selects beforehand the random numbers α 1 ∈X 1 , α 2 ∈X 2  and r∈Zq and calculates and stores beforehand:  
           u   1   =g   1   r   , u   2   =g   2   r   , h   r , g 1   α     1   c r d 1   αr    
         [0078]    Therefore, a load of an encipher process can be reduced considerably and the process time can be shortened.  
         [0079]    II Second Embodiment  
         [0080]    The second embodiment shows one of the methods of realizing the public-key cryptographic scheme of the fist embodiment, and adopts concatenation of three parameters as a function π. FIG. 4 shows the outline of this embodiment.  
         [0081]    1. Key Generation Process  
         [0082]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0083]    x 1 ,x 2 ,y 11 , y 12 , y 21 ,y 22 , z∈Z q    
         [0084]    and public information:  
         [0085]    p, q: prime number (q is a prime factor of p-1)  
         [0086]    g 1 ,g 2 ∈Z p : ord p (g 1 )=ord p (g 2 )=q  
         [0087]    c=g 1   x     1   g 2   x2  mod p, d 1 =g 1   y11 g 2   y12  mod p, d 2   y12 g 2   y22  mod p, h=g 1   z  mod p,  
         [0088]    k 1 , k 2 , k 3 : positive constant (10 k     1     +k   2 &lt;q, 10 k     3   &lt;q, 10 k     1     +k     2     +k     3   &lt;p)  
         [0089]    (ord ( ) indicates an order)  
         [0090]    The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0091]    2. Encipher/Decipher Process  
         [0092]    (1) In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α=α 1 ∥α 2 (|α 1 |=k 1 , |α 2 |=k 2 ) for a plaintext m (|m|=k 3 , where |x| indicates the number of digits of x) (step  401 ), and calculates (Step  402 ):  
         {tilde over (m)}=α∥m  
         [0093]    The random number generator unit  101  further selects a random number r∈Zq, and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculates:  
         
       u 
       1 
       =g 
       1 
       r 
       mod p, u 
       2 
       =g 
       2 
       r 
       mod p, e={tilde over (m)}h 
       r 
       mod p, v=g 
       1 
       α 
       
         1 
       
       c 
       r 
       d 
       1 
       αr 
       d 
       2 
       mr  
       mod p  
     
         [0094]    In response to an operation by the sender A, the communication apparatus  106  of the sender side apparatus  100  transmits (u 1 , u 2 , e, v) as the ciphertext to the receiver side apparatus  200  of the receiver B via the communication line  300  (Step  403 ).  
         [0095]    (2) In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate (Step  404 ), from the received ciphertext and by using the secret information, α′ 1 , α′ 2 , m′ (|α′ 1 |=k 1 , |α′ 2 |=k 2 , |m′=k 3 ) which satisfy:  
         α′ 1 ∥α′ 2   ∥m′=e/u   1   z    mod p    
         [0096]    If the following is satisfied (Step 405):  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       m   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       m   ′          y   22             ≡     υ                   (     mod                 p     )                             
 
         [0097]    m′ is output as the deciphered results (where α′=α′ 1 ∥α′ 2 ) (Step  406 ), whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results (Step  407 ).  
         [0098]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α 1 , α 2  (|α 1 |=k 1 , |· 2 |=k 2 ) and r∈Zq and calculates and stores beforehand:  
           u   1   =g   1   r    mod p, u   2 =g 2   r    mod p, h   r    mod p, g   1   α     1     c   r   d   1   αr   mod p    
         [0099]    Therefore, a load of an encipher process can be reduced considerably.  
         [0100]    III Third Embodiment  
         [0101]    In this embodiment, the message sender A enciphers transmission data m to the receiver B by common-key encipher (symmetric cryptography), and the common key used is enciphered by the public-key cryptographic scheme of the first embodiment to be sent to the receiver B.  
         [0102]    1. Key Generating Process  
         [0103]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0104]    x 1 , x 2 , y 11 , y 12 , y 21 , y 22 , z∈Z q    
         [0105]    and public information:  
         [0106]    G, C′: finite (multiplicative) group G ⊂ G′ 
         [0107]    q: prime number (the order of G)  
         [0108]    g 1 , g 2 ∈C  
         [0109]    c=g 1   x     1   g 2   x     2   , d 1 =g 1   y11 g 2   y12 , d 2 =g 1   y21 , g 2   y22 , h=g 1   z ,  
         [0110]    π: X 1 ×X 2 ×M , G′: one-to-one mapping  
         [0111]    π −1 : Im(π)→X 1 ×X 2 ×M  
         [0112]    E: symmetric encipher function  
         [0113]    where the group G is a partial group of the group G′, X 1  and X 2  are an infinite set of positive integers which satisfy:  
         α 1 ∥α 2 &lt;q (∀α 1 ∈X 1 , ∀α 2 ∈X 2 )  
         [0114]    M is a key space. The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0115]    2. Encipher/Decipher Process  
         [0116]    (1) In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α 1 ∈X 1 , α 2 ∈X 2 , r∈Zq for the plaintext m (m∈M), and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
           u   1   =g   1   r   , u   2 =g 2   r , e=π(α 1 ,α 2 ,K)h r , v=g 1   α1 c r d 1   αr d 2   Kr    
         [0117]    where α=α 1 ∥α 2 . A ciphertext C of the transmission data m is generated by:  
         C=E K (m)  
         [0118]    by using the symmetric cryptographic function E and key data K. In response to an operation by the sender A, the communication apparatus  106  of the sender side apparatus  100  transmits (u 1 , u 2 , e, v, C) as the ciphertext to the receiver side apparatus  200  via the communication line  300 .  
         [0119]    (2) In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate, from the received ciphertext and by using the secret information, α′ 1 , α′ 2 , K′ (α′ 1 ∈X 1 , α′ 2 ∈X 2 , K′∈M) which satisfy:  
         π(α′ 1 ∥α′ 2 ∥K′)=e/u 1   z    
         [0120]    If the following is satisfied (where α′=α′ 1 ∥α′ 2 )  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       K   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       K   ′          y   22             =   υ                         
 
         [0121]    a decipher process is executed by:  
         m=D K′ (C)  
         [0122]    where D is a decipher function corresponding to E. The deciphered results are output. If not satisfied, the effect that the received ciphertext is rejected is output as the decipher results.  
         [0123]    As another method of generating a ciphertext C, the sender generates the ciphertext C by:  
           C=E   K (α 1 ∥α 2 ∥m)  
         [0124]    by using the (symmetric) cryptographic function E and key data K. The receiver checks whether the following is satisfied:  
               g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       K   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       K   ′          y   22             =   υ     ,       α   1   ′                 α   2   ′     =       [       D     K   ′            (   C   )       ]         k   1     +     k   2                                     
 
         [0125]    where [x] k  indicates the upper k digits. If the check passes, a decipher process is executed by:  
           m=[D   K′ ( C )] −(k     1     +k     2   )  
         [0126]    where [x] −k  indicates an integer train of x removed with the upper k digits.  
         [0127]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers (α 1 ∈X 1 , α 2 ∈X 2  and r∈Zq and calculates and stores beforehand:  
           u   1   =g   1   r   , u   2   =g   2   r   , h   r   , g   1 α 1   c   r   d   1   αr    
         [0128]    Therefore, a load of an encipher process can be reduced considerably and the process time can be shortened.  
         [0129]    IV Forth Embodiment  
         [0130]    In this embodiment, the message sender A enciphers transmission data m to the receiver B by common-key encipher (symmetric cryptography), and the common key used is enciphered by the public-key cryptographic scheme of the second embodiment to be sent to the receiver B.  
         [0131]    [0131]FIG. 5 shows the outline of the embodiment.  
         [0132]    1. Key Generating Process  
         [0133]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0134]    x 1 , x 2 , y 11 , y 12 , y 21 , y 22 , Z∈           q    
         [0135]    and public information:  
         [0136]    p, q: prime number (q is a prime factor of p-1)  
         [0137]    g 1 ,g 2 ∈           p : ord p (g 1 )=ord p (g 2 )=q  
         [0138]    c=g 1   z     1   g 2   x     2    mod p, d 1 =g 1   y11 g 2   y12  mod p, d 2 =g 1   y21 g 2   y22  mod p, h=g 1   z  mod p,  
         [0139]    k 1 , k 2 , k 3 : positive constant (10 k     1     +k     2   &lt;q, 10 k     3   &lt;q, 10 k     1     +k   2 +k 3 &lt;p)  
         [0140]    E: symmetric encipher function  
         [0141]    The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0142]    2. Encipher/Decipher Process  
         [0143]    (1) In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α=α 1 ∥α 2 (|α 1 |=k 1 , |α 2 |=k 2 ) for the key data K (Step  501 ) (|K|=k 3  where |x| indicates the number of digits of x), and calculates (Step  502 ):  
         {tilde over (m)}=α∥K  
         [0144]    The random number generator unit  101  selects a random number r∈Zq, and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
         
       u 
       1 
       =g 
       1 
       r 
       mod p, u 
       2 
       =g 
       2 
       r  
       mod p, e={tilde over (m)}h 
       r 
       mod p, v=g 
       1 
       α 
       
         1 
       
       c 
       r 
       d 
       1 
       αr 
       d 
       2 
       mr  
       mod p  
     
         [0145]    In response to an operation by the sender A, the sender side apparatus  100  generates a ciphertext C of the transmission data m by:  
           C=E   K ( m )  
         [0146]    by using the (symmetric) cryptographic function E and key data K (Step  503 ), and the communication unit  106  transmits (u 1 , u 2 , e, v, C) as the ciphertext to the receiver side apparatus  200  via the communication line  300  (Step  504 ).  
         [0147]    (2) In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate (Step  505 ), from the received ciphertext and by using the secret information, α′ 1 , α′ 2 , K′ (|α′ 1 |=k 1 , |α′ 2 |=k 2 , |K′|=k 3 ) which satisfy:  
         α′ 1 ∥α′ 2 ∥K′=e/u 1   z   mod p    
         [0148]    If the following is satisfied (where α′=α′ 1 ∥α′ 2 ) (Step  506 ):  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       K   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       K   ′          y   22             ≡     υ                   (     mod                 p     )                             
 
         [0149]    a decipher process is executed (Step 507) by:  
         m=D K′ (C)  
         [0150]    where D is a decipher function corresponding to E. The deciphered results are output. If not satisfied, the effect that the received ciphertext is rejected is output as the decipher results (Step  508 ).  
         [0151]    As another method of generating a ciphertext C, the sender generates the ciphertext C by:  
           C=E   K (α 1 ∥α 2 ∥K)  
         [0152]    by using the (symmetric) cryptographic function E and key data K. The receiver checks whether the following is satisfied:  
               g   1       α   1   ′              u   1         x   1     +       α   ′          y   11       +       K   ′          y   21                  u   2         x   2     +       α   ′          y   12       +       K   ′          y   22             ≡     υ                   (     mod                 p     )         ,     
            α   1   ′                 α   2   ′     =       [       D     K   ′            (   C   )       ]         k   1     +     k   2                                     
 
         [0153]    If the check passes, a decipher process is executed by:  
           m=[D   K′ ( C )] −(k     1     +k     2   )  
         [0154]    where [x] −k  indicates an integer train of x removed with the upper k digits.  
         [0155]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α 1 , α 2 , (|α 1 |=k 1 , |α 2 |=k 2 ), r∈Zq and calculates and stores beforehand:  
         
       u 
       1 
       =g 
       1 
       r 
       mod p, u 
       2 
       =g 
       2 
       r 
       mod p, h 
       r 
       mod p, g 
       1 
       α 
       
         1 
       
       c 
       r 
       d 
       1 
       αr 
       mod p  
     
         [0156]    Therefore, a load of an encipher process can be reduced considerably.  
         [0157]    V Fifth Embodiment  
         [0158]    In this embodiment, the message sender A transmits transmission data m to the receiver B by cryptographic communications by using symmetric cryptography based upon the public-key cryptography of the first embodiment. This embodiment is more excellent in the efficiency than the method of the third embodiment. If the symmetric cryptography is non-malleable (IND-CPA) against chosen plaintext attacks, it is possible to verify that the symmetric cryptography is non-malleable against adaptive chosen ciphertext attacks (NM-CCA2). In the embodiment method, a key K itself is not transmitted but the sender and receiver share a seed so that the key can be generated.  
         [0159]    1. Key Generating Process  
         [0160]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0161]    x 1 , x 2 , y 1 , y 2 , z∈Z q    
         [0162]    and public information:  
         [0163]    G, C : finite (multiplicative) group G ⊂ C′ 
         [0164]    q: prime number (the order of G)  
         [0165]    g 1 ,g 2 ⊂G  
         [0166]    c=g 1   x     1   g 2   x     2   , d=g 1   y1 g 2   y2 , h=g 1   z ,  
         [0167]    π: X 1 ×X 2 ×M→Dom(E): one-to-one mapping (Dom(E) is the domain of the function E)  
         [0168]    π −1 : Im(π)→X 1 ×X 2 ×M  
         [0169]    H: hash function  
         [0170]    E: symmetric encipher function  
         [0171]    where the group G is a partial group of the group GI, X 1  and X 2  are an infinite set of positive integers which satisfy:  
         α 1 μα 2   &lt;q (∀α 1   ∈X   1 , ∀α 2   ∈X   2 )  
         [0172]    The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0173]    2. Encipher/Decipher Process  
         [0174]    (1) In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α 1 ∈X 1 , α 2 ∈X 2 , r∈Zq for transmission data m (m∈M, M is a plaintext space), and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
           u   1   =g    1   r   , u   2   =g   2   r   , v=g   1   α     1     c   r   d   αr   , K=H ( h   r )  
         [0175]    where α=α 1 ∥α 2 . A ciphertext C of the transmission data m is generated by:  
           C=E   K (π((α 1 , α 2 , m))  
         [0176]    by using the (symmetric) cryptography. In response to an operation by the sender A, the communication apparatus  106  of the sender side apparatus  100  transmits (upl u 2 , V, C) as the ciphertext to the receiver side apparatus  200  via the communication line  300 .  
         [0177]    (2) In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate:  
           K′=H (u 1   z )  
         [0178]    by using the secret information, and further calculate, from the received ciphertext, α′ 1 , α′ 2 , α 1 ∈=X 1 , α′ 2  E X 2 ) which satisfy:  
         π(α′ 1 , α′ 2   , m ′)= D   K′ ( C )  
         [0179]    where D is a cryptographic function corresponding to E. If the following is satisfied:  
               g   1       α   1   ′              u   1         x   1     +       α   ′          y   1                  u   2         x   2     +       α   ′          y   2             =   υ     ,                         
 
         [0180]    m′ is output as the deciphered results (where α′=α′ 1 λα′ 2 ), whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results.  
         [0181]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α 1 ∈X 1 , α 2 ∈X 2  and r∈Zq and calculates and stores beforehand u 1 , u 2  and v. Therefore, a load of an encipher process can be reduced considerably and the process time can be shortened.  
         [0182]    VI Sixth Embodiment  
         [0183]    In this embodiment, the message sender A transmits transmission data m to the receiver B by cryptographic communications by using symmetric cryptography based upon the public-key cryptography of the second embodiment.  
         [0184]    [0184]FIG. 6 illustrates the outline of the embodiment.  
         [0185]    1. Key Generating Process  
         [0186]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0187]    x 1 , x 2 , y 1 , y 2 , z∈Z q .  
         [0188]    and public information:  
         [0189]    p, q : prime number (q is a prime factor of p-1)  
         [0190]    g 1 , g 2 ∈Z p : ord p (g 1 )=ord p (g 2 )=q  
         [0191]    c=g 1   x     1   g 2   x     2    mod p, d=g 1   y1 g 2   y2  mod p, h=g 1   z  mod p,  
         [0192]    k 1 , k 2 , k 3 : positive constant (10 k     1     +k     2   &lt;q, 10 k     3   &lt;q, 10 k     1     +k     2     +k     3   &lt;p)  
         [0193]    H: hash function  
         [0194]    E: symmetric encipher function (the domain of E is all positive integers)  
         [0195]    The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0196]    2. Encipher/Decipher Process  
         [0197]    In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects (step  602 ) random numbers α=α 1 ∥α 2 (|α 1 |=k 1 , α 2 |=k 2 , where |x| is the number of digits of x) for the plaintext m (m∈M, M is a plaintext space) (Step  601 ), and further selects a random number r∈Zq. The exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
           u   1   =g   1   r   mod p, u   2   =g   2   r   mod p, v=g   1   α     1     c   r   d   αr   mod p, K=H ( h   r    mod p )  
         [0198]    The sender side apparatus  100  generates a ciphertext C of the transmission data m by:  
           C=E   K (α 1 ∥α 2   ∥m )  
         [0199]    by using the (symmetric) cryptographic function E (Step  603 ). The communication apparatus  106  transmits (ul, U 2 , V, C) as the ciphertext to the receiver side apparatus  200  via the communication line  300  (Step  604 ).  
         [0200]    In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate:  
           K′=H ( u   1   z   mod p )  
         [0201]    by using the secret information, and further calculate (Step  605 ), from the received ciphertext, (α′ 1 , α′ 2 , (|α′ 1 , α′ 2 (|α′ 1 |=k 1 , |α′ 2 |=k 2 ) which satisfy:  
         a′1II2IIm′ =DKI(C)  
         [0202]    If the following is satisfied (Step  606 ):  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   1                  u   2         x   2     +       α   ′          y   2             ≡     υ                   (     mod                 p     )                             
 
         [0203]    m′ is output as the deciphered results (where α′=α′ 1 ∥α′ 2 ) (Step  607 ), whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results (Step  608 ).  
         [0204]    With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α 1 , α 2  (|α 1 |=k 1 , |α 2 |=k 2 ) and r Zq, and calculates and stores beforehand u 1 , u 2  and v. Therefore, a load of an encipher process can be reduced considerably and the process time can be shortened.  
         [0205]    VII Seventh Embodiment  
         [0206]    In this embodiment, the message sender A transmits transmission data m to the receiver B by cryptographic communications by using another asymmetric cryptography and the public-key cryptography of the first embodiment. In this embodiment, a weak asymmetric cryptography (NM-CPA) can be transformed into a non-malleable cryptography (NM-CCA2).  
         [0207]    1. Key Generating Process  
         [0208]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0209]    x 1 , x 2 , y 1 , y 2 ∈           q    
         [0210]    sk : (asymmetric) decipher key  
         [0211]    and public information:  
         [0212]    G: finite (multiplicative) group  
         [0213]    q: prime number (the order of G)  
         [0214]    g 1 ,g 2 ∈G  
         [0215]    c=g 1   x     1   g 2   x     2   , d=g 1   y1 g 2   y2 ,  
         [0216]    π: X 1 ×X 2 ×M→Dom(E): one-to-one mapping (Dom(E) is the domain of the function E)  
         [0217]    π −1 : Im(π)→X 1 ×X 2 ×M  
         [0218]    E pk (·): (asymmetric cryptography) encipher function  
         [0219]    where the group G is a partial group of the group G′, X 1  and X 2  are an infinite set of positive integers which satisfy:  
         α 1 ∥α 2   &lt;q (∀α 1 ∈X 1 , ∀α 2 ∈X 2 )  
         [0220]    M is a plaintext space. The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0221]    2. Encipher/Decipher Process  
         [0222]    In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α 1 ∈X 1 , α 2 ∈X 2 , r∈Zq, and the exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
         
       u 
       1 
       =g 
       1 
       r 
       , u 
       2 
       =g 
       2 
       r 
       , v=g 
       α1 
       c 
       r 
       d 
       αr  
     
         [0223]    where α=α 1 ∥α 2 . The sender side apparatus  100  generates a ciphertext C of the transmission data m by:  
           e=E   pk (π(α 1 ,α 2   ,m ))  
         [0224]    by using the (asymmetric) cryptographic function E pk . In response to an operation by the sender A, the communication apparatus  106  transmits (u 1 , u 2 , e, v) as the ciphertext to the receiver side apparatus  200  via the communication line  300 .  
         [0225]    In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate, from the received ciphertext, α′ 1 , α′ 2  and m′ (α′ 1 ∈X 1 , α′ 2 ′∈X 2 , α′∈X 2 , and m′∈M) which satisfy:  
         π(α′ 1 ,α′ 2   ,m ′)= D   sk ( e )  
         [0226]    (where D sk  is a decipher function corresponding to E pk ) by using the secret information. If the following is satisfied:  
             g   1       α   1   ′              u   1         x   1     +       α   ′          y   1                  u   2         x   2     +       α   ′          y   2             =   υ                         
 
         [0227]    where:  
         [0228]    m′ is output as the deciphered results, whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results. With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α′ 1 ∈X 1 , α′ 2 ∈X 2 , and r∈Zq and calculates and stores beforehand u 1 , u 2  and v. Therefore, a load of an encipher process can be reduced considerably and the process time can be shortened.  
         [0229]    VIII Eighth Embodiment  
         [0230]    In this embodiment, similar to the seventh embodiment, the message sender A transmits transmission data m to the receiver B by cryptographic communications by using the asymmetric cryptography based upon the public-key cryptography of the second embodiment.  
         [0231]    1. Key Generating Process  
         [0232]    In response to an operation by the receiver B, the key generator unit  201  of the reception side apparatus  200  generates beforehand secret information:  
         [0233]    x 1 ,x 2 , y 1 , y 2 ∈           q    
         [0234]    sk: (asymmetric cryptography) decipher key  
         [0235]    and public information:  
         [0236]    p, q: prime number (q is a prime factor of p-1)  
         [0237]    g  1 , g 2 ∈           p : ord p (g 1 )=ord p (g 2 )=q  
         [0238]    c=g 1   x     1   g 2   x     2    mod p, d=g 1   y1 g 2   y2  mod p,  
         [0239]    k 1 , k 2 : positive constant (10 k     1     +k     2   &lt;q)  
         [0240]    E pk (′): (asymmetric cryptography) encipher function (the domain is all positive integers)  
         [0241]    The public information is supplied to the sender side apparatus  100  or made public, via the communication line  300  or the like. A publicizing method may be registration in the third party (public information management facilities) or may be a well-known method. Other information is stored in the memory unit  205 .  
         [0242]    2. Encipher/Decipher Process  
         [0243]    In response to an operation by the sender A, the random number generator unit  101  of the sender side apparatus  100  selects random numbers α=α 1 ∥α 2 (|α 0 |=k 1 , |α 2 |=k 2 , where |x| is the number of digits of x), and further selects a random number r∈Zq. The exponentiation unit  102 , calculation unit  103  and modular calculation unit  104  calculate:  
         
       u 
       1 
       =g 
       1 
       r  
       mod p, u 
       2 
       =g 
       2 
       r  
       mod p, v=g 
       1 
       α 
       
         1 
       
       c 
       r 
       d 
       αr 
       mod p  
     
         [0244]    In response to an operation by the sender A, the sender side apparatus  100  generates a ciphertext C of the transmission data m (positive integer) by:  
           e=E   pk (α 1 ∥α 2   ∥m )  
         [0245]    by using the (asymmetric) cryptographic function E. The communication apparatus  106  transmits (u 1 , u 2 , e, v) as the ciphertext to the receiver side apparatus  200  via the communication line  300 .  
         [0246]    In response to an operation by the receiver B, the exponentiation unit  202 , modular calculation unit  203  and calculation unit  204  of the receiver side apparatus  200  calculate, from the received ciphertext and by using the secret information, α′ 1 , α′ 2  and m′ (|α′ 1 =k 1 , |α′ 2 |=k 2 , m′ is a positive integer) which satisfy:  
         α′ 1 ∥α′ 2   ∥m′=D   ak ( e )  
         [0247]    where D sk  is a decipher function corresponding to E pk .  
         [0248]    If the following is satisfied:  
               g   1       α   1   ′              u   1         x   1     +       α   ′          y   1                  u   2         x   2     +       α   ′          y   2             ≡     υ                   (     mod                 p     )         ,                         
 
         [0249]    where:  
         αa′α′ 1 μα′ 2    
         [0250]    m′ is output as the deciphered results, whereas if not satisfied, the effect that the received ciphertext is rejected is output as the decipher results. With the embodiment method, when a ciphertext is generated in response to an operation by the sender A, the sender side apparatus  100  selects beforehand the random numbers α′ 1 ∈X 1 , α′ 2 (|α 1 |=k 1 , |α 2 |=k 2 , and r∈Zq and calculates and stores beforehand u 1 , u 2  and v. Therefore, a load of an encipher process can be reduced considerably.  
         [0251]    In each of the embodiments described above, cryptographic communications are performed by using the apparatuses of the sender and receiver, which is a general system. Various systems may also be used.  
         [0252]    For example, in an electronic shopping system, a sender is a user, a sender side apparatus is a computer such as a personal computer, a receiver is a retail shop and its clerk, and a receiver side apparatus is an apparatus in the retail shop such as a computer, e.g., a personal computer in the shop. An order sheet of a commodity ordered by the user or a key generated when the order sheet is enciphered is enciphered by the embodiment method and transmitted to the apparatus of the retail shop.  
         [0253]    In an email cryptographic system, each apparatus is a computer such as a personal computer, and a message of the sender or a key generated when the message is enciphered is enciphered by the embodiment method and transmitted of the receiver side computer.  
         [0254]    Each embodiment is also applicable to various systems using conventional cryptographic techniques.  
         [0255]    Various digitalized data (multimedia data) can be used as a plaintext or message of each embodiment. Calculations of each embodiment are performed by executing each program in a memory by a CPU. Some of calculations may be performed not by a program but by a hardware calculation unit which transfers data to and from another calculation unit and CPU.