Aparato de codificación, aparato de descodificación, método de codificación, método de descodificación, método y programa de seguridad y medio de almacenamiento

摘要

Security against CCA is improved without providing space for just improving the security against CCA in a ciphertext space. In encryption processing, a first ciphertext C 1 is calculated from a plaintext M and a symmetric key K; a value containing a value corresponding to the symmetric key K and a value corresponding to the first ciphertext C 1 is put into a collision-resistant function H to calculate a function value of the function H; and r corresponding to the function value is used to calculate second ciphertext C 2 = r·(£ µ=1 n v µ ·b µ ) + Á·b n+1 ˆˆ G 1 n+1 . In decryption processing, the second ciphertext C 2 ˆˆ G 1 n+1 and key information D 1 * = ±·(£ µ=1 n w µ ·b µ * ) + b n+1 * ˆˆ G 2 n+1 are put into a bilinear function e to calculate a function value S ˆ¼ = e(C 2 , D 1 * ) ˆˆ G T ; a value corresponding to the function value S ˆ¼ and the first ciphertext C 1 are put into the collision-resistant function H to calculate a function value of the function H; and it is judged whether r ˆ¼ corresponding to the function value satisfies C 2 = r ˆ¼ ·(£ µ=1 n v µ ·b µ ) + Á ˆ¼ ·b n+1 ˆˆ G 1 n+1 .