Nippon Telegraph and Telephone Corporation

Eiichiro Fujisaki

Kazuo Ohta

Masayuki Abe

Tatsuaki Okamoto

Go Yamamoto

Koutarou Suzuki

Atsushi Fujioka

In encryption, a random number r is generated to generate a ciphertext C=M(+)R(r), function values H(r, C), a common key K, a ciphertext C(&#x3a8;+1) of the random number r using the common key K, and ciphertexts C(0) and C(&#x3bb;) of the common key K that correspond to function values H(r, C). In decryption, a common key K' is decrypted from input ciphertexts C&#x2032;(0) and C&#x2032;(&#x3bb;), an input ciphertext C&#x2032;(&#x3a8;+1) is decrypted by using the common key K&#x2032; to generate a decrypted value r&#x2032;, and function values H(r&#x2032;, C&#x2032;) is generated. If the input ciphertexts C&#x2032;(0) and C&#x2032;(&#x3bb;) do not match ciphertexts C&#x2033;(0) and C&#x2033;(&#x3bb;) of the common key K&#x2032; that correspond to the function values H(r&#x2032;, C&#x2032;), decryption is rejected; if they match, the input ciphertext C&#x2032; is decrypted.

Encryption device, decryption device, encryption method, decryption method, program, and recording medium

Security against CCA is improved without providing space for just improving the security against CCA in a ciphertext space. In encryption processing, a first ciphertext Cis calculated from a plaintext M and a symmetric key K; a value containing a value corresponding to the symmetric key K and a value corresponding to the first ciphertext Cis put into a collision-resistant function H to calculate a function value of the function H; and r corresponding to the function value is used to calculate second ciphertext C=r&#xb7;(&#x3a3;v&#xb7;b)+&#x3c1;&#xb7;b&#x2208;G. In decryption processing, the second ciphertext C&#x2208;Gand key information D*=&#x3b1;&#xb7;(&#x3a3;w&#xb7;b*)+b*&#x2208;Gare put into a bilinear function e to calculate a function value S=e(C, D*)&#x2208;G; a value corresponding to the function value Sand the first ciphertext Care put into the collision-resistant function H to calculate a function value of the function H; and it is judged whether rcorresponding to the function value satisfies C=r&#xb7;(&#x3a3;v&#xb7;b)+&#x3c1;&#xb7;b&#x2208;G.

Encryption apparatus, decryption apparatus, encryption method, decryption method, security method, program, and recording medium

A verification device stores verification information and first random information in a storage. The verification information depends upon contents of comparative information, and not upon an information volume of the comparative information. The verification device generates an authentication information generation factor using the first random information and transmits the factor to a proving device, which generates authentication information using the authentication information generation factor and held information and transmits the authentication information to the verification device. The authentication information depends upon contents of the authentication information generation factor and the held information, and not upon the information volume of the held information. A decision section of the verification device decides whether a predetermined relationship is established between the authentication information and the verification information and the first random information. Thereby, the verification device verifies the held information stored in the proving device is the same as the comparative information.

Authentication system, authentication method, attesting device, verification device, their programs, and recording medium

In an electronic cash implementing method using a trustee, a user registers his identification information ID.sub.U and anonymous public key N with the trustee and receives a license (B,I). The user processes the license (B,I) by a public key corresponding to the amount to be issued and sends the processed information to a bank to have it attach a blind signature to the information so that the user obtain electronic cash C from the blind signature. The user transmits to a shop the information B,I,C,N and a digital signature that assures the divisional use of the electronic cash. The shop verifies the validity of the information B and C and accepts it as cash and sends a history H of communication with the user to the bank and receives a payment therefrom. The bank places all received communication histories under its supervision and makes a check to see if the amount x spent by the electronic cash C is in excess of its face value X, and if so, informs the trustee of the information N contained in the communication history. The trustee uses the information ID.sub.U thus received to specify the corresponding user identification information ID.sub.U.

Electronic cash implementing method using a trustee

In a method for implementing traceable electronic cash, a user US sends a bank BK a product N of prime numbers P and Q, a prime number L and his real name ID.sub.U, and the bank BK generates a pseudonym I corresponding to the real name ID.sub.U and keeps the correspondence between the real name ID.sub.U and the pseudonym I secret. The bank BK uses a signature function .OMEGA.=D.sub.eB (N,L,I) to attach a signature to information composed of the above-mentioned N, L and I and sends the user US the signed information .OMEGA. as information containing a license B. The user US generates authentication information X from the N and a random number R and sends the bank BK information Z obtained by performing blind signature preprocessing on information (X,B) with a function F.sub.eC and has the information Z signed by the bank BK with a signature function D.sub.eC (Z) to obtain electronic cash C. When the user US abuses the electronic cash C, the bank BK follows a court order to reveal the correspondence between the real name ID.sub.U and pseudo name of the user US and trace the electronic cash spent.

Growing community of inventors

Tokyo, Japan

Eiichiro Fujisaki