Key agreement system, shared-key generation apparatus, and shared-key recovery apparatus

Abstract

Provided is a content distribution system that prevents different keys to be derived between an encryption apparatus and a decryption apparatus. A random-number generating unit, in an encryption apparatus, generates a random number s, and a first function unitgenerates a functional value G(s) of the random number s, and generates a verification value a and a shared key K from the functional value G(s). An encryption unitgenerates a first cipher text cof the verification value a using a public-key polynomial h, and a second function unitgenerates a functional value H(a,c) of the verification value a and the first cipher text c, and a random-number mask unitgenerates a second cipher text c=s xor H(a,c). A decryption unit, in a decryption apparatus, decrypts the first cipher text cusing a secret-key polynomial f, to generate a decryption verification value a'. A third function unit 124generates a functional value H(a′,c) of the decryption verification value a′ and the first cipher text c, and a random-number mask removal unitgenerates a decryption random number s′=cxor H(a′,c). A fourth function unitgenerates a hash functional value G(s′) of the decryption random number s′, and generates a verification value a″ and a shared key K′ from the functional value G(s′) A comparison unitoutputs the shared key K′ if the decryption verification value a′ is equal to the verification value a″.