Cipher system, encryption apparatus, decryption apparatus, method, and program

An encryption device that encrypts a plaintext m by a public key encryption scheme including a tag-based encryption scheme TBE=(GenTBE,EncTBE,DecTBE), a weak commitment scheme wCom=(Init,S,R), and a message authentication code scheme MAC=(T,V), the encryption device comprising:

• a memory;
• and
• a processor configured to:
• generate a random number r, a commitment com, and a decommitment dec by a sender algorithm S(1κ,pub) using a security parameter as a and a common parameter as pub, generate a ciphertext c by an encryption algorithm EncTBE(ekTBE,com,(m,dec)) using an encryption key of the public key encryption scheme as ek=ekTBE, generate a tag σ by a MAC generation algorithm T(r,c), and use the commitment com, the ciphertext c, and the tag σ as a ciphertext ct of the public key encryption scheme;
• and
• transmit the ciphertext ct to a decryption device connected to the encryption device via a communication network.

A decryption device that decrypts a ciphertext ct by a public key encryption scheme including a tag-based encryption scheme TBE=(GenTBE,EncTBE,DecTBE), a weak commitment scheme wCom=(Init,S,R), and a message authentication code scheme MAC=(T,V), the decryption device comprising:

• a memory;
• and
• a processor configured to:
• using a security parameter as κ, generate an encryption key ekTBE and a decryption key dkTBE by a key generation algorithm GenTBE(1κ), generate a common parameter pub by an initialization algorithm Init(1κ), and use the encryption key ekTBE and the common parameter pub as an encryption key ek of the public key encryption scheme and the decryption key dkTBE as a decryption key dk of the public key encryption scheme;
• and
• parse the ciphertext ct into a commitment com, a ciphertext c, and a tag σ, generate a plaintext m and a decommitment dec by a decryption algorithm DecTBE(dkTBE,com,c), verify whether committing to a random number value r has succeeded by a receiver algorithm R(pub,com,dec), and verify the tag σ by a verification algorithm V(r,c,σ) in a case where the committing has succeeded.