Method of a public key encryption and a cypher communication both secure against a chosen-ciphertext attack
AssigneeHitachi, Ltd.
InventorsMototsugu Nishioka, Yoichi Seto, Hisayoshi Satoh
Life of this patent
Estimating the term…
Abstract
The public-key encryption method uses the sender-side apparatus by the creator of a ciphertest and creates the ciphertext of a plaintext x (∈ {0, 1}n), in y1=f (x0k1G(r)), y2=H (x0k1G(r))r with respect to the published trapdoor-equipped unidirectional function f and the random functions G, H. Meanwhile, the receiver of the ciphertext, who has received the ciphertext by the receiver-side apparatus via the communications line, performs the decryption processing with the use of f−1, i.e., the secret key, in accordance with the steps inverse to those of the encryption processing.
Claims8
1-27. (canceled)
A receiver-side apparatus for decrypting transmission data, said receiver-side apparatus comprising:
- a key generation unit;
- and
- a decryption unit,
- wherein the key generation unit:
- (a):
- creates a secret key given by an expression:
- p, q:
- prime numbers
- p=3 (mod 4), q=3 (mod 4)
- and further,
- (b) creates said public key given by an expression:
- N=pdq (d is odd number)
- k=|N|
- G:
- {0,1}ko→{0,1}n+k1 hash function,
- H:
- {0,1}n+k1{0,1}k0 hash function
- wherein a sender-side apparatus calculates an expression:
- y=w2 mod N
- and defines this result y as a ciphertext so as to transmit said ciphertext to the receiver-side apparatus,
- wherein said decryption unit, using said secret key:
- (c) calculates, from said ciphertext y, an expression:
- α
- 0
- =
- y
- p
- +
- 1
- 4
-
- mod
-
- p
- ,
-
- β
- 0
- =
- α
- 0
- ,
-
- α
- k
- =
- 1
- 2
-
- β
- k
- -
- 1
-
- (
- y
-
-
- mod
-
-
- p
- k
- +
- 1
- -
- β
- k
- -
- 1
- 2
- p
- k
- )
-
- mod
-
- p
- ,
- (
- k
- ≥
- 1
- )
- β
- k
- =
- ∑
- i
- =
- 0
- k
-
- α
- i
-
- p
- i
-
-
- (
- k
- ≥
- 1
- )
- ,
- and, using this result,
- (d) calculates an expression:
- x
- p
- =
- ∑
- i
- =
- 0
- d
- -
- 1
-
- α
- i
-
- p
- i
- and further,
- (e) calculates an expression:
- x
- q
- =
- y
- q
- +
- 1
- 4
-
-
- mod
-
-
- q
- and, concerning each of expressions φ(xp, xq), (p(−xp, xq), φ(Xp, −xq), and φ(−xp, −xq) (where, φ designates a ring isomorphism mapping from Z/(p)×Z/(q) to Z/(pq) by Chinese remainder theorem),
- (f) sets each of said expressions to be as given by an expression:
- s′∥t′ (s′∈ {0,1}n+k1, t′∈ {0,1}k0)
- and
- (g) calculates an expression:
- r′=H(s′)⊕t′,
- x′∥z′=s′⊕G(r′) (x1∈0,1}n, z′∈{0,1}k1)
- and
- (h) obtains a decryption result given by an expression:
- {
- x
- ′
- if
-
-
- z
- ′
- =
- 0
- k
- 1
- *
- otherwise
- wherein, it is stipulated that, in a case where said decryption result is * or invalid, said receiver-side apparatus denies said ciphertext,
- wherein p and q are prime numbers,
- wherein (N, k, G, H) represents a public key, and each of N, k, G, and H represent a function of the public key,
- wherein n is a natural number,
- wherein r is a random number,
- wherein Z represents an aggregate of integers, and
- wherein d is an integer.
A receiver-side apparatus for decrypting transmission data, said receiver-side apparatus comprising:
- a key generation unit;
- and
- a decryption unit,
- wherein the key generation unit:
- (a) creates a secret key given by an expression:
- p, q:
- prime numbers
- p≡3 (mod 4), q≡3 (mod 4)
- and further,
- (b) creates said public key given by an expression:
- N=pdq (d is odd number)
- k=|N|
- G:
- {0,1}k0→{0,1}n hash function,
- H:
- {0,1}n+k1→{0,1}k0 hash function
- H′:
- {0,1}n+k0→{0,1}k1 hash function
- wherein a sender-side apparatus calculates an expression:
- y=w2 mod N
- and defines this result y as a ciphertext so as to transmit said ciphertext to the receiver-side apparatus,
- wherein said decryption unit, using said secret key:
- (c) calculates, from said ciphertext y, an expression:
- α
- 0
- =
- y
- p
- +
- 1
- 4
-
-
- mod
-
-
- p
- ,
-
- β
- 0
- =
- α
- 0
- ,
-
- α
- k
- =
- 1
- 2
-
- β
- k
- -
- 1
-
- (
- y
-
-
- mod
-
-
- p
- k
- +
- 1
- -
- β
- k
- -
- 1
- 2
- p
- k
- )
-
-
- mod
-
-
- p
- ,
-
- β
- k
- =
- ∑
- i
- =
- 0
- k
-
- α
- i
-
- p
- i
- (
- k
- ≥
- 1
- )
- ,
- and using this result,
- (d) calculates an expression:
- x
- p
- =
- ∑
- i
- =
- 0
- d
- -
- 1
-
- α
- i
-
- p
- i
- and further,
- (e) calculates an expression:
- x
- q
- =
- y
- q
- +
- 1
- 4
-
-
- mod
-
-
- q
- and, concerning each of expressions φ(xp, xq), φ(−xp, xq), φ(Xp, −xq), and φ(−xp, −xq) where, φ designates a ring isomorphism mapping from Z/(p)×Z/(q) to Z/(pq) by Chinese remainder theorem,
- (f) sets each of said expressions to be as given by an expression:
- s′∥z′∥t′ (s′∈ {0,1}k1, t′∈ {0,1}k0)
- and
- (g) calculates an expression:
- r′=H(s′∥z′)⊕t′,
- x′=s′⊕G(r′) (x′∈ {0,1}n)
- and
- (h) obtains a decryption result given by an expression:
- {
- x
- ′
- if
-
-
- H
- ′
-
- (
- x
- ′
- ||
- r
- ′
- )
- =
- x
- ′
- *
- otherwise
- wherein, it is stipulated that, in a case where said decryption result is *, said receiver-side apparatus denies said ciphertext,
- wherein p and q are prime numbers,
- wherein (N, k, G, H) represents a public key, and each of N, k, G, and H represent a function of the public key,
- wherein n is a natural number, wherein r is a random number,
- wherein Z represents an aggregate of integers, and
- wherein d is an integer.
Dependencies are inferred from the claim text.