Re-encryption device, cryptographic system, re-encryption method, and computer readable medium
An encryption device ( 30 ) generates a session key K and a ciphertext ct S in which the session key K is encrypted that are generated by an encryption algorithm using as input attribute information S. A re-encryption key generation device ( 40 ) generates a re-encryption key rk including a converted decryption key sk Γ ˜ generated by setting a random number r in a decryption key sk Γ with which the ciphertext ct S can be decrypted, a session key K′ and a ciphertext ct S′ that are generated by the encryption algorithm using as input attribute information S′, and conversion information generated from the random number r. A re-encryption device ( 50 ) outputs a re-encrypted ciphertext rct S′ including the ciphertext ct S′ and a cipher element K ˜ generated by deleting an element related to the random number r by the conversion information from decryption information K{circumflex over ( )} obtained by decrypting the ciphertext ct S with the converted decryption key sk Γ ˜ and setting the session key K′.
1. A re-encryption device comprising
processing circuitry to:
acquire a ciphertext cts out of a session K and the ciphertext cts in which the session key K is encrypted that are generated by an encryption algorithm using as input attribute information S that defines a range to be permitted decryption;
acquire a re-encryption key rk including a converted decryption key sk Γ ˜ that is generated by setting a random number r in a decryption key sk Γ with which the ciphertext cts can be decrypted, a session key K′ and a ciphertext cts′ in which the session key K′ is encrypted that are generated by the encryption algorithm using as input attribute information S′ that defines a range to be permitted decryption, and conversion information that is generated from the random number r;
generate a cipher element K ˜ by deleting an element related to the random number r by the conversion information from decryption information K{circumflex over ( )} and setting the session key K′, the decryption information K{circumflex over ( )} being obtained by decrypting the ciphertext cts with the converted decryption key sk Γ ˜ included in the re-encryption key rk; and
output a re-encrypted ciphertext rcts′ including the cipher element K ˜ and the ciphertext cts′.
2. The re-encryption device according to claim 1 ,
wherein the ciphertext cts includes a cipher element c 0 , which is a vector in a basis B 0 ,
wherein the decryption key sk Γ includes a key element k* 0 , which is a vector in a basis B* 0 ,
wherein the converted decryption key sk Γ ˜ is generated by setting the random number r in a certain basis vector of the basis B* 0 ,
wherein the conversion information is obtained by multiplying an element A by the random number r, the element A being obtained by performing a pairing operation on an element of the basis B 0 and an element of the basis B* 0 , and
wherein the processing circuitry generates the decryption information K{circumflex over ( )} by performing a pairing operation on a cipher element c of the ciphertext cts and a key element k* of the converted decryption key sk Γ ˜ , and generates the session key K by dividing the decryption information K{circumflex over ( )} by the conversion information.
3. The re-encryption device according to claim 2 ,
wherein the processing circuitry acquires the ciphertext cts indicated in Formula 8,
acquires the re-encryption key rk indicated in Formula 9, and
generates the cipher element K ˜ indicated in Formula 10
[Formula 8]
= ( := (M, ρ), {c i } i=0, . . . ,L ) → Enc(pk, := (M, ρ))
where
Enc(pk, := (M, ρ)):
f
→
←
U
𝔽
q
r
,
s
→
T
:=
(
s
1
,
.
.
.
,
s
L
)
T
:=
M
·
f
→
T
,
s
0
:=
1
→
·
f
→
T
,
η
0
,
ς
←
U
𝔽
q
,
c
0
:=
c
+
(
ς
,
-
s
0
,
0
,
0
,
η
0
,
0
)
𝔹
0
,
for i = 1, . . . , L,
if ρ(i) = (t, {right arrow over (v)} i := (v i,1 , . . . , v i,n t ) ∈ q n t \{{right arrow over (0)}})(v i,n t ≠ 0),
θ
i
,
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
e
→
t
,
1
+
θ
i
v
→
i
︷
n
t
,
0
n
t
︷
n
i
,
0
n
t
︷
n
t
,
η
i
︷
1
)
𝔹
t
,
if ρ(i) = ¬(t, {right arrow over (v)} i ),
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
v
→
i
︷
n
i
,
0
n
t
︷
n
t
,
0
n
t
︷
n
i
,
η
i
︷
1
)
𝔹
i
,
return := ( , {c i } i=0, . . . ,L ), K
[Formula 9]
rk := (s{tilde over (k)} Γ . A r · K′, ′ )
where
s{tilde over (k)} Γ := (Γ, k 0 * + rb 0,6 *, ∈Γ ),
k 0 * :=
k
t
*
:=
(
δ
x
→
t
︷
n
i
,
0
n
t
︷
n
t
,
φ
→
t
︷
n
i
,
0
︷
1
)
𝔹
t
*
for
(
t
,
x
→
t
)
∈
Γ
,
δ
,
φ
0
,
r
←
U
𝔽
q
,
φ
→
t
←
U
𝔽
q
n
t
for
(
t
,
x
→
t
)
∈
Γ
,
( ′ ), K′), → Enc(pk, ′)
[Formula 10]
{tilde over (K)} := {circumflex over (K)}/A r · K′,
where
K
^
:=
e
(
c
0
,
k
0
*
)
∏
i
∈
I
∧
ρ
(
i
)
=
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
∏
i
∈
I
∧
ρ
(
i
)
=
¬
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
/
(
v
→
i
·
x
→
t
)
,
{right arrow over (1)} = Σ i∈I α i M i ,
I ⊆ {i ∈ {1, . . . , L}|[ρ(i) = (t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t = 0] ∨
[ρ(i) = ¬(t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t ≠ 0]},
M i is i-th row of M.
4. The re-encryption device according to claim 1 ,
wherein the processing circuitry acquires the ciphertext cts indicated in Formula 1,
acquires the re-encryption key rk indicated in Formula 2, and
generates the cipher element K ˜ indicated in Formula 3
[Formula 1]
= ( := (M, ρ), {c i } i=0, . . . ,L ) → Enc(pk, := (M, ρ))
where
Enc(pk, := (M, ρ)):
f
→
←
U
𝔽
q
r
,
s
→
T
:=
(
s
1
,
.
.
.
,
s
L
)
T
:=
M
·
f
→
T
,
s
0
:=
1
→
·
f
→
T
,
η
0
,
ς
←
U
𝔽
q
,
c
0
:=
c
+
(
ς
,
-
s
0
,
0
,
0
,
η
0
,
0
)
𝔹
0
,
for i = 1, . . . , L,
if ρ(i) = (t, {right arrow over (v)} i := (v i,1 , . . . , v i,n t ) ∈ q n t \{{right arrow over (0)}})(v i,n t ≠ 0),
θ
i
,
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
e
→
t
,
1
+
θ
i
v
→
i
︷
n
t
,
0
n
t
︷
n
t
,
0
n
t
︷
n
i
,
η
i
︷
1
)
𝔹
t
,
if ρ(i) = ¬(t, {right arrow over (v)} i ),
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
v
→
i
︷
n
t
,
0
n
t
︷
n
i
,
0
n
t
︷
n
t
,
η
i
︷
1
)
𝔹
i
,
return := ( , {c i } i=0, . . . ,L ), K
[Formula 2]
rk := (s{tilde over (k)} Γ . A r · K′, ′ )
where
s{tilde over (k)} Γ := (Γ, k 0 * + rb 0,6 *, ∈Γ ),
k 0 * :=
k
t
*
:=
(
δ
x
→
t
︷
n
t
,
0
n
t
︷
n
t
,
φ
→
t
︷
n
i
,
0
︷
1
)
𝔹
t
*
for
(
t
,
x
→
t
)
∈
Γ
,
δ
,
φ
0
,
r
←
U
𝔽
q
,
φ
→
t
←
U
𝔽
q
n
t
for
(
t
,
x
→
t
)
∈
Γ
,
( ′ ), K′), → Enc(pk, ′)
[Formula 3]
{tilde over (K)} := {circumflex over (K)}/A r · K′,
where
K
^
:=
e
(
c
0
,
k
0
*
)
∏
i
∈
I
∧
ρ
(
i
)
=
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
∏
i
∈
I
∧
ρ
(
i
)
=
¬
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
/
(
v
→
i
·
x
→
t
)
,
{right arrow over (1)} = Σ i∈I α i M i ,
I ⊆ {i ∈ {1, . . . , L}|[ρ(i) = (t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t = 0] ∨
[ρ(i) = ¬(t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t ≠ 0]},
M i is i-th row of M.
5. A cryptographic system comprising:
an encryption device to generate a ciphertext cts out of a session key K and the ciphertext cts in which the session key K is encrypted that are generated by an encryption algorithm using as input attribute information S that defines a range to be permitted decryption;
a re-encryption key generation device to generate a re-encryption key rk including a converted decryption key sk Γ ˜ that is generated by setting a random number r in a decryption key sk Γ with which the ciphertext cts can be decrypted, a session key K′ and a ciphertext cts′ in which the session key K′ is encrypted that are generated by the encryption algorithm using as input attribute information S′ that defines a range to be permitted decryption, and conversion information that is generated from the random number r; and
a re-encryption device to generate a cipher element K ˜ by deleting an element related to the random number r by the conversion information from decryption information K{circumflex over ( )} and setting the session key K′, the decryption information K{circumflex over ( )} being obtained by decrypting the ciphertext cts with the converted decryption key sk Γ ˜included in the re-encryption key rk, and output a re-encrypted ciphertext rcts′ including the cipher element K ˜ and the ciphertext cts′.
6. The cryptographic system according to claim 5 ,
wherein the ciphertext cts includes a cipher element c 0 , which is a vector in a basis B 0 ,
wherein the decryption key sk Γ includes a key element k* 0 , which is a vector in a basis B* 0 ,
wherein the converted decryption key sk Γ ˜ is generated by setting the random number r in a certain basis vector of the basis B* 0 ,
wherein the conversion information is obtained by multiplying an element A by the random number r, the element A being obtained by performing a pairing operation on an element of the basis B 0 and an element of the basis B* 0 , and
wherein the re-encryption device generates the decryption information K{circumflex over ( )} by performing a pairing operation on a cipher element c of the ciphertext cts and a key element k* of the converted decryption key sk Γ ˜ , and generates the session key K by dividing the decryption information K{circumflex over ( )} by the conversion information.
7. The cryptographic system according to claim 6 ,
wherein the encryption device generates the ciphertext cts indicated in Formula 11,
wherein the re-encryption key generation device generates the re-encryption key rk indicated in Formula 12, and
wherein the re-encryption device generates the cipher element K ˜ indicated in Formula 13
[Formula 11]
= ( := (M, ρ), {c i } i=0, . . . ,L ) → Enc(pk, := (M, ρ))
where
Enc(pk, := (M, ρ)):
f
→
←
U
𝔽
q
r
,
s
→
T
:=
(
s
1
,
.
.
.
,
s
L
)
T
:=
M
·
f
→
T
,
s
0
:=
1
→
·
f
→
T
,
η
0
,
ς
←
U
𝔽
q
,
c
0
:=
c
+
(
ς
,
-
s
0
,
0
,
0
,
η
0
,
0
)
𝔹
0
,
for i = 1, . . . , L,
if ρ(i) = (t, {right arrow over (v)} i := (v i,1 , . . . , v i,n t ) ∈ q n t \{{right arrow over (0)}})(v i,n t ≠ 0),
θ
i
,
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
e
→
t
,
1
+
θ
i
v
→
i
︷
n
t
,
0
n
i
︷
n
t
,
0
n
t
︷
n
t
,
η
i
︷
1
)
𝔹
t
,
if ρ(i) = ¬(t, {right arrow over (v)} i ),
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
v
→
i
︷
n
t
,
0
n
i
︷
n
i
,
0
n
t
︷
n
t
,
η
i
︷
1
)
𝔹
t
,
return := ( , {c i } i=0, . . . ,L ), K
[Formula 12]
rk := (s{tilde over (k)} Γ , A r · K′, ′ )
where
s{tilde over (k)} Γ := (Γ, k 0 * + rb 0,6 *, ∈Γ ),
k 0 *:=
k
t
*
:=
(
δ
x
→
t
︷
n
t
,
0
n
t
︷
n
t
,
φ
→
t
︷
n
t
,
0
︷
1
)
𝔹
t
*
for
(
t
,
x
→
t
)
∈
Γ
,
δ
,
φ
0
,
r
←
U
𝔽
q
,
φ
→
t
←
U
𝔽
q
n
t
for
(
t
,
x
→
t
)
∈
Γ
,
( ′ ), K′), → Enc(pk, ′)
[Formula 13]
{tilde over (K)} := {circumflex over (K)}/A r · K′,
where
K
^
:=
e
(
c
0
,
k
0
*
)
∏
i
∈
I
∧
ρ
(
i
)
=
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
∏
i
∈
I
∧
ρ
(
i
)
=
¬
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
/
(
v
→
i
·
x
→
t
)
,
{right arrow over (1)} = Σ i∈I α i M i ,
I ⊆ {i ∈ {1, . . . , L}|[ρ(i) = (t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t = 0] ∨
[ρ(i) = ¬(t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t ≠ 0]},
M i is i-th row of M.
8. The cryptographic system according to claim 7 , further comprising
a decryption device to decrypt the ciphertext cts′ included in the re-encrypted ciphertext rcts′ with a decryption key sk Γ′ so as to generate the session key K′, and generate the session key K from a cipher element K ˜ included in the re-encrypted ciphertext rcts′ and the session key K′.
9. The cryptographic system according to claim 8 ,
wherein the decryption device generates the session key K indicated in Formula 14
K:={tilde over (K)}·K′ [Formula 14].
10. The cryptographic system according to claim 5 ,
wherein the encryption device generates the ciphertext cts indicated in Formula 4,
wherein the re-encryption key generation device generates the re-encryption key rk indicated in Formula 5, and
wherein the re-encryption device generates the cipher element K ˜ indicated in Formula 6
[Formula 4]
= ( := (M, ρ), {c i } i=0, . . . ,L ) → Enc(pk, := (M, ρ))
where
Enc(pk, := (M, ρ)):
f
→
←
U
𝔽
q
r
,
s
→
T
:=
(
s
1
,
.
.
.
,
s
L
)
T
:=
M
·
f
→
T
,
s
0
:=
1
→
·
f
→
T
,
η
0
,
ς
←
U
𝔽
q
,
c
0
:=
c
+
(
ς
,
-
s
0
,
0
,
0
,
η
0
,
0
)
𝔹
0
,
for i = 1, . . . , L,
if ρ(i) = (t, {right arrow over (v)} i := (v i,1 , . . . , v i,n t ) ∈ q n t \{{right arrow over (0)}})(v i,n t ≠ 0),
θ
i
,
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
e
→
t
,
1
+
θ
i
v
→
i
︷
n
t
,
0
n
t
︷
n
i
,
0
n
t
︷
n
i
,
η
i
︷
1
)
𝔹
t
,
if ρ(i) = ¬(t, {right arrow over (v)} i ),
η
i
←
U
𝔽
q
,
c
i
:=
(
s
i
v
→
i
︷
n
t
,
0
n
t
︷
n
i
,
0
n
t
︷
n
i
,
η
i
︷
1
)
𝔹
i
,
return := ( , {c i } i=0, . . . ,L ), K
[Formula 5]
rk := (s{tilde over (k)} Γ . A r · K′, ′ )
where
s{tilde over (k)} Γ := (Γ, k 0 * + rb 0,6 *, ∈Γ ),
k* 0 :=
k
t
*
:=
(
δ
x
→
t
︷
n
t
,
0
n
t
︷
n
t
,
φ
→
t
︷
n
t
,
0
︷
1
)
𝔹
t
*
for
(
t
,
x
→
t
)
∈
Γ
,
δ
,
φ
0
,
r
←
U
𝔽
q
,
φ
→
t
←
U
𝔽
q
n
t
for
(
t
,
x
→
t
)
∈
Γ
,
( ′ ), K′), → Enc(pk, ′)
[Formula 6]
{tilde over (K)} := {circumflex over (K)}/A r · K′,
where
K
^
:=
e
(
c
0
,
k
0
*
)
∏
i
∈
I
∧
ρ
(
i
)
=
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
∏
i
∈
I
∧
ρ
(
i
)
=
¬
(
t
,
v
→
i
)
e
(
c
i
,
k
t
*
)
α
i
/
(
v
→
i
·
x
→
t
)
,
{right arrow over (1)} = Σ i∈I α i M i ,
I ⊆ {i ∈ {1, . . . , L}|[ρ(i) = (t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t = 0] ∨
[ρ(i) = ¬(t, {right arrow over (v)} i ) ∧ (t, {right arrow over (x)} t ) ∈ Γ ∧ {right arrow over (v)} i · {right arrow over (x)} t ≠ 0]},
M i is i-th row of M.
11. The cryptographic system according to claim 10 , further comprising
a decryption device to decrypt the ciphertext cts′ included in the re-encrypted ciphertext rcts′ with a decryption key sk Γ′ so as to generate the session key K′, and generate the session key K from a cipher element K ˜ included in the re-encrypted ciphertext rcts′ and the session key K′.
12. The cryptographic system according to claim 11 ,
wherein the decryption device generates the session key K indicated in Formula 7
K:={tilde over (K)}·K′ [Formula 7].
13. A re-encryption method comprising:
acquiring a ciphertext cts out of a session K and the ciphertext cts in which the session key K is encrypted that are generated by an encryption algorithm using as input attribute information S that defines a range to be permitted decryption;
acquiring a re-encryption key rk including a converted decryption key sk Γ ˜ that is generated by setting a random number r in a decryption key sk Γ with which the ciphertext cts can be decrypted, a session key K′ and a ciphertext cts′ in which the session key K′ is encrypted that are generated by the encryption algorithm using as input attribute information S′ that defines a range to be permitted decryption, and conversion information that is generated from the random number r;
generating a cipher element K ˜ by deleting an element related to the random number r by the conversion information from decryption information K{circumflex over ( )} and setting the session key K′, the decryption information K{circumflex over ( )} being obtained by decrypting the ciphertext cts with the converted decryption key sk Γ ˜ included in the re-encryption key rk; and
outputting a re-encrypted ciphertext rcts′ including the cipher element K ˜ and the ciphertext cts ′.
14. A non-transitory computer readable medium storing a re-encryption program that causes a computer to function as a re-encryption device to perform:
a ciphertext acquisition process of acquiring a ciphertext cts out of a session K and the ciphertext cts in which the session key K is encrypted that are generated by an encryption algorithm using as input attribute information S that defines a range to be permitted decryption;
a key acquisition process of acquiring a re-encryption key rk including a converted decryption key sk Γ ˜ that is generated by setting a random number r in a decryption key sk Γ with which the ciphertext cts can be decrypted, a session key K′ and a ciphertext cts′ in which the session key K′ is encrypted that are generated by the encryption algorithm using as input attribute information S′ that defines a range to be permitted decryption, and conversion information that is generated from the random number r;
a re-encrypted ciphertext generation process of generating a cipher element K ˜ by deleting an element related to the random number r by the conversion information from decryption information K{circumflex over ( )} and setting the session key K′, the decryption information K{circumflex over ( )} being obtained by decrypting the ciphertext cts with the converted decryption key sk Γ ˜ included in the re-encryption key rk; and
an output process of outputting a re-encrypted ciphertext rcts′ including the cipher element K ˜ and the ciphertext cts′.