Nippon Telegraph and Telephone Corporation

Toyohashi University of Technology

Koutarou Suzuki

Ryo Nishimaki

Atsushi Fujioka

Hikaru Morita

Kunio Kobayashi

Akira Nagai

Masayuki Abe

Tetsutaro Kobayashi

Ryo Kikuchi

Atsushi Nakadaira

Tatsuaki Okamoto

Shigeru Fujimura

Hiroki Watanabe

Go Yamamoto

Shigenori Ohashi

Shingo Kinoshita

Fumitaka Hoshino

Junichi Tomida

Eiichiro Fujisaki

Tsunekazu Saito

Miyako Ohkubo

Carmen Kempka

A key exchange system in which a shared key is generated for executing encrypted communication between communication apparatuses according to an authenticated key exchange protocol using ID-based encryption, wherein each communication apparatus includes a memory and a processor configured to generate a short-term private key by using a private key of the communication apparatus; generate a short-term public key of the communication apparatus by using the short-term private key; generate private information on the communication apparatus by using the short-term private key, a short-term public key generated by another communication apparatus, and public information generated by the communication apparatus and said another communication apparatus or public information generated by a key delivering center; and generate the shared key for executing encrypted communication with said another communication apparatus by executing a pairing operation using the private key of the communication apparatus and the private information.

Key exchange system, communication apparatus, key exchange method and program

A key exchange system method safely conceal secret information recorded on a blockchain. A first terminal includes a license issuing unit that generates a first transaction including a first public key, a first key storage region that retains a first secret key, and a first encrypting and decrypting unit that generates a common key using deal-specific information, a second public key, and the first secret key, and a second terminal includes a license requesting unit that generates a second transaction including the second public key, a second key storage region that retains a second secret key, and a second encrypting and decrypting unit that generates the common key using deal-specific information, the first public key, and the second secret key. The first encrypting and decrypting unit encrypts secret information using the common key. The second encrypting and decrypting unit decrypts the encrypted secret information using the common key.

Key exchange system and key exchange method

At least any one of input keys K, K, K, and Kis set so that the input keys K, K, K, and Kwhich satisfy K&#x2212;K=K&#x2212;K=dare obtained, and an output key Kcorresponding to an output value g(I(A), I(B)) is set by using the input keys K, K, K, and K, where input values of a gate that performs a logical operation are I(A), I(B)&#x2208;{0, 1}, an output value of the gate is g(I(A), I(B))&#x2208;{0, 1}, an input key corresponding to the input value I(A) is K, and an input key corresponding to the input value I(B) is K.

Circuit concealing apparatus, calculation apparatus, and program

A sharing apparatus independently shares a value corresponding to each element &#x3b8;(&#x3c8;, i, &#x3b2;)&#xb7;gof basis vectors b*(&#x3b8;) among each subset SUB(&#x3b1;) consisting of H(&#x3b1;) share management apparatuses PA(&#x3b1;, 1), . . . , PA(&#x3b1;, H(&#x3b1;)) to generate share information SH(&#x3c8;, i, &#x3b2;, &#x3b1;, h(&#x3b1;)) corresponding to each element &#x3b8;(&#x3c8;, i, &#x3b2;)&#xb7;g. The share management apparatus PA(&#x3b1;, h(&#x3b1;)) generates a share secret value DSH(&#x3c8;, &#x3b1;, h(&#x3b1;)) by performing a common calculation common in the subset SUB(&#x3b1;) on common information shared in the subset SUB(&#x3b1;) and the share information SH(&#x3c8;, i, &#x3b2;, &#x3b1;, h(&#x3b1;)). An acquisition apparatus generates reconstructed secret values SUBSK(&#x3c8;, &#x3b1;) for each subset SUB(&#x3b1;) by performing a reconstruction processing for the subset SUB(&#x3b1;) and generates generation information D*(&#x3c8;) from the reconstructed secret values SUBSK(&#x3c8;, &#x3b1;).

Secret sharing system, sharing apparatus, share management apparatus, acquisition apparatus, secret sharing method, program and recording medium

An information output apparatus identifies, according to a rule established for each of functional encryption protocols or a rule established for each combination of the protocols, one or more identifiers corresponding to a particular functional encryption protocol or a combination of the particular protocols, sets a particular piece of first correspondence information corresponding to the identifier or identifiers, and outputs first information which is a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information. An information processing apparatus inputs the first information and second information which is key information or a ciphertext of the functional encryption scheme that corresponds to a particular piece of second correspondence information into a decryption function of the functional encryption scheme and, when the truth value of a logical formula corresponding to the combination of the particular piece of first correspondence information corresponding to the first information and the particular piece of second correspondence information corresponding to the second information is true, generates a decryption result.

Functional encryption applied system, information output apparatus, information processing apparatus, encryption protocol execution method, information output method, information processing method, program and recording medium

Hierarchical cryptography expressed in a general semiordered structure other than a tree structure is implemented. In information generation, random numbers &#x3c3;and (&#x3c3;)&#x3b5;Zare generated; main information k=&#x3c3;&#x3a3;vb*+b* is calculated; and derivation information k=&#x3c3;&#x3a3;vb*+b* is calculated for each j&#x3b5;w(v). In information derivation, random numbers &#x3c3;and (&#x3c3;)&#x3b5;Zare generated; main information k=&#x3c3;&#x3a3;uk+kis calculated; and derivation information k=&#x3c3;&#x3a3;uk+kis calculated for each j&#x3b5;w(v).

Information generation apparatus, method, program, and recording medium for deriving a decryption key from another decryption key

A secure secret sharing system is implemented. Shares SH(&#x3b1;, h(&#x3b1;)) are generated by secret sharing of secret information separately for each subset SUB(&#x3b1;); each of share management apparatuses PA(&#x3b1;, h(&#x3b1;)) generates a shared secret value DSH(&#x3b1;, h(&#x3b1;)) by performing a common operation to a corresponding share SH(&#x3b1;, h(&#x3b1;)) and common information containing a common value &#x3c3;(&#x3b1;) shared in each subset SUB(&#x3b1;); and an acquisition apparatus generates a reconstructed secret value SUBSK(&#x3b1;) by reconstruction processing for each subset SUB(&#x3b1;), using a plurality of shared secret values DSH(&#x3b1;, h(&#x3b1;)) corresponding to the same subset SUB(&#x3b1;), and generates generation information SK by using the reconstructed secret values SUBSK(&#x3b1;).

Secret sharing system, sharing apparatus, share management apparatus, acquisition apparatus, processing methods thereof, secret sharing method, program, and recording medium

Security against CCA is improved without providing space for just improving the security against CCA in a ciphertext space. In encryption processing, a first ciphertext Cis calculated from a plaintext M and a symmetric key K; a value containing a value corresponding to the symmetric key K and a value corresponding to the first ciphertext Cis put into a collision-resistant function H to calculate a function value of the function H; and r corresponding to the function value is used to calculate second ciphertext C=r&#xb7;(&#x3a3;v&#xb7;b)+&#x3c1;&#xb7;b&#x2208;G. In decryption processing, the second ciphertext C&#x2208;Gand key information D*=&#x3b1;&#xb7;(&#x3a3;w&#xb7;b*)+b*&#x2208;Gare put into a bilinear function e to calculate a function value S=e(C, D*)&#x2208;G; a value corresponding to the function value Sand the first ciphertext Care put into the collision-resistant function H to calculate a function value of the function H; and it is judged whether rcorresponding to the function value satisfies C=r&#xb7;(&#x3a3;v&#xb7;b)+&#x3c1;&#xb7;b&#x2208;G.

Encryption apparatus, decryption apparatus, encryption method, decryption method, security method, program, and recording medium

A signature is generated by a scheme in which x denotes a secret key of a signature generating apparatus, m&#x2208;{0, 1}denotes a recovery message, k denotes an arbitrary value, g denotes a generator of a cyclic group G of order q, R represents g&#x2208;G, Hrepresents a hash function H: {0, 1}*&#x2192;{0, 1}, Hrepresents a hash function H: {0, 1}*&#x2192;{0, 1}that has a variable output length, Hrepresents a hash function H: {0, 1}*&#x2192;Z, r=H(R, m)|m(+)H(R, H(R, m)), where (+) represents an exclusive-OR operator, t is defined for &#x3b3;, which depends on r, as t=H(&#x3b3;), s is defined as s=k&#x2212;t&#xb7;x&#x2208;Z, and a signature is &#x3c3;=(r, s).

Signature generating apparatus, signature verifying apparatus, and methods and programs therefor

A bid-opening devicereceives from each bidding devicea bidding price index &#x3b3;=g(h(IV)) (where IVis an initial value, hindicates k-times processing with a one-way function h and g is a one-way function) and its identifier ID. The received information is stored on a common bulletin board. D=h(IV) (where D=g(D) is generated with k set as the upper limit value K of the bidding price. The bulletin boardis checked for &#x3b3;which matches this D. If no match is found, m is incremented by one, and the check for &#x3b3;&#x2212;Dmatching is made for each of m bidding devices. Upon completion of the matching for all the bidding devices, k is decremented by one, and a check is made for &#x3b3;which matches D=g(h(IV)), and the index k for which they match is determined as the highest price bid. The bid-opening deviceoutputs that k and the identifier IDof &#x3b3;.

System and method for quantitative competition and recording medium having recorded thereon program for implementing the method

A tag device causes a second calculator to read a confidential value from a confidential value memory and to apply a second function Fwhich disturbs a relationship between elements of a definition domain and a mapping thereof to generate tag output information. The tag device delivers the tag output information to a backend apparatus. Subsequently, a first calculator reads out at least part of elements of the confidential value from the confidential value memory, and applies a first function F, an inverse image of which is difficult to obtain, and a result of such calculation is used to update a confidential value in the confidential value memory by overwriting.

Growing community of inventors

Tokyo, Japan

Koutarou Suzuki