Encryption device, decryption device, storage system, information processing device, encryption method, decryption method, decompression device, and decompression method
According to one embodiment, an encryption device includes a generator configured to generate an N-dimensional random number vector, a calculator configured to calculate a value of a predetermined function for the random number vector, and an encryption circuit configured to encrypt the leading component by a public key of N rows and (n+1) columns having an (n+1)-dimensional regular submatrix and the N-dimensional random number vector and encrypt each of the subsequent components by the public key and an output of the calculator.
1 . A decompression device including circuitry to receive a compressed ciphertext block and decompress the compressed ciphertext block including a leading component ciphertext and subsequent component compressed ciphertexts and output a ciphertext block, wherein:
the leading component ciphertext includes a leading subcomponent and a subsequent subcomponent;
each of the subsequent component compressed ciphertexts includes a leading subcomponent;
the decompression device comprises:
a random number restoration circuit to restore a random number vector encrypted by a public key relating to the ciphertext block from the leading component ciphertext;
a calculator circuit to calculate a value of predetermined function for the random number vector encrypted by the public key; and
a decompression circuit to receive compressed ciphertext blocks, calculate a difference between each of the subsequent component compressed ciphertexts and a product as the leading subcomponent of each of the subsequent component ciphertexts, each of the subsequent component compresses ciphertexts being encrypted by the public key, the product being a leading row of a transposed matrix of the public key and the value of the predetermined function for the random number vector encrypted by the public key, and output a ciphertext block including the leading component ciphertext and the subsequent component ciphertexts.
2 . A storage system comprising:
a decompression device including circuitry to receive a compressed ciphertext block and decompress the compressed ciphertext block including a leading component ciphertext and subsequent component compressed ciphertexts and output a ciphertext block, wherein:
the leading component ciphertext includes a leading subcomponent and a subsequent subcomponent;
each of the subsequent component compressed ciphertexts includes a leading subcomponent;
the decompression device comprises:
a random number restoration circuit to restore a random number vector encrypted by a public key relating to the ciphertext block from the leading component ciphertext;
a calculator circuit to calculate a value of predetermined function for the random number vector encrypted by the public key; and
a decompression circuit to calculate a difference between each of the subsequent component compressed ciphertexts and a product as the leading subcomponent of each of the subsequent component ciphertexts, each of the subsequent component compresses ciphertexts being encrypted by the public key, the product being a leading row of a transposed matrix of the public key and the value of the predetermined function for the random number vector encrypted by the public key, and output a ciphertext block including the leading component ciphertext and the subsequent component ciphertexts;
a storage medium; and
a controller circuit to write the ciphertext block output from the decompression device to the storage medium.
3 . The storage system of claim 2 , wherein
the controller includes a calculator circuit to perform a secure calculation on the ciphertext block output from the decompression device in an encrypted state and write a result of the secure calculation to the storage medium.
4 . An information processing device comprising:
a decompression device including circuitry to receive a compressed ciphertext block and decompress the compressed ciphertext block including a leading component ciphertext and subsequent component compressed ciphertexts and output a ciphertext block, wherein:
the leading component ciphertext includes a leading subcomponent and a subsequent subcomponent;
each of the subsequent component compressed ciphertexts includes a leading subcomponent;
the decompression device comprises:
a random number restoration circuit to restore a random number vector encrypted by a public key relating to the ciphertext block from the leading component ciphertext;
a calculator circuit to calculate a value of predetermined function for the random number vector encrypted by the public key; and
a decompression circuit to calculate a difference between each of the subsequent component compressed ciphertexts and a product as the leading subcomponent of each of the subsequent component ciphertexts, each of the subsequent component compresses ciphertexts being encrypted by the public key, the product being a leading row of a transposed matrix of the public key and the value of the predetermined function for the random number vector encrypted by the public key, and output a ciphertext block including the leading component ciphertext and the subsequent component ciphertexts; and
a calculator circuit to perform a calculation on the ciphertext block output from the decompression device in an encrypted state.
5 . A decompression method for receiving a compressed ciphertext block and decompressing the compressed ciphertext block including a leading component ciphertext and subsequent component compressed ciphertexts and outputting a ciphertext block, wherein:
the leading component ciphertext includes a leading subcomponent and a subsequent subcomponent; and
each of the subsequent component compressed ciphertexts includes a leading subcomponent;
the decompression method comprises:
restoring a random number vector encrypted by a public key relating to the ciphertext block from the leading component ciphertext;
calculating a value of a predetermined function for the random number vector encrypted by the public key;
calculating a difference between each of the subsequent component compressed ciphertexts and a product as the leading subcomponent of each of the subsequent component ciphertexts, each of the subsequent component compresses ciphertexts being encrypted by the public key, the product being a leading row of a transposed matrix of the public key and the value of the predetermined function for the random number vector encrypted by the public key; and
outputting a ciphertext block including the leading component ciphertext and the subsequent component ciphertexts.
6 . The decompression device of claim 1 , wherein
the decompressed ciphertext block includes the leading component ciphertext and a list of ciphertexts of leading subcomponents of the subsequent component compressed ciphertexts.
7 . The decompression device of claim 1 , wherein
the compressed ciphertext block relates to a lattice-based cryptography which is cipher constructed using a lattice; and
the lattice is a set of vectors that is represented by an integer linear combination of basis vectors.
8 . The decompression device of claim 1 , wherein
each of the subsequent component compressed ciphertexts does not include subsequent subcomponents.
9 . The decompression device of claim 1 , wherein
a random number restoration circuit is configured to perform homomorphic restoration of a partial random number vector encrypted by the public key and homomorphic restoration of the random number vector encrypted by the public key from the partial random number vector.
10 . The decompression device of claim 1 , wherein
the predetermined function comprises a bit-rotation function, a one-way function, or a permutation function.
11 . The decompression device of claim 1 , wherein
the public key comprises N row vectors including an N-row and (n+1)-column matrix having (n+1)-dimensional regular submatrix;
the random number vector comprises an N-dimensional random number vector generated from (n+1)-dimensional primary independent partial random number vector;
n and N are positive integers; and
(n+1) is smaller than N.
12 . The decompression device of claim 11 , wherein
the leading component ciphertext corresponds to a leading component; and
the leading component ciphertext comprises a ciphertext generated by encrypting the leading component with the public key and the N-dimensional random number vector.
13 . The decompression device of claim 12 , wherein
the subsequent component compressed ciphertexts respectively correspond to subsequent component plaintexts;
the subsequent component compressed ciphertexts respectively comprise ciphertexts; and
each of the ciphertexts of the subsequent component compressed ciphertexts is generated by encrypting each of the subsequent component plaintexts with the public key and a value obtained by calculating, a predetermined number of times, a value of a predetermined function for the N-dimensional random number vector.
14 . The decompression device of claim 12 , wherein
an i-th row of the (n+1)-dimensional regular submatrix matches an i-th row of the public key; and
an i-th component of the random number vector coincides with an i-th component of the (n+1)-dimensional primary independent partial random number vector.