1 / 47

Cryptosystems for Social Organizations based on TSK( Tsujii-Shamir-Kasahara ) ー MPKC

Cryptosystems for Social Organizations based on TSK( Tsujii-Shamir-Kasahara ) ー MPKC. Shigeo Tsujii Kohtaro Tadaki Masahito Gotaishi Ryo Fujita Hiroshi Yamaguchi. Research & Development Initiative, Chuo University. Introduction Development of MPKC

jeroen
Télécharger la présentation

Cryptosystems for Social Organizations based on TSK( Tsujii-Shamir-Kasahara ) ー MPKC

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Cryptosystems for Social Organizationsbased on TSK( Tsujii-Shamir-Kasahara ) ーMPKC Shigeo Tsujii Kohtaro Tadaki Masahito Gotaishi Ryo Fujita Hiroshi Yamaguchi Research & Development Initiative, Chuo University

  2. Introduction Development of MPKC Adaptability of TSK-MPKC to Social Organizations Whole Structure of the Proposed System Structure and Function of Perturbed TSK-MPKC Structure and Function of PQ type TSK-MPKC Simulation Result Considerations for Security Conclusion We are going to explain: 1

  3. In secret communication, such as between a local government and a hospital, or among industrial companies, sending organizations are often unable to identify or decide the appropriate receiver in charge of the sending information. In such a case, it is preferable that in the first place the sending organization sends an encrypted information to the representative (or secretary) of receiving organization 1 Introduction

  4. (e.g.. a hospital), then the representative of the hospital distributes the received information and the corresponding key to an adequate person who is responsible for the receiving information (e.g. a surgeon) without decrypting the encrypted Information. While the application of public key cryptosystem to social organizations, Attribute Based Encryption and Functional Encryption are extensively being developed. In such encryption systems, a sending organization has to identify or decide the qualified receiver in the receiving organization by embedding the capacity of decryption of sending information in the encrypted data or the encryption key. As an example, it is easy for broadcast companies to embed the capacity of viewing of charged television.

  5. However, it is often difficult for sending organization to decide the qualified receiver. In such cases, secret communication systems proposed in this presentation convince to be crucial. Proposed system is composed of two subsystems; Perturbed TSK-MPKC PQ type TSK-MPKC

  6. Sending Scheme of key (random number) Encryption of Key using Public Key of PQ-type TSK-MPKC Encryption of Key using Public Key of PQ-type TSK-MPKC Sending of Key for Decryption of the perturbed TSK-MPKC ZN®F2 Key Key Encryption of information using Public Key of perturbed TSK-MPKC Distribution of Receiving Information with keeping Encrypted State by Representative Sending of Information

  7. 2 Development of MPKC

  8. Main Result of MPKC 7

  9. Classification of MPKC MPKC F: Single Field F/E: Mixed Field UOV TSK MI HFE Based on [Wolf, C., Preneel, B.: Taxonomy of Public Key Schemes based on the problem of Multivariate Quadratic equations. Cryptology ePrint Archive, Report 2005/077]

  10. Public Key E Background: Basic Information S ¢G¢T Formulation of the Public Key affine affine Central Map S T G x y u w Cipher Plain 9

  11. TSK-MPKC Stepwise Triangular System of Central Map Decrypted by solving univariate equation one by one. Quick decryption, but easily attacked Prey of Gröbner Base Attack which at that time (1985 ～1989）I did not notice. 10

  12. cipher-text m dimensional vector y plain text m dimensional vector x vm= fm(u1, u2, .........um) vm-1=fm-1(u1, u2, ..um-1) . . . v3=f3(u1, u2, u3) v2=f2(u1, u2) v1=f1(u1) m degree affine transformation y=T(v) m degree affine transformation u=S(x) = ¡ x=(x1, x2, .........xm) xiÎF2, i=1, 2, ....m y=(y1, y2, .........ym) yiÎF2, i=1, 2, ....m fi(u1, u2, .........um), i=1, 2, ....m; random quadratic polynomial (only ui is linear for all i)

  13. 3 Adaptaility of TSK-MPKC to Social Organizations

  14. Comparison of Proposed system and Attribute-based Encryption (Functional Encryption)

  15. Analogy between MPKC(TSK)and Organization The President has to access every information f3l (v1, v2,.....v3l) ................. f2l+2(v1, v2,.....v2l+2) f2l+1(v1, v2,.....v2l+1) f2l (v1, v2,.....v2l) ................. fl+2(v1, v2,.....vl+2) fl+1(v1, v2,.....vl+1) Head of the Division in charge of info B & C fl (v1, v2,.....vl) ................. f2(v1, v2) f1(v1) Section chief in charge of info C Structure of TSK-MPKC; hierarchical decryption Example of Hierarchical Structure of social organizations

  16. Whole Structure of Proposed System

  17. Key Sending Scheme Encryption of Key using Public Key of PQ-type TSK-MPKC Encryption of Key using Public Key of PQ-type TSK-MPKC Sending of Key for Decryption of the perturbed TSK-MPKC ZN®F2 Key Key Encryption of information using Public Key of PQ-type TSK-MPKC Distribution of Receiving Information with keeping Encrypted State by Representative Sending of Information

  18. 5 Structure and Function of Perturbed TSK-MPKC

  19. cipher-text m dimensional vector y plain text m dimensional vector x vm= fm(u1, u2, .........um) vm-1=fm-1(u1, u2, ..um-1) . . . v3=f3(u1, u2, u3) v2=f2(u1, u2) v1=f1(u1) m degree affine transformation y=T(v) m degree affine transformation u=S(x) = ¡ fi(u1, u2, .........um), i=1, 2, ....m; random quadratic polynomial (only ui is linear for all i) Original TSK-MPKC x=(x1, x2, .........xm) xiÎF2, i=1, 2, ....m y=(y1, y2, .........ym) yiÎF2, i=1, 2, ....m

  20. plain text 2m dimensional vector x1 x2 vm(u1, u2, ...um)+gm(um+1,....u2m) vm-1(u1, ...um-1)+gm-1(um+1...u2m) . . . v2=f2(u1, u2)+g2(um+1, ......u2m) v1=f1(u1) +g1(um+1, ......u2m) cipher-text m dimensional vector y m degree affine transformation y=T(v) 2m degree affine transformation u=S(x1||x2) = ¡ x1=(x1, x2, .........xm) x2=(xm+1, .........x2m) xiÎF2, i=1, 2, ....2m y=(y1, y2, .........yn) yiÎF2, i=1, 2, ....m fi(u1, u2, .........ui), i=1, 2, ....m; random quadratic polynomial (only ui is linear for all i) gi(um+1, um+2 ,..., u2m); random quadratic n-variate polynomial for all i. Perturbed TSK-MPKC

  21. Securuty of Perturbed TSK-MPKC The number of variables is 2m The number of equations is m ≧200 Groebner base attack is impossible. Unlike the cases of signature system, attackers do not have any freedom of assigning values to the extra variables in encryption systems. So rank attack is impossible.

  22. ６　Structure of PQ type TSK-MPKC (1) Its security against quantum computing attack is given up (2) Security is based on the difficulty of prime factorization (SCC2013 “Construction of the Tsujii-Shamir-Kasahara (TSK) Type Multivariate Public Key Cryptosystem, which relies on the Difficulty of Prime Factorization”) 21

  23. Theorem C(x):=pA(x)+qB(x) Let A(x), B(x) be random systems of polynomials defined on the residual ring ZN (N=pq) Only C(x) is disclosed: • then: It is as difficult as factoring N to find A(x) and B(x) (C(x) does not have any term whose coefficient is divisible by p or q.) 22

  24. The Proposed System A(x) B(x) p q + Combining two TSK together (p and q term) Residue Class Ring is used Above polynomial system is the central map and public key is generated by applying affine transformation 23

  25. Structure of the Central Map Linear Polynomial in x1 + ・・・・・・・・・・ q p ・・・・・・・・・・ random polynomial with all variables random polynomial with all variables Linear Polynomial in xm 24

  26. The Proposed PQ type TSK-MPKC The Polynomial System defined on ZN(N=pq) Each system is solved by transforming it to subfields, and afterwards plain text is computed using Chinese Remainder Theorem 25

  27. The Proposed System There is a unique pair of elements a, b such that ap+bq=1 (a< q, b< p). The equation system defined on the subfield GF(q) 26

  28. Background: Theorem C(x):=pA(x)+qB(x) Theorem: Let A(x), B(x) be random systems of polynomials defined on the residual ring ZN (N=pq) Only C(x) is disclosed: • then: It is as difficult as factoring N to find A(x) and B(x) (C(x) does not have any term whose coefficient is divisible by p or q.) 27

  29. Problem of Polynomial Algebra, with the equivalent difficulty as the Prime Factoring A basic problem of polynomial algebra with the equivalent difficulty as the prime factorization is proposed. Two prime numbers p, q are selected. N:=pq The plain text vector x is an m-dimensional vector, with each element defined on the residue class ring ZN . x=(x1, x2, ..., xm)T, xiÎZN, i=1, 2, ..., m Two m-dimensional random polynomial vector A(x), B(x) are generated: A(x)=(a1(x), a2(x), ..., am(x))T B(x)=(b1(x), b2(x), ..., bm(x))T 28

  30. Subsequently, an m-dimensional quadratic polynomial vector C(x) on the residue class ring ZN is defined using p, q,A(x), B(x) C(x)=(c1(x), c2(x), ..., cm(x))T=A(x)p+B(x)q With the above assumption, the problem of finding the prime numbers p, q from the value of C(x) for a given value of x, with A(x) and B(x) confidential, is discussed. This problem is called "prime factorization problem with additional information." Then the following theorem is proved: Theorem: The following two conditions are equivalent. Prime factorization is difficult. Prime factorization with additional information is difficult. 29

  31. Proof of the Theorem n is a security parameter. And for all positive integer l, Zl is a set {0, 1, 2, ..., l-1}. First of all, the following experiment about the probabilistic algorithm A and the security parameter n is discussed: FactorA(n): Choose a pair (p, q) of two distinct n/2-bits prime uniformly. Set N:=pq. A is given N, and outputs p'q'>1. The output of the experiment is defined to be 1 if p'q'=N, and 0 otherwise. 30

  32. Definition 3.2. The remark that "A prime factoring problem is difficult" means that following proposition is true: For all probabilistic algorithm A and security parameter d, exists a certain positive integer n0 such that the following inequation is true for any n > n0, Pr[FactorA(n)=1]£1/nd Let ℓ be a certain univariate polynomial with all its coefficients are positive integers. The following experiment is discussed about a given probabilistic polynomial time algorithm A and a security parameter n: 31

  33. The factoring experiment with additional information Factor-AddInfoA(n): Choose a pair (p, q) of two distinct n/2-bits prime uniformly. Set N:=pq. Set m:=ℓ(n). Choose aÎZN[x1, x2, ..., xm]m of total degree two uniformly. Choose bÎZN[x1, x2, ..., xm]m of total degree two uniformly. Set c:=pa+qb A is given N, c, and outputs p'q' > 1 The output of the experiment is defined to be 1 ifp'q'= N, and 0 otherwise. 32

  34. Background: Outline of the Proof Prime Factorization of Additional Information Choose a pair (p, q) of two distinct n=2-bits primes uniformly. Set N := pq. Set m := ℓ(n). Choose a, bÎZN[x1,..., xm]m of total degree two uniformly. Set c := pa + qb. A is given N, c and outputs p0, q0 > 1. The output of the experiment is defined to be 1 if p0q0 = N, and 0 otherwise. 33

  35. Problem of Polynomial Algebra, with the equivalent difficulty as the Prime Factoring A basic problem of polynomial algebra with the equivalent difficulty as the prime factorization is proposed. Two prime umbers p, q are selected. N:=pq The plain text vector x is an m-dimensional vector, with each element defined on the residue class ring ZN . x=(x1, x2, ..., xm)T, xiÎZN, i=1, 2, ..., m Two m-dimensional random polynomial vector A(x), B(x) are generated: A(x)=(a1(x), a2(x), ..., am(x))T B(x)=(b1(x), b2(x), ..., bm(x))T 34

  36. Definition 3.3. The remark that "A prime factoring problem with additional information is difficult" means that following proposition is true: For all probabilistic polynomial time algorithm A and all positive integer d, exists a positive integer n0 such that following inequation is true. Pr[Factor-AddinfoA'(n)=1]£1/nd With the above preparation, the following theorem is proved. Theorem 3.4. The following two conditions are equivalent. (i) Prime factorization is difficult (ii) Prime factorization with additional information is difficult. The proposition that (ii)→(i) is obvious. 35

  37. Next (i)→(ii) is proved. Beforehand following Lemma needs to be proved. Here #S means the number of the elements of a given finite set S. Lemma 3.5. Let p and q be two prime numbers. Let N:=pq. Mapping F: ZN×ZN→ZN isdefined as follows: F(x, y)=(px+qy) mod N Then we have following equality for all zÎZN. F({z})=N (3) 36

  38. [Proof] Since both p and q are prime, there exist integers x0,y0such that px0+qy0=1. Subsequently , a subset Sz of ZN×ZN is defined as: Sz :={(x0z+qa) mod N, (y0z+pb mod N) | aÎZp, bÎZq} It should be noted that for all zÎZN, we have the equality: F(Sz)=z Therefore for any different elements z, z'ÎZN, we have the equality: Sz Ç Sz' =f On the other hand, since #Zp=p and #Zq=q, for all zÎZN, we have the following relation: #Sz=pq=N (end of the proof) 37

  39. Based on the Lemma 3.5, (i)→(ii)in the Theorem is proved as follows: Here following experiment about a given probabilistic polynomial time algorithm A and n: The factoring experiment with dummy information Factor-DmmyInfoA(n): Choose a pair of two distinct n/2-bits prime uniformly. Set N:=pq. Set m:=ℓ(n). Choose cÎZN[x1, x2, ..., xm]m of total degree two uniformly. A is given N, c, and outputs p', q' > 1 The output of the experiment is defined to be 1 if p'q'=N, and 0 otherwise. 38

  40. Based on the Lemma 3.5, the polynomial vector c generated by the step 4-6 of the Factor-AddInfoA(n) is homogeneously generated from a set of quadratic polynomial vectors in aÎZN[x1, x2, ..., xm]m. Consequently for a given probabilistic polynomial time algorithm A and a security parameter n, we have the following equality: Pr[Factor-DmmyinfoA'(n)=1] = Pr[FactorA'(n)=1] Here let A be a given probabilistic polynomial-time algorithm, which has positive integers and polynomial vectors as its inputs. Based on the algorithm A, a probabilistic polynomial-time algorithm A' is structured as follows: 39

  41. A' has the positive integer N as its input. A' gnerates a quadratic polynomial vector c homogeneously. After that, it invokes the algorithm A inputing N and c. Then we have the following equality for a given security parameter n: Pr[Factor-DmmyinfoA'(n)=1]= Pr[FactorA'(n)=1] Here it is assumed that the prime factorization is difficult. Then for all positive integer d, there exists a positive integer n0 such that for all n>n0, Pr[Factor-AddinfoA'(n)=1]£1/nd Since A can be any algorithm, it is led from the equation (4) and (5) that a prime factorization problem with additional information is difficult. (4) (5) 40

  42. Discussion of Security of PQ-TSK 1 • Direct Attack • Polynomials of public key are transformed by two affine transformation so that no coefficient is divisible by p or q • The public key is virtually the same as random systems from attakers. 41

  43. Discussion of Security of PQ-TSK 2 1）It is impossible to separate the public key C(x) into A(x) and B(x) without knowing p or q. 2) Neither p nor q is worked out with any probabilistic algorithm with the public key as the input (Theorem). 3) Although two polynomial systems have the TSK trapdoor structure, all polynomials of central map have the same rank and rank attack is impossible. So extracting any p term or q term is convinced to be impossible 42

  44. Discussionefficiency of whole system • PQ-TSK ; although encryption and decryption take time due to residue ring, PQ-TSK is used for key (random number for perturbation in perturbed TSK). So in advance of transmission of information , key can be sent using PQ-TSK. • The same key (random number for perturbation) could be used repeatedly for different perturbed TSK.

  45. Discussionsecurity of whole system • PQ-TSK is secure • Perturbed TSK is secure • Whole system is secure

  46. Conclusion • Cryptosystem for Social Organizations based on PQ type TSK-MPKC and Perturbed TSK-MPKC is proposed. Practical applications in the fields of electronic government and electronic medicare systems are now being considered.

  47. Thank you for listening Any Questions?

More Related