Patent ID: 7471792

Claim:
A key agreement system comprising a shared-key generation apparatus and a shared-key recovery apparatus, each apparatus establishing therein a same shared key in secrecy stored in memory, wherein the shared-key generation apparatus includes: a seed-value generating unit configured to generate a seed value; a first shared-key generating unit configured to generate a verification value and a shared key, from the seed value; a first encryption unit configured to encrypt the verification value to generate first encryption information; a second encryption unit configured to encrypt the seed value based on the verification value, to generate second encryption information; and a transmitting unit configured to transmit to the shared-key recovery apparatus the first encryption information and the second encryption information without transmitting to the shared-key recovery apparatus the generated shared-key, wherein the shared-key recovery apparatus includes: a receiving unit configured to receive from the shared-key generation apparatus the first encryption information and the second encryption information; a first decryption unit configured to decrypt the first encryption information, to generate a first decryption verification value; a second decryption unit configured to decrypt the second encryption information based on the first decryption verification value, to generate a decryption seed value; a second shared-key generating unit configured to generate a second decryption verification value and a decryption shared key, from the decryption seed value according to the same method as used in the first shared-key generating unit of the shared-key generation apparatus; and a judging unit configured to judge whether the first decryption verification value generated from the received first encryption information is identical to the second decryption verification value generated from the decryption seed value, the decryption seed value being generated based on the received second encryption information and the first decryption verification value, and to judge that the decryption shared key is identical to the shared key generated in the shared-key generation apparatus if it is judged that the first decryption verification value is identical to the second decryption verification value, wherein the shared-key generation apparatus is distinct from the shared-key recovery apparatus, and wherein the first encryption information is distinct from the second encryption information.