Hierarchical Time-Released Proxy Re-Encryption
6
0
0
全文
(2) Vol.2014-DPS-158 No.11 Vol.2014-CSEC-64 No.11 2014/3/6. ใॲཧֶձڀݚใࠂ IPSJ SIG Technical Report. ΔɻmDBDH ͱ DBDH ՁͰ͋Δ [1]ɻ. 2.2 Proxy Re-Encryption Proxy Re-Encryption(PRE) ͱຊདྷͷ҉߸จͷड৴ऀ A ͕ɺड͚औͬͨ҉߸จΛ৴པͰ͖Δୈ 3 ऀͰ͋Δ Proxy. 3. ఏҊํࣜ. ʹૹ৴͠ɺProxy ͕ड৴ऀ A ͕ࢦఆͨ͠ϢʔβѼͯͷ҉߸. 3.1 ఆٛ. จʹมߋͰ͖ΔػೳΛ࣋ͭ҉߸ํࣜͰ͋Δɻ·ͨҎԼͷΑ. hTR-PRE (Setup,KeyGen,TS-Release,ReKeyGen,Enc, ReEnc,Dec) ͷ 7 ͭͷΞϧΰϦζϜͰߏ͞ΕΔɻ. ͏ͳੑ࣭Λ࣋ͭɻ. • single-hop/multi-hopɿ࠶҉߸Խͨ͠҉߸จΛߋʹผ ͷϢʔβͷൿີͰݤ෮߸Ͱ͖Δ҉߸จʹ࠶҉߸ԽͰ͖. ʕ Setup. ΔํࣜΛ multi-hopɺ࠶҉߸ԽΛͨ͠҉߸จΛߋʹ࠶. Setup(1k ) → (params, tspriv ). ҉߸Խ͢Δ͜ͱ͕Ͱ͖ͳ͍ํࣜ single-hop ͱ͍͏ɻ. ηΩϡϦςΟύϥϝʔλ 1k Λೖྗͱ͠ެ։ύϥϝʔλ. • bidirectinal/unidirectinal ɿϢʔβ A ͱϢʔβ B ؒͷ ࠶҉߸ԽݤΛ༻͍ͯϢʔβ A Ѽͯͷ҉߸จ CA ΛϢʔ. params ͱλΠϜαʔόͷൿີ ݤtspriv Λग़ྗ͢Δɻ ʕ KeyGeneration. β B Ѽͯͷ҉߸จ CB ʹม͖Ͱɺ·ͨϢʔβ B Ѽ. KeyGen(1k ) → (pk, sk). ͯͷ҉߸จ CB ΛϢʔβ A Ѽͯͷ҉߸จ CA ʹมͰ. ηΩϡϦςΟύϥϝʔλ 1k Λೖྗͱ͠ެ։ ݤpk ɺൿ. ͖ΔํࣜΛ bidirectinalɺͲͪΒ͔͔͠Ͱ͖ͳ͍ํࣜΛ. ີ ݤsk Λग़ྗ͢Δɻ ʕ TimeServer-Release. unidirectinal ͱ͍͏ɻ multi-hop bidirectinal PRE (KeyGen,ReKeyGen,Enc,Re. TS-Release(params, tspriv , T ) → (ST ). Enc,Dec) ͷ 5 ͭͷΞϧΰϦζϜͰߏ͞ΕΔɻ. params, tspriv ɺ։ࣔ࣌ࠁ T Λೖྗͱ͠ɺ࣌ࠁ ݤST Λ. k. ʕ KeyGenerationɿKeyGen(1 ) → (pk, sk). ग़ྗ͢Δɻ. ηΩϡϦςΟύϥϝʔλ 1k Λೖྗͱ͠ެ։ ݤpk ɺൿ. ʕ ReEncryptionKeyGeneration. ReKeyGen(params, skA , skB ) → (rkAB ). ີ ݤsk Λग़ྗ͢Δɻ. paramsɺ2 ͭͷൿີ ݤskA , skB Λೖྗͱ͠ɺ࠶҉߸. ʕ ReEncryptionKeyGenerationɿ. ReKeyGen(skA , skB ) → rkAB. Խ ݤrkAB Λग़ྗ͢Δɻ. 2 ͭͷൿີ ݤskA , skB Λೖྗͱ͠ɺ࠶҉߸Խ ݤrkAB. ʕ Encryption. Enc(params, pk, m, T ) → C. Λग़ྗ͢Δɻ ʕ Encryption ɿ Enc(pk, m) → C. ެ։ ݤpk ɺϝοηʔδ mɺ։ࣔ࣌ࠁ T Λೖྗͱ͠҉. ެ։ ݤpk ɺϝοηʔδ m Λೖྗͱ͠҉߸จ C Λग़ྗ. ߸จ C Λग़ྗ͢Δɻ ʕ ReEncryption. ͢Δɻ. ReEnc(params, rkAB , CA ) → CB. ʕ ReEncryption ɿ ReEnc(rkAB , CA ) → CB ࠶҉߸Խ ݤrkAB ɺϢʔβ A Ѽͷ҉߸จ CA Λೖྗͱ. paramsɺ࠶҉߸Խ ݤrkAB ɺϢʔβ A Ѽͷ҉߸จ CA. ͠Ϣʔβ B Ѽͷ҉߸จ CB Λग़ྗ͢Δɻ. Λೖྗͱ͠Ϣʔβ B Ѽͷ҉߸จ CB Λग़ྗ͢Δɻ͋. ʕ Decryption ɿ Dec(sk, C) → m. Δ͍˵ Λग़ྗ͢Δɻ. ൿີ ݤsk ɺ҉߸จ C Λೖྗͱ͠ɺϝοηʔδ m Λग़. ʕ Decryption. Dec(params, sk, pk, C, ST ) → m. ྗ͢Δɻ͋Δ͍ ⊥ Λग़ྗ͢Δɻ. paramsɺൿີ ݤsk ɺެ։ ݤpk ɺ҉߸จ C ɺ࣌ࠁ ݤST Λೖྗͱ͠ɺϝοηʔδ m Λग़ྗ͢Δɻ͋Δ͍˵. 2.3 ఆઢ ܕDiffie-HellmanʢDBDHʣԾఆ DBDH Ծఆͱ DBDH ͕͍͠ͱ͍͏ԾఆͰ͋. Λग़ྗ͢Δɻ. Δ ɻૉ p Λ Ґ ͱ ͠ ͨ ͷ ܈G, GT ʹ ϖ Ξ Ϧ ϯ ά ԋ ࢉ e(G × G → GT ) ͕ఆٛ͞Ε͍ͯΔͱ͢Δɻ͜ͷ࣌ a. b. c. g ∈ G ʹ͓͍ͯ < g, g , g , g , T > ͷ͕༩͑ΒΕͨͱ͖ T = e(g, g)abc ͘͠ T ͕ϥϯμϜͰ͋Δɺͱఆ͢Δ. 3.2 ҆શੑఆٛ 3.2.1 ४උ ೖྗ݅Λ໌֬ʹ͢ΔͨΊʹެ։ʹݤϥϕϧΛ͚ɺແ. Λɺఆઢ ܕDiffie-Hellman(DBDH) ͱ͍͏ɻ. άϥϑ (V,E) Λߟ͑ΔɻUncorrupted key generation Φ. DBDH ͕ղ͚Δ Algorithm B ͷޭ֬ AdvB ࣍. ϥΫϧͷΫΤϦͰಘͨ pk ʹϥϕϧʠuncorruptedʡΛ. a. b. c. abc. ͷΑ͏ʹͳΔɻAdvB = |P r[B(g, g , g , g , e(g, g). ) = 1]. ͚ΔɻCorrupted key generation ΦϥΫϧͷΫΤϦͰಘ. − P r[B(g, g a , g b , g c , R) = 1]|. AdvB ͕ negligible Ͱ͋Δͱ. ͨ pk ʹϥϕϧʠcorruptedʡΛ͚ΔɻνϟϨϯδެ։ݤ. ͖ DBDH Ծఆ͕Γཱͭͱ͍͏ɻຊͰڀݚ DBDH . pk ∗ ʹϥϕϧʠtargetʡΛ͚Δɻ࣍ʹແάϥϑ (V,E). Λมߋͨ͠ Modified DBDH(mDBDH) Λ༻͍Δɻ۩. Λఆٛ͢Δɻ. ମతʹ e(g, g)abc ͱ͍ͯͨ͠ͱ͜ΖΛɺe(g, g)ab/c ͱ͢. ⓒ 2014 Information Processing Society of Japan. • V = {pkA , pkB , pkC , ...}, E ⊆ V × V 2.
(3) Vol.2014-DPS-158 No.11 Vol.2014-CSEC-64 No.11 2014/3/6. ใॲཧֶձڀݚใࠂ IPSJ SIG Technical Report. • V ɿެ։ݤͷू߹. ༧͠ग़ྗ͢Δɻ. • Τοδ (pkA , pkB ) ∈ E ⇔ʠϢʔβ AɺϢʔβ B ؒͰ ͠ b ͱ b ͕͚͠Ε A ͷউརͱͳΔɻA ͷউར֬. ࠶҉߸Խ ݤrkAB ͕ੜࡁΈʡ Ҏ্ͷΑ͏ͳάϥϑͷதͰ target ΛؚΉ࿈݁Λʠtarget. Λ࣍ͷΑ͏ʹఆٛ͢ΔɻAdvΓ,A (1k ) = 2P r[b = b ] − 1. άϧʔϓ (Target)ʡɺcorrupted ΛؚΉ࿈݁ΛʠCor-. ఆٛ 1ɿhTR-PRE ํࣜ Γ ʹର͢Δҙͷଟ߲ࣜ࣌ؒΞϧ. rupted άϧʔϓ (Corrupted)ʡɺͦΕҎ֎ΛʠUncorrupted. ΰϦζϜ A ͷউར֬ AdvΓ,A (1k ) ͕ negligible Ͱ͋Δ࣌. άϧʔϓ (Uncorrupted)ʡͱͿݺɻ·ͨɺTarget ͱ Uncor-. Γ Malicious TimeServer Security Λຬͨ͢ͱ͍͏ɻ. rupted ؒͰΤοδ͕ுΒΕΔ߹͕͋Δ͕ͦͷ߹࿈ ͕݁ͯ͢ Target ͱͳΔɻྫ͑ɺpkA ∈Target ͱ. pkB ∈Uncorupted ؒͰ࠶҉߸Խ ݤrkAB ͕ੜ͞Εͨ ߹ pkB ΛؚΉάϧʔϓ Target ͱͳΔɻ·ͨ҉߸จ C˄. 3.2.3 Malicious User Security hTR-PRE ํࣜ Γ ʹର͢Δ Malicious User Security Λఆ ٛ͢Δɻଟ߲ࣜ࣌ؒΞϧΰϦζϜͰ͋Δ߈ܸऀ A ͯ͢. Λ 1 ճҎ্࠶҉߸ԽΛߦ͍ಘͨ҉߸จ C ΛʠC⇐ C˄ʡͷ. ͷϢʔβͷൿີݤɺެ։ݤΛಘΔ͜ͱ͕Ͱ͖ɺઓऀ CH. Α͏ʹॻ͘ɻ. ͱҎԼͷΑ͏ͳήʔϜΛߦ͏ɻ. 3.2.2 Malicious TimeServer Security. Keygeneration. hTR-PRE ํࣜ Γ(Setup,KeyGen,TS-Release,ReKeyGen,. A ͕ΫΤϦ͢ΔͱݤϖΞ (pk, sk) ←KeyGen(1k ) Λ A ʹฦ. Enc,ReEnc,Dec) ʹର͢Δ Malicious TimeServer Security. ͢ɻ. Λఆٛ͢Δɻଟ߲ࣜ࣌ؒΞϧΰϦζϜͰ͋Δ߈ܸऀ A . TS-Rslease. TimeServer ͷൿີݤΛॴ͓࣋ͯ͠Γɺઓऀ CH ͱҎԼ. T ΛΦϥΫϧͷೖྗͱ͠ɺΦϥΫϧ࣌ࠁ ݤST ← TS-. ͷΑ͏ͳήʔϜΛߦ͏ɻ. Rslease(params, tspriv , T ) Λฦ͢ɻͨͩ͠ T = T ∗ ͷ߹. A ʹҎԼͷΦϥΫϧͷΞΫηεΛ͢ڐɻ. ⊥ Λฦ͢ɻ. Uncorrupted key generatio. Challenge k. A ͕ΫΤϦ͢Δͱ (pk, sk) ←KeyGen(1 ) Λ࣮ߦ͠ A ʹ pk. ͜ͷΦϥΫϧͷΫΤϦ 1 ճͷΈ͞ڐΕΔɻ. Λฦ͢ɻ. (pk ∗ , T ∗ , m∗0 , m∗1 ) ΛΦϥΫϧͷೖྗͱ͢Δɻpk ∗ Λνϟ Ϩϯδ key ͱ͢ΔɻΦϥΫϧ b ← {0, 1} ΛϥϯμϜʹܾ. Corrupted key generation k. A ͕ΫΤϦ͢Δͱ (pk, sk) ←KeyGen(1 ) Λ࣮ߦ͠ A ʹ. ఆ͠νϟϨϯδ҉߸จ C ∗ ←Enc(pk ∗ , T ∗ , m∗b ) Λฦ͢ɻͨ. (pk, sk) Λฦ͢ɻ. ͩ͠ೖྗ T ∗ ͕ TS-Rslease ͰΫΤϦ͞Ε͍ͯΔ߹˵Λฦ. Re-Encryption key generation. ͢ɻ. (pkA , pkB ) Λ Φ ϥ Ϋ ϧ ͷ ೖ ྗ ͱ ͠ ɺΦ ϥ Ϋ ϧ ࠶. Decryption. ҉ ߸ Խ ݤrkAB ←ReKeyGen(skA , skB ) Λ ฦ ͢ ɻͨ ͩ. (pk, T, C) Λ Φ ϥ Ϋ ϧ ͷ ೖ ྗ ͢ Δ ͱ ͠ ɺϝ ο η ʔ δ. ͠ʠpkA ∈Uncorrupted ͔ ͭ pkB ∈Corruptedʡ· ͨ . m = Dec(sk, C, ST ) Λ ฦ ͢ ɻͨ ͩ ͠ C = C ∗ · ͨ . ʠpkA ∈Corrupted ͔ͭ pkB ∈ Uncorruptedʡͷ߹ ⊥ Λ. C ⇐ C ∗ ͷ߹˵Λग़ྗ͢Δɻ. ग़ྗ͢Δɻ. Decision. Challenge. A b Λ༧͠ग़ྗ͢Δɻ. ͜ͷΦϥΫϧͷΫΤϦ 1 ճͷΈ͞ڐΕΔɻ. (pk ∗ , T ∗ , m∗0 , m∗1 ) ΛΦϥΫϧͷೖྗͱ͢Δɻpk ∗ Λνϟ. ͠ b ͱ b ͕͚͠Ε A ͷউརͱͳΔɻA ͷউར֬. Ϩϯδ key ͱ͢ΔɻΦϥΫϧ b ← {0, 1} ΛϥϯμϜʹܾ. Λ࣍ͷΑ͏ʹఆٛ͢ΔɻAdvΓ,A (1k ) = 2P r[b = b ] − 1. ఆ͠νϟϨϯδ҉߸จ C ∗ ←Enc(pk ∗ , m∗b , T ∗ ) Λฦ͢ɻ. ఆٛ 2ɿhTR-PRE ํࣜ Γ ʹର͢Δҙͷଟ߲ࣜ࣌ؒΞϧ. Re-Encryption. ΰϦζϜ A ͷউར֬ AdvΓ,A (1k ) ͕ negligible Ͱ͋Δ࣌. (pkA , pkB , CA ) ΛΦϥΫϧͷೖྗͱ͠ɺϢʔβ B Ѽͷ҉. Γ Malicious User Security Λຬͨ͢ͱ͍͏ɻ. ߸จ CB ←ReEnc(ReKeyGen(skA , skB ), CA ) Λฦ͢ɻͨͩ ͠ɺpkA ∈Target, pkB ∈Corrupted, CA ⇐ C ∗ ͕ͯ͢ Γཱͭ߹߹ ⊥ Λฦ͢ɻ. 3.3 ϓϩτίϧ ຊઅͰఏҊํࣜͷৄࡉΛॻ͘ɻ ʕ Setup. Decryption (pk, T, C) Λ Φ ϥ Ϋ ϧ ͷ ೖ ྗ ͢ Δ ͱ ͠ ɺϝ ο η ʔ δ ∗. m = Dec(sk, pk, C, ST ) Λฦ͢ɻͨͩ͠ C = C ·ͨ ∗. ηΩϡϦςΟύϥϝʔλ 1k Λೖྗͱ͢ΔɻG, GT Λ ૉ Ґ p ͷ ܈ɺe : G × G → G T ͱ ͠ ɺ. C ⇐ C ͷ߹˵Λग़ྗ͢Δɻ. g, g2 , g3 , h1 , h2 , h3 ∈ Gɺs ← Zp∗ Λબ͢ΔɻT Spub =. Decision. g s , tspriv = s ͱ͠ɺϋογϡؔΛҎԼͷΑ͏ʹબ. pk∗ ∈Corrupted ͷ߹ ⊥ɺͦ͏Ͱͳ͍ͳΒ A b Λ. ͢Δɻ. ⓒ 2014 Information Processing Society of Japan. 3.
(4) Vol.2014-DPS-158 No.11 Vol.2014-CSEC-64 No.11 2014/3/6. ใॲཧֶձڀݚใࠂ IPSJ SIG Technical Report. ɾ. ϋογϡؔ H ɿ{0, 1}l → G. ൿ ີ ݤsk ɺެ ։ ݤpk ɺ҉ ߸ จ C Λ ೖ ྗ ͱ ͢ Δ ɻ. ϋογϡؔ H pairwise independent ͳ univer-. CheckPRE(C, pk) = 1 ͔ͭ CheckIBE(C, pk) = 1 ͳ. sal one-way hash function family [4][6] Λ༻͍Δɻ. ΒҎԼΛ͢ࢉܭΔɻͦ͏Ͱͳ͚Ε˵Λग़ྗ͢Δɻ. x ∈ {0, 1} ͱ y ∈ G ͕༩͑ΒΕͨͱ͖ɺH(x) = y. ɾ e(C6 , hrT1 ) · C7rT1 = e(g, h1 )r2. Λຬͨ͢ H ΛޮΑ͚ͭ͘ݟΔΞϧΰϦζϜ͕ଘࡏ. ɾ. l. m = C3 /{e(C2 , H(C1 ))1/sk · e(g, h1 )r2 } Λग़ྗɻ. ͢Δɻ ɾ. ϋογϡؔ F ɿZp → Gɺͨͩ͠ϋογϡؔ. g2y. F F (y) = ɾ ɾ. · g3 ͱ͢Δɻ(g2 , g3 ∈ G). ϋογϡؔ H1 : {0, 1}. m. ϧΰϦζϜʹ͍ͭͯॻ͘ɻ. CheckPRE ΞϧΰϦζϜΛҎԼͷΑ͏ʹఆٛ͢Δɻೖྗ. → Zp ∗. ϋ ο γ ϡ ؔ H2 : {0, 1}. ํࣜͰ༻͍ͨ CheckPRE ΞϧΰϦζϜ͓Αͼ CheckIBE Ξ. → Zp params =. ҉߸จ C = (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ) ͱެ։ ݤpk. (g, g2 , g3 , h, h1 , h2 , h3 , H, F, H1 , H2 , T Spub ) Λެ։ύ. Ͱ͋Δɻ. ϥϝʔλͱ͢Δɻ. ( 1 ) Ver(C1 , (C2 , C3 , C4 , C5 , C6 , C7 , C8 ), σ) ΛௐΔɻσ (C3 , C4 , C5 , C6 , C7 , C8 ) ʹର͢Δॺ໊Ͱ͋Γ C1 ݕ. ʕ KeyGeneration k. ηΩϡϦςΟύϥϝʔλ 1 Λೖྗͱ͠ɺx ∈ Zp Λϥ x. ( 2 ) e(C2 , F (C1 )) = e(pk, C4 ), e(C2 , h) = e(pk, C5 ) ͕Γ. ϯμϜʹબɻpk = g , sk = x ͱ͢Δɻ. ཱ͔ͭௐΔ. ʕ Re-EncryptionKeyGeneration. ski = xi , skj = xj Λೖྗͱ͠࠶҉߸Խ ݤrkij = ski skj. mod p =. xi xj. ূ͋ͰݤΔɻ. ( 3 ) 1,2 ͷͲͪΒ͔ҰํͰΓཱͨͳ͚Ε 0ɺͦ͏Ͱͳ ͚Ε 1 Λग़ྗɻ. mod p ͱ͢Δɻ. CheckIBE ΞϧΰϦζϜΛҎԼͷΑ͏ʹఆٛ͢Δɻೖྗ. ʕ TS-Release ։ࣔ࣌ࠁ T ͱλΠϜαʔόͷൿີ ݤtspriv = s Λೖྗ. ҉߸จ C = (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ) ͱެ։ ݤpk. ͱ͠ rT1 , rT2 , rT3 ← Zp∗ ΛϥϯμϜʹબɻ։ࣔ࣌ࠁ. Ͱ͋Δɻ. ʹରԠ͢Δ࣌ࠁ ݤST ΛҎԼͷ௨Γ͢ࢉܭΔɻ. ߹̍ΛΓཱͨͳ͍߹̌Λग़ྗ͢Δɻ. ST = ((rT1 , (hrT1 ), (rT2 , (hrT2 ), (rT3 , (hrT3 )) hrTn = (hn · g. −rTn. ). 1 (s−H(T )). 1. ( 1 ) C8 = e(C6 , (h2 · g −rT2 ) s−H1 (T ) , C7rT2 +rT3 ) ͕Γཱͭ. ), (n ∈ {1, 2, 3}). ఏҊͨ͠ hTR-PRE ɺC.H.PRE[7] ͱ G.IBE[1] ΛΈ߹ ΘͤΔΞΠσΞʹߏ͍ͯͮجͨ͠ɻC1 = svk, C2 =. ʕ Encryption. pk ͱϝοηʔδ m ∈ GT ɺ։ࣔ࣌ࠁ T Λೖྗͱ͢Δɻ. pk r1 , C4 = F (svk)r1 = (g2svk · g3 )r1 , C5 = hr1 ͷ ཁ ૉ. ɾ. C.H.PRE ͷ Enc ΞϧΰϦζϜͱಉ༷Ͱ͋ΓɺC6 =. ϫϯλΠϜॺ໊ͷ KeyGeneration ΞϧΰϦζϜΑ k. Γ Gen(1 ) → (svk, ssk) ΛಘΔɻC1 = svk ͱ͢Δɻ. (g −H1 (T ) · T spub)r2 , C7 = e(g, g)r2 , C8 = (e(e(g, h2 ) ·. ཚ r1 , r2 ∈ Zp Λબ࣍͠Λ͢ࢉܭΔɻ. e(g, h3 ))β )r2 ͷཁૉ G.IBE ͷ Enc ΞϧΰϦζϜͱಉ༷. C2 = pk r1 , C3 = m · e(g, H(svk))r1 · e(g, h1 )r2 ). Ͱ͋ΔɻC3 = m · e(g, H(svk))r1 · e(g, h1 )r2 ) ʹ͓͍ͯ. ɾ. r1. m · e(g, H(svk))r1 ͷ෦ͷΈʹ͢ΔͱɺC.H.PRE ͷ. C6 = (g −H1 (T ) · T spub )r2 , C7 = e(g, g)r2. ҉߸จͷཁૉͷҰ෦ʹͳΓɺ·ͨ m · e(g, h1 )r2 ͷ෦ʹ. C8 = (e(e(g, h2 ) · e(g, h3 ))β )r2. ͢Δͱ G.IBE ͷ҉߸จͷཁૉͷҰ෦ʹͳΔɻ. C4 = F (svk). r1. =. (g2svk. r1. · g 3 ) , C5 = h. β = H2 (C3 , C6 , C7 ) ɾ. (C3 , C4 , C5 , C6 , C7 , C8 ) ʹରͯ͠ϫϯλΠϜॺ໊. ຊઅͰఏҊͨ҆͠શੑఆٛʹ ͖ͮجhTR-PRE ͷ҆શ. ͷ Signature ΞϧΰϦζϜΛ࣮ߦɻ. σ ← Sig(ssk, (C3 , C4 , C5 , C6 , C7 , C8 )) ɾ. ੑͷূ໌Λߦ͏ɻ. C = (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ) Λ҉߸จ. 3.4.1 Malicious User Secrity Malicious User Secrity Λ ഁ Δ ߈ ܸ ऀ A Λ ༻ ͍ ͯ. ͱ͢Δɻ ʕ. 3.4 ҆શੑূ໌. GentryIBE ͷ҆શੑΛഁΔΞϧΰϦζϜ B Λߏ͢Δɻ. Re-Encryption ҉߸จ Cj ͱ࠶҉߸Խ ݤrkij Λೖྗͱ࣍͠ͷࢉܭΛ. ఆཧ 1ɿIND-ID-CCA ҆શͳ GentryIBE Λ༻͍ͯߏ͠. ߦ͏ɻ rk C2 ij. ɾ. C2. ɾ. CheckPRE(Cj , pkj ). =. =g. xi r1. ͨ hTR-PRE Malicious User Secrity Λຬͨ͢ɻ. =. 1 ͳ Β Ci. =. (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ) ͱ ͠ ͯ ग़ ྗ ɻ. ূ໌. ͦ͏Ͱͳ͍߹ ⊥ Λग़ྗɻ. ઓऀ CH g, h1 , h2 , h3 ∈ G1 ΛϥϯμϜʹબ͢Δɻ. ʕ Decryption. s ← Zp∗ ΛϥϯμϜʹબ͠ɺtsprive = s, T Spub = g s ͱ ͢Δɻ(g, h1 , h2 , h3 , T Spub, H1 , H2 ) ΛγϛϡϨʔλ B ʹ. ⓒ 2014 Information Processing Society of Japan. 4.
(5) Vol.2014-DPS-158 No.11 Vol.2014-CSEC-64 No.11 2014/3/6. ใॲཧֶձڀݚใࠂ IPSJ SIG Technical Report. Β 1 Λɺͦ͏Ͱͳ͚Ε 0 Λग़ྗ͢Δɻ. ૹΔɻ. Setup B g2 , g3 , h. ∈. G ΛϥϯμϜʹબ͢Δɻ. A ͕ C. =. (C1∗ , C2∗ , C3∗ , C4∗ , C5∗ , C6 , C7 , C8 , σ ∗ ). ,. · ͨ ϫ ϯ λ Π Ϝ ॺ ໊ ͷ KeyGeneration Ξ ϧ. CheckPRE(pk, C) = 1, CheckIBE(pk, C) = 1 Λ ͢ . ΰ Ϧ ζ Ϝ Gen(1k ). ͯຬͨ͢ (pk , C ) ΛΫΤϦ͖ͯͨ͠߹ɺB Decryption. (ssk ∗ , svk ∗ ) Λ ࣮ ߦ ͠. →. ∗. Λ. (g, g2 , g3 , h, h1 , h2 , h3 , e, H, F, H1 , H2 , T Spub, svk ). ΦϥΫϧΛγϛϡϨʔτ͢Δ͜ͱ͕ෆՄೳͰ͋Δɻ͔͠. A ʹૹΔɻ. ͠ɺ͜Ε IND-ID-CCA ͷ҆શੑΛഁ͍ͬͯΔ͜ͱʹͳ. KeyGen. ΔɻͦͷଞͷγϛϡϨʔγϣϯʹ͍ࣦͭͯഊ͢Δࣄͳ. A ͕ΫΤϦ͢Δͱ B x ← Zp ΛϥϯμϜʹબ͠ x. (pk, sk) = (g , x) Λ A ʹฦ͢ɻ. ͍ͷͰɺA ͷউར͕֬ 1/2 ʹରͯ͠༏ҐੑΛ࣋ͭͳΒ ɺB ͷޭ֬ 1/2 ʹରͯ͠༏ҐੑΛ࣋ͭɻ. TS-Release A TS-Release ΫΤϦͱͯ࣌͠ࠁ T Λ B ʹૹΔɻB . 3.4.2 Malicious TimeServer Security. IND-ID-CCA ήʔϜʹ͓͚Δ Extract ΫΤϦͱͯ͠ T Λ. ఆٛͨ͠ Malicious TimeServer Security ΛഁΔ߈ܸऀ. ͦͷ·· CH ʹૹΓ, ରԠ͢Δ෮߸ݤʢൿີݤʣdT Λखʹ. A Λ༻͍ͯ mDBDH ΛഁΔΞϧΰϦζϜ B Λߏ͢. ೖΕΔɻB TS-Release ΫΤϦͷฦͱͯ͠ ST = dT Λ. Δɻ. B ʹฦ͢ɻ ఆ ཧ 2ɿmDBDH Ծ ఆ ͷ Լ Ͱ hTR-PRE Malicious. Challenge A ̎ ͭ ͷ ฏ จ ɺ࣌ ࠁ ɺ ҙ ͷ ެ ։ ݤͷ η ο τ ∗. TimeServer Security Λຬͨ͢ɻ. ∗. (m0 , m1 , pk , T ) Λ B ʹૹΔɻB r1 ← Zp ΛϥϯμϜʹ બ͠ m0 = m0 ·e(g, H(svk ∗ )), m1 = m1 ·e(g, H(svk ∗ ))r1. ূ໌. Λ ͢ ࢉ ܭΔ ɻ࣍ ʹ B IND-ID-CCA ή ʔ Ϝ ʹ ͓ ͚ Δ. B ͷೖྗ mDBDH ͷೖྗ (g, g a , g b , g c , Q) ͱͳΓɺB. Challenge ͱ ͠ ͯ CH ʹ (m0 , m1 , T ∗ ) Λ ૹ Δ ɻCH . ͷΰʔϧ Q = e(g, g)ab/c ͕Γཱ͔ͭδϟοδ͢Δ͜. b ← {0, 1} ͱཚ r2 ← Zp Λબ͠ҎԼΛ͢ࢉܭΔɻ. ͱͰ͋ΔɻΞϧΰϦζϜ B ࣍ͷΑ͏ʹߏ͢Δɻ. C3∗. =. C7∗. mb. r2. · e(g, h1 ) , r2. C8∗. = e(g, g) ,. C6∗. = (g. −H1 (T ). r2. · T SP ub ) ,. Setup. β r2. B ϫϯλΠϜॺ໊ͷݤੜΞϧΰϦζϜ. = (e(g, h2 ) · e(g, h3 ) ). Λ IND-ID-. Gen(1k ) → (ssk ∗ , svk ∗ ) Λ࣮ߦ͢Δɻ࣍ʹ ω, α1 , α2 ∈ Zp. CCA ͷ ν ϟ Ϩ ϯ δ ҉ ߸ จ ͱ ͠ ͯ B ʹ ૹ Δ ɻB . ΛϥϯμϜʹબ͠ɺh = g cω , g2 = g α1 , g3 = g −α1 svk ·g cα2. C1∗. =. Λ ͢ ࢉ ܭΔ ɻs ← Zp Λ ϥ ϯ μ Ϝ ʹ બ ͠ ɺλ Π Ϝ. Λ ܭ. α ʔ ό ͷ ൿ ີ ެ ͱ ݤ։ ݤΛ tspriv = s, T Spub = g s. CH ҉ ߸ จ C =. r1. h ,σ. svk ∗ , C2∗. =. pk r1 , C4∗. =. Sig(ssk. =. (C3∗ , C6∗ , C7∗ , C8∗ ). ∗. =. F (svk ∗ )r1 , C5∗. , (C3∗ , C4∗ , C5∗ , C6∗ , C7∗ , C8∗ )). ࢉ ͢ Δ ɻB Challenge ͷ ฦ ͱ ͠ ͯ C ∗. (C1∗ , C2∗ , C3∗ , C4∗ , C5∗ , C6∗ , C7∗ , C8∗ , σ ∗ ). =. Λ A ʹૹΔɻ. ∗. ͱ ͢ Δ ɻB H(svk∗). =. ga ͱ ͳ Δ Α ͏ ͳ ϋ ο. γ ϡ ؔ H Λ બ ͼ ɺγ ε ς Ϝ ύ ϥ ϝ ʔ λ Λ. Decryption. (p, h, h2 , h3 , tspriv , T Spub , g,2 , g3 , G, GT , e, H1 , H2 , H, F ). A Decryption Ϋ Τ Ϧ ͱ ͠ ͯ ެ ։ ݤɺ҉ ߸ จ ɺ࣌ ࠁ. ͱ͢Δɻ. (pk, C, T ) Λ B ʹૹΔɻ. Uncorrupted key generation. C3 =. mb. r2. · e(g, h1 ) , C6 = (g. −H1 (T ). r2. B ཚ x ∈ Zp Λબͼ pk = g cx ͱ͠ A ʹग़ྗ͢Δɻ. · T SP ub ) ,. C7 = e(g, g)r2 , C8 = (e(g, h2 ) · e(g, h3 )β )r2 σ = Sig(ssk. ∗. , (C3∗ , C4∗ , C5∗ , C6∗ , C7∗ , C8∗ )) ∗. Corrupted key generation. ͕ͯ͢Γཱͭ. B ཚ x ∈ Zp Λબͼ pk = g x , sk = x ͱ͠ A ʹग़ྗ͢. ߹ C ⇐ C ͳͷͰ˵Λग़ྗ͢Δɻͦ͏Ͱͳ͍߹ B . Δɻ. ҎԼͷॲཧΛߦ͏ɻ. Re-Encryption key generation. ( 1 ) CheckPRE(pk, C) = 0 ·ͨ CheckIBE(pk, C) = 0 ͷ. pki , pkj Λ ೖ ྗ ͱ ͢ Δ ɻpki , pkj ∈Uncorrupted · ͨ . ߹҉߸จਖ਼͘͠ੜ͞Ε͍ͯͳ͍ͷͰ ⊥ Λฦ͢ɻ. ( 2 ) e(C6 , hT 1 ) ·. C7rT 1. = e(g, h1 ). r2. ɹ, ɹ. C1. =. C3 e(g,h1 )r2. Λ. ͢ࢉܭΔɻ ͱͯ͠ C =. xj xi. ͱͯ͠ A ʹग़ྗ͢. Δɻͦ͏Ͱͳ͍߹ ⊥ Λग़ྗ͢Δɻ. Challenge. ( 3 ) B IND-ID-CCA ήʔϜʹ͓͚Δ Decryption ΫΤϦ ∗. pki , pkj ∈Corrupted ͷ߹ rkij =. (C1 , C6 , C7 , C8 ). Λ CH ʹૹΓɺ෮߸݁Ռ. m Λͦͷ·· A ʹૹΔɻ. A Φ ϥ Ϋ ϧ ʹ (pk ∗ , m0 , m1 ) Λ ૹ ৴ ͢ Δ (pk ∗ ∈Uncorrupted)ɻB ϥϯμϜʹ b ← {0, 1} Λબ b/c. ͠ҎԼΛ͢ࢉܭΔɻC1∗ = svk ∗ , C2∗ = (g b )xi = pki , C3∗ =. Decition. Q · mb · e(g, h1 )r2 , C4∗ = (g b )α2 = (g2svk∗ · g3 )b/c , C5∗ =. A b Λ༧͠ग़ྗ͢ΔɻB b Λड͚औΓɺb = b ͳ. (g b )ω. ⓒ 2014 Information Processing Society of Japan. =. hb/c , C6∗. =. (g −H1 (T ) · T SP ub )r2 , C7∗. =. 5.
(6) Vol.2014-DPS-158 No.11 Vol.2014-CSEC-64 No.11 2014/3/6. ใॲཧֶձڀݚใࠂ IPSJ SIG Technical Report. e(g, g)r2 , C8∗. (e(g, h2 ) · e(g, h3 )β )r2 , σ ∗. =. =. Encryption ΦϥΫϧγϛϡϨʔγϣϯ͕ෆՄೳͰ͋Δɻ. Sig(ssk ∗ , (C3 , C4 , C5 , C6 , C7 , C8 )) ν ϟ Ϩ ϯ δ ҉ ߸ จ. ͔ͦ͠͠ͷΑ͏ͳ҉߸จ (C3 , C4 , C5 , C6 , C7 , C8 , σ) =. C ∗ = (C1∗ , C2∗ , C3∗ , C4∗ , C5∗ , C6∗ , C7∗ , C8∗ , σ ∗ ) Λ A ʹ༩͑Δɻ. (C3∗ , C4∗ , C5∗ , C6∗ , C7∗ , C8∗ , σ ∗ ) ͱͳ͍ͬͯΔͨΊϫϯλΠϜ. Decryption. ॺ໊ΛഁΒΕ͍ͯΔ͜ͱʹͳΔɻB ͕ mDBDH ͷΛ. (pk, C, T ) Λೖྗͱ͢ΔɻCheckPRE(C, pk) = 0 ·ͨ. ड͚औͬͨͳΒ mDBDH ΛຒΊࠐΜͩνϟϨϯ. CheckIBE(C, pk) = 0 ͷ߹҉߸จਖ਼͘͠ੜ͞Εͯ. δ҉߸จ C ∗ ͷͱ mb Λϝοηʔδͱͨ͠௨҉߸จ. ͳ͍ͷͰ B ⊥ Λग़ྗ͢Δɻ࣍ʹ C ⇐ C ∗ Ͱ͋Δ͔. C = Enc(pk ∗ , m∗b , T ∗ ) ͷશʹҰக͢ΔɻΑͬͯ. ֬ೝΛ͢ΔɻC1 = svk∗, C3 = Q · mb · e(g, h1 )r2 , C4 =. A ͕ b = b Λਖ਼ղ͢Δ֬ɺmDBDH ͷΛຒΊࠐΜ. (g b )α2 , C5 = (g b )ω , σ = σ ∗ Λ֬ೝͯ͢͠Γཱͭ߹ɺ. ͩ߹ɺmb Λ༻͍ͯ௨ৗͷ҉߸ԽΛߦͬͨ߹͠. ∗. ∗. C C Λ࠶҉߸Խͯ͠ಘΒΕͨͷɺC ⇐ C ʹͳΔͨ. ͘ͳΔɻB ͕ mDBDH ͷΛड͚औ͍ͬͯͳ͍߹. Ί ⊥ Λग़ྗ͢ΔɻͦͷͲͪΒͰͳ͍߹ɺB ࣍ͷΑ. ҉߸จͷཁૉ C3 b ͱಠཱͯ͠ GT ্ʹҰ༷ʹ͢Δ. ͏ͳࢉܭΛ͠ϝοηʔδ m Λग़ྗ͢Δɻ. ͷͰ mb ͷใҰؚΜͰ͍ͳ͍ɻΑͬͯ A ͕ b = b Λ. t=. C4. α /x. C2 2. ,λ=. 3 m = e(tλ ,H(C1C))e(g,h r 1) 2 C2 = pk r1 , C4 = F (C1 )r1 ͱͳ. 1 α1 (C1 −svk) ,. ਖ਼͘͠ੜ͞Εͨ҉߸จ. Γɺಉ͡ཚ r1 Λ༻͍͍ͯΔɻ F (C1 )r1 pkr1 α2 /x. t =. =. g rα1 (C1 −svk)+cα2 g r1 cα2. r C r g21 1 g3 1 r1 α2 pk x. =. =. = g r1 α1 (C1 −svk). Re-Encryption (pki , pkj , Ci ) Λ ೖ ྗ ͱ ͢ Δ ɻCheckPRE(C, pk) = 0 · ͨ CheckIBE(C, pk) = 0 ͷ ߹ ɺ҉ ߸ จ Ci ਖ਼ ͠ ͘ ੜ ͞ Ε ͯ ͍ ͳ ͍ ͷ Ͱ ⊥ Λ ग़ ྗ ͢ Δ ɻ· ͨ ɺ. i ∈Target ͔ͭ j ∈Corrupt ͔ͭ C ⇐ C ∗ ͭ·Γ C1 = svk∗, C3 = Q · mb · e(g, h1 )r2 , C4 = (g b )α2 , C5 = (g b )ω , σ = Sig(ssk ∗ , (C3 , C4 , C5 , C6 , C7 , C8 ))”ͷ߹ ⊥ Λฦ͢ɻͦ ͏Ͱͳ͍߹ҎԼͷΑ͏ʹಈ࡞͢Δɻ. ∈Uncorrupted,. ͨ ʠi ʠj. Ͱ hTR-PRE Malicious TimeServer Security Λຬͨ͢ɻ. 4. ·ͱΊ. r1 (g α1 )r1 C1 (g −α1 svk+cα2 ) r1 α2 (g cx ) x. Αͬͯ C1 = svk ∗ Ͱͳ͍ͱ͖ tλ = g r ʹͳΔɻ. ( 1 ) ʠ(i, j). ਖ਼ղ͢Δ֬ 1/2 ͱͳΔɻҎ্ΑΓ mDBDH ԾఆͷԼ. Target,. ∈Uncorrupted ͔ ͭ j. ∈Uncorrupted ͔ ͭ i. hTR-PRE ͷߏ๏Λࣔ҆͠શੑূ໌Λߦͬͨɻຊڀݚ ͰఏҊͨ͠ hTR-PRE ํࣜʹର͠ Malicious TimeServer Security ͱ Malicious User Security ͷ̎ͭͷ҆શੑΛఆٛ ͠ɺ҆શੑͷূ໌ΛߦͬͨɻMalicious TimeServer Security ͷ҆શੑ mDBDH Ծఆͱ͍͏ͮ͘جʹྔࢉܭԾఆʹؼ ண͠ɺMalicious User Security ͷ҆શੑ G.IBE[3] ͷ҆ શੑ IND-ID-CCA ʹؼண͢ΔɻఏҊͨ͠ํࣜͰ G.IBE ͱ C.H.PRE[7] Λ༻͍ͯํࣜΛߏ͕ͨ͠ G.IBE Ҏ֎ͷ IBE Λ༻͍Δ͜ͱͰߏ͢Δ͜ͱ͕ՄೳͰ͋Δͱߟ͑Β ΕΔɻ͔͠͠ G.IBE ͱ C.H.PRE ڞ௨ͯ͠ DBDH Ծఆ Λ҆શੑͷ͍ࠜͯ͠ͱڌΔͷͰɺ҆શੑͷ໘Ͱ࠷ྑͰ͋ Δͱߟ͑Δɻ ࢀߟจݙ [1] [2]. Corruptedʡ· ∈Targetʡ· ͨ. ∈Targetʡͷ ߹ ɺ. [3]. Cj = ReEnc(xj /xi , Ci ) Λग़ྗ͢Δɻ ( 2 ) i ∈Corrupted ͔ ͭ j ∈Uncorrupted ͷ ߹ B x /ω. C5 j. = g crxj = pkjr = C2 Λ ͠ ࢉ ܭɺCj =. [4]. (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ) Λग़ྗ͢Δɻ ( 3 ) i ∈Uncorrupted ͔ ͭ j ∈Corrupted ͷ ߹ ɺtλ = g. r. ΑΓ g. rxj. =. pkjr. C2. =. (C1 , C2 , C3 , C4 , C5 , C6 , C7 , C8 , σ). Λ ͠ ࢉ ܭCj. =. Λग़ྗ͢Δɻ [6]. Decision . [5]. . . A b Λ༧͠ग़ྗ͢ΔɻB b Λड͚औΓɺb = b ͳΒ 1 Λɺͦ͏Ͱͳ͚Ε 0 Λग़ྗ͢Δɻ. [7]. A ͕ C1 = svk ∗ ͱͳΔ҉߸จΛΫΤϦ͢Δ߹͕͋Δɻ. [8]. νϟϨϯδ҉߸จ C ∗ ΛಘͨޙɺCheckPRE(C, pk) = 1,. CheckIBE(C, pk) = 1ɺC1 = svk ∗ , C ⇐ C ∗ ͷ શ ͯ. Amit Sahai and Brent Waters. Fuzzy identity-based encryption. In EUROCRYPT, pages 457-473, 2005. Benoit Libert, Damien Vergnaud. Unidirectional chosenciphertext secure proxy reencryption. In: Cramer, R. (ed.) PKC 2008. LNCS, vol. 4939, pp. 360ʕ379. Springer, Heidelberg (2008). Craig Gentry. Practical identity-based encryption without random oracles. In Advances in Cryptologyʕ EUROCRYPT 2006, Lecture Notes in Computer Science. Springer-Verlag, 2006. Dan Boneh and Xavier Boyen. Efcient selective-ID secure identity-based encryption without random oracles. In EUROCRYPT ’04, vol. 3027 of LNCS, pages 223-238, 2004. Keita Emura, Atsuko Miyaji, and Kazumasa Omote. A Timed-Release Proxy Re-encryption Scheme and Its Application to Fairly-Opened Multicast Communication. In ProvSec 2010, LNCS 6402, pp. 200ʕ213, 2010. Ran Canetti, Shai Halevi, and Jonathan Katz. A forwardsecure public-key encryption scheme. In EUROCRYPT, vol 2656 of LNCS, pp. 255-271, 2003. Ran Canetti, Susan Hohenbergery. Chosen-Ciphertext Secure Proxy Re-Encryption. In ACM CCS 2007, pp.185ʕ 194. ACM Press, New York (2007). খᖒ ݡ༎ , ᴡ౻ ହҰ. Canetti-Hohenberger ͷ multi-hop ϓϩΩγ࠶҉߸Խ҆શੑϞσϧʹ͍ͭͯ. 2013 ҉߸ͱ ใηΩϡϦςΟγϯϙδϜ,2013.. Λ Λ ຬ ͨ ͢ ҉ ߸ จ Λ Ϋ Τ Ϧ ͢ Δ ͱ ɺDecryptionɺRe-. ⓒ 2014 Information Processing Society of Japan. 6.
(7)
関連したドキュメント
In he following numerical examples, for simplicity of calculations he start-up time parameter is dropped in Model 1. In order to keep system idle ime minimal, the "system
We obtained the condition for ergodicity of the system, steady state system size probabilities, expected length of the busy period of the system, expected inventory level,
After studying the stochastic be- havior of the initial busy period for various queuing processes, we derive some limit theorems for the heights and widths of random rooted trees..
We construct critical percolation clusters on the diamond hierarchical lattice and show that the scaling limit is a graph directed random recursive fractal.. A Dirichlet form can
Real separable Banach space, independent random elements, normed weighted sums, strong law of large numbers, almost certain convergence, stochastically dominated random
Real separable Banach space, independent random elements, normed weighted sums, strong law of large numbers, almost certain convergence, stochastically dominated random
Theorem 3.5 is based on the single integral identity developed in Lemma 2.5, while Theorem 3.1 is based on the double integral identity repre- sentation for the bound..
Moreover, in 9, 20, the authors studied the problem of the robust stability of neutral systems with nonlinear parameter perturbations and mixed time-varying neutral and discrete
