Apparatus and method for encryption, apparatus and method for converting ciphertext

Abstract

A method for encryption according to an embodiment includes generating a ciphertext for a secret key that is an integer vector by using an integer-based first homomorphic encryption algorithm, generating a key stream that is the integer vector from a nonce and the secret key by using a key stream generator, encoding the key stream by using a message encoding function of the first homomorphic encryption algorithm, encoding a message that is a real vector by using a message encoding function of a real number-based second homomorphic encryption algorithm, generating a ciphertext for the message by using a result of the encoding of the key stream and a result of the encoding of the message, and transmitting the nonce, the ciphertext for the secret key, and the ciphertext for the message to an apparatus for converting a ciphertext.

Claims

1. A method for encryption, the method comprising: generating a first ciphertext for a secret key that is an integer vector by using an integer-based first homomorphic encryption algorithm; generating a key stream that is an integer vector from a nonce and the secret key by using a key stream generator; encoding the key stream by using a message encoding function of the first homomorphic encryption algorithm; encoding a message that is a real vector by using a message encoding function of a real number-based second homomorphic encryption algorithm; generating a second ciphertext for the message by using a result of the encoding of the key stream and a result of the encoding of the message; and transmitting the nonce, the first ciphertext for the secret key, and the second ciphertext for the message to an apparatus for converting a ciphertext.

2. The method for encryption of claim 1, wherein the first homomorphic encryption algorithm is a homomorphic encryption algorithm that supports modulo operations with a prime number t as a modulus.

3. The method for encryption of claim 2, wherein a message space of the first homomorphic encryption algorithm is a vector space over a finite field with the prime number t as a modulus, and the nonce, the secret key, the key stream, and the second ciphertext for the message are elements of the vector space.

4. The method for encryption of claim 1, wherein the key stream generator includes a generation function for generating a random vector of a preset length based on the nonce and a counter, and r (where, r≥1) round functions sequentially applied to the secret key based on the random sequence.

5. The method for encryption of claim 1, wherein a message space of the second homomorphic encryption algorithm is a real space or a complex space, and the message is an element of the real space or the complex space.

6. The method for encryption of claim 1, wherein the generating of the ciphertext includes generating the second ciphertext for the message by performing a modulo addition on the result of the encoding of the key stream and the result of the encoding of the message with the prime number t as a modulo.

7. A method for converting a ciphertext, the method comprising: receiving, from an apparatus for encryption, a nonce, a first ciphertext for a secret key that is an integer vector, and a second ciphertext for a message that is a real vector; generating a third ciphertext for a key stream used by the apparatus for encryption to generate the second ciphertext for the message, based on the nonce and the first ciphertext for the secret key; and converting the second ciphertext for the message by using the third ciphertext for the key stream and the second ciphertext for the message, wherein the first ciphertext for the secret key is a ciphertext encrypted by using an integer-based first homomorphic encryption algorithm, the second ciphertext for the message is a ciphertext encrypted by using a result of encoding the key stream using a message encoding function of the first homomorphic encryption algorithm and a result of encoding the message using a message encoding function of a real number-based second homomorphic encryption algorithm, the key stream is an integer vector generated from the nonce and the secret key by using a key stream generator, the generating of the third ciphertext for the key stream includes generating the third ciphertext for the keystream using a homomorphic operation based on the first homomorphic encryption algorithm for the key stream generator, and the converting includes converting the second ciphertext for the message into a ciphertext based on the second homomorphic encryption algorithm.

8. The method for converting a ciphertext of claim 7, wherein the first homomorphic encryption algorithm is a homomorphic encryption algorithm that supports modulo operations with a prime number t as a modulus.

9. The method for converting a ciphertext of claim 8, wherein a message space of the first homomorphic encryption algorithm is a vector space over a finite field with the prime number t as a modulus, and the nonce, the secret key, the key stream, and the second ciphertext for the message are elements of the vector space.

10. The method for converting a ciphertext of claim 7, wherein the key stream generator includes a generation function for generating a random vector of a preset length based on the nonce and a counter, and r (where, r≥1) round functions sequentially applied to the secret key based on the random sequence.

11. The method for converting a ciphertext of claim 7, wherein a message space of the second homomorphic encryption algorithm is a real space or a complex space, and the message is an element of the real space or the complex space.

12. The method for converting a ciphertext of claim 7, wherein the second ciphertext for the message is a ciphertext generated by performing a modulo addition on a result of encoding the key stream and a result of encoding the message with the prime number t as a modulo, and the converting includes converting the second ciphertext for the message into a ciphertext based on the second homomorphic encryption algorithm by performing a modulo subtraction on the third ciphertext for the key stream and the second ciphertext for the message with an integer q set in the second homomorphic encryption algorithm as a modulo.

13. An apparatus for encryption, the apparatus comprising: a memory that stores one or more instructions; and one or more processors that execute the one or more instructions, wherein the one or more processors perform operations comprising: generating a first ciphertext for a secret key that is an integer vector by using an integer-based first homomorphic encryption algorithm; generating a key stream that is an integer vector from a nonce and the secret key by using a key stream generator; encoding the key stream by using a message encoding function of the first homomorphic encryption algorithm; encoding a message that is a real vector by using a message encoding function of a real number-based second homomorphic encryption algorithm; generating a second ciphertext for the message by using a result of the encoding of the key stream and a result of the encoding of the message; and transmitting the nonce, the first ciphertext for the secret key, and the second ciphertext for the message to an apparatus for converting a ciphertext.

14. The apparatus for encryption of claim 13, wherein the first homomorphic encryption algorithm is a homomorphic encryption algorithm that supports modulo operations with a prime number t as a modulus.

15. The apparatus for encryption of claim 14, wherein a message space of the first homomorphic encryption algorithm is a vector space over a finite field with the prime number t as a modulus, and the nonce, the secret key, the key stream, and the second ciphertext for the message are elements of the vector space.

16. The apparatus for encryption of claim 13, wherein the key stream generator includes a generation function for generating a random vector of a preset length based on the nonce and a counter, and r (where, r≥1) round functions sequentially applied to the secret key based on the random sequence.

17. The apparatus for encryption of claim 13, wherein a message space of the second homomorphic encryption algorithm is a real space or a complex space, and the message is an element of the real space or the complex space.

18. The apparatus for encryption of claim 13, wherein the generating of the ciphertext includes generating the second ciphertext for the message by performing a modulo addition on the result of the encoding of the key stream and the result of the encoding of the message with the prime number t as a modulo.

19. An apparatus for converting a ciphertext, the apparatus comprising: a memory that stores one or more instructions; and one or more processors that execute the one or more instructions, wherein the one or more processors perform operations comprising: receiving, from an apparatus for encryption, a nonce, a first ciphertext for a secret key that is an integer vector, and a second ciphertext for a message that is a real vector; generating a third ciphertext for a key stream used by the apparatus for encryption to generate the second ciphertext for the message, based on the nonce and the first ciphertext for the secret key; and converting the second ciphertext for the message by using the third ciphertext for the key stream and the second ciphertext for the message; the first ciphertext for the secret key is a ciphertext encrypted by using an integer-based first homomorphic encryption algorithm; the second ciphertext for the message is a ciphertext encrypted by using a result of encoding the key stream using a message encoding function of the first homomorphic encryption algorithm and a result of encoding the message using a message encoding function of a real number-based second homomorphic encryption algorithm; the key stream is an integer vector generated from the nonce and the secret key by using a key stream generator; the generating of the third ciphertext for the key stream includes generating the third ciphertext for the keystream using a homomorphic operation based on the first homomorphic encryption algorithm for the key stream generator; and the converting includes converting the second ciphertext for the message into a ciphertext based on the second homomorphic encryption algorithm.

20. The apparatus for converting a ciphertext of claim 19, wherein the first homomorphic encryption algorithm is a homomorphic encryption algorithm that supports modulo operations with a prime number t as a modulus.

21. The apparatus for converting a ciphertext of claim 20, wherein a message space of the first homomorphic encryption algorithm is a vector space over a finite field with the prime number t as a modulus, and the nonce, the secret key, the key stream, and the second ciphertext for the message are elements of the vector space.

22. The apparatus for converting a ciphertext of claim 19, wherein the key stream generator includes a generation function for generating a random vector of a preset length based on the nonce and a counter, and r (where, r≥1) round functions sequentially applied to the secret key based on the random sequence.

23. The apparatus for converting a ciphertext of claim 19, wherein a message space of the second homomorphic encryption algorithm is a real space or a complex space, and the message is an element of the real space or the complex space.

24. The apparatus for converting a ciphertext of claim 19, wherein the second ciphertext for the message is a ciphertext generated by performing a modulo addition on a result of encoding the key stream and a result of encoding the message with the prime number t as a modulo, and the converting includes converting the second ciphertext for the message into a ciphertext based on the second homomorphic encryption algorithm by performing a modulo subtraction on the third ciphertext for the key stream and the second ciphertext for the message with an integer q set in the second homomorphic encryption algorithm as a modulo.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 a diagram for illustrating an operation of an encryption system according to an embodiment.

(2) FIG. 2 is a diagram illustrating an example of generating a key stream using a key stream generator according to an embodiment.

(3) FIG. 3 is a flowchart of a method for encryption according to an embodiment.

(4) FIG. 4 is a flowchart of a method for converting a ciphertext according to an embodiment.

(5) FIG. 5 is a block diagram for exemplarily illustrating a computing environment including a computing device according to an embodiment.

DETAILED DESCRIPTION

(6) Hereinafter, specific embodiments of the present invention will be described with reference to the accompanying drawings. The following detailed description is provided to assist in a comprehensive understanding of the methods, devices and/or systems described herein. However, the detailed description is only for illustrative purpose and the present invention is not limited thereto.

(7) In describing the embodiments of the present invention, when it is determined that detailed descriptions of known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed descriptions thereof will be omitted. The terms used below are defined in consideration of functions in the present invention, but may be changed depending on the customary practice or the intention of a user or operator. Thus, the definitions should be determined based on the overall content of the present specification. The terms used herein are only for describing the embodiments of the present invention, and should not be construed as limitative. Unless expressly used otherwise, a singular form includes a plural form. In the present description, the terms “including”, “comprising”, “having”, and the like are used to indicate certain characteristics, numbers, steps, operations, elements, and a portion or combination thereof, but should not be interpreted to preclude one or more other characteristics, numbers, steps, operations, elements, and a portion or combination thereof.

(8) FIG. 1 is a diagram for illustrating an operation of an encryption system according to an embodiment.

(9) Referring to FIG. 1, an encryption system 100 according to an embodiment includes an apparatus 110 for encryption (encryption apparatus) and an apparatus 120 for converting a ciphertext (ciphertext conversion apparatus).

(10) The encryption apparatus 110 is a device for generating a ciphertext for a message that is a real vector and providing it to the ciphertext conversion apparatus 120.

(11) Specifically, the encryption apparatus 110 generates a ciphertext Enc.sup.int(K) for a secret key K, which is an integer vector, by using a first homomorphic encryption algorithm, which is an integer-based homomorphic encryption algorithm.

(12) In this case, the homomorphic encryption algorithm refers to encryption technology that enables encrypted data to be calculated in an encrypted state. In addition, in the following, the homomorphic operation based on the homomorphic encryption algorithm for a specific operation or a specific function refers to the operation for using the data encrypted using the homomorphic encryption algorithm in an encrypted state to generate a ciphertext for a result of applying the specific operation or the specific function to a plaintext data of the encrypted data.

(13) As a specific example, the homomorphic operation for addition may refer to an operation for generating a ciphertext Enc(x.sub.1+x.sub.2) for the result of addition of x.sub.1 and x.sub.2 by using a ciphertext Enc(x.sub.1) obtained by encrypting plaintext data x.sub.1 and the ciphertext Enc(x.sub.2) obtained by encrypting plaintext data x.sub.2 in an encrypted state, for example, as shown in Equation 1 below.
Enc(x.sub.1)Enc(x.sub.2).fwdarw.Enc(x.sub.1+x.sub.2)  [Equation 1]

(14) In addition, the homomorphic operation for multiplication may refer to an operation for generating a ciphertext Enc(x.sub.1.Math.x.sub.2) for the result of multiplication of x.sub.1 and x.sub.2 by using a ciphertext Enc(x.sub.1) obtained by encrypting plaintext data x.sub.1 and the ciphertext Enc(x.sub.2) obtained by encrypting plaintext data x.sub.2 in an encrypted state to for example, as shown in Equation 2 below.
Enc(x.sub.1)Enc(x.sub.2).fwdarw.Enc(x.sub.1.Math.x.sub.2)  [Equation 2]

(15) Also, the homomorphic operation for a specific function f may refer to an operation for generating a ciphertext Enc(f(x)) for the result of applying the function f to the plaintext data x by using a ciphertext Enc(x) obtained by encrypting plaintext data x in an encrypted state, for example, as shown in Equation 3 below.
Enc(x)).fwdarw.Enc(f(x))  [Equation 3]

(16) Meanwhile, the integer-based homomorphic encryption algorithm refers to a homomorphic encryption algorithm that supports encryption and homomorphic operations on data of integers. Specifically, according to an embodiment, the integer-based homomorphic encryption algorithm may be a homomorphic encryption algorithm that supports modulo operations with a prime number t as a modulus.

(17) For example, the first homomorphic encryption algorithm may be a homomorphic encryption algorithm based on the Brakerski/Fan-Vercauteren scheme (B/FV scheme) (hereinafter, BFV homomorphic encryption algorithm); however, the first homomorphic encryption algorithm is not necessarily limited to a specific homogeneous cryptographic algorithm as long as it is an integer-based homomorphic encryption algorithm.

(18) Meanwhile, a message space of the first homomorphic encryption algorithm is a vector space .sub.t.sup.n (where, n is the order of the vector space and is a natural number with n≥1) over a finite field with a prime number t as a modulus, and the secret key K may be an element of .sub.t.sup.n (that is, K∈.sub.t.sup.n).

(19) Meanwhile, the encryption apparatus 110 generates a key stream, which is an integer vector, from a nonce nc and the secret key K using a key stream generator E.

(20) In this case, the nonce is an element of the vector space .sub.t.sup.n, and may be a randomly generated value.

(21) Specifically, the key stream generator E may be implemented by using various functions capable of randomly generating the key stream, which is an element of the vector space .sub.t.sup.n, by using the nonce nc and the secret key K, which are elements of the vector space .sub.t.sup.n, as input values.

(22) Specifically, FIG. 2 is a diagram illustrating an example of generating a key stream using a key stream generator according to an embodiment.

(23) Referring to FIG. 2, the key stream generator E according to an embodiment may include a generation function 202 for generating a random vector of a preset length based on the nonce nc and a counter ctr, and r round functions (where, r is a natural number of r≥1) each including a linear layer 204 and a non-linear layer 206.

(24) Specifically, the generation function 202 of the key stream generator E may receive the nonce nc and the counter ctr and generate r vectors that are each random vectors of k*n dimensions (where, k is a natural number with k≥1). In this case, the counter ctr may be a preset value that starts from 0 and increases by one each time the key stream for the secret key is generated by using the key stream generator E. In addition, the generation function 202 may be, for example, an international standard hash function, such as a SHA3-based SHAKE-256 function; however, is not necessarily limited to a specific function.

(25) Meanwhile, the key stream generator E may use r vectors generated by the generation function 202 to generate each r random matrices M.sub.1, . . . , M.sub.r∈.sub.t.sup.n×n of size n×n and r n-dimensional vectors b.sub.1, . . . , b.sub.r∈.sub.t.sup.n.

(26) In this case, the i-th matrix M.sub.i (1≤i≤r) among r matrices may be generated by using, for example, an n-dimensional vector including the first value to the n-th value among k*n values included in an i-th vector among r k*n-dimensional vectors generated by the generation function 202 and a preset irreducible polynomial.

(27) As a specific example, when the n-dimensional vector including the first value to the n-th value of the i-th vector among the r vectors generated by the generation function 202 is a.sub.i=(a.sub.1, . . . , a.sub.n), the matrix Mi may be built by a.sub.i and the generation source α of .sub.t.sup.n, as in Equation 4 below.

(28) $\begin{array}{cc}M=\left[\begin{array}{cccccc}{a}_1& \alpha .Math.a_n& \alpha .Math.a_{n-1}& .Math.& \alpha .Math.a_3& \alpha .Math.a_2\\ a_2& a_1& \alpha .Math.a_n& .Math.& \alpha .Math.a_4& \alpha .Math.a_3\\ .Math.& .Math.& .Math.& .Math.& .Math.& .Math.\\ a_{n-1}& a_{n-2}& a_{n-3}& .Math.& a_1& \alpha .Math.a_n\\ a_n& a_{n-1}& a_{n-2}& .Math.& a_2& a_1\end{array}\right]& \left[\mathrm{Equation}4\right]\end{array}$

(29) Meanwhile, the i-th vector b.sub.i of the r n-dimensional vectors may include, for example, the k*n−n+1-th value to the k*n-th value among k*n values included in the i-th vector among the r k*n dimensional vectors generated by the generation function 202.

(30) Then, the key stream generator E may sequentially apply r round functions to the secret key K. In this case, the i-th round function of the r round functions may include the linear layer 204 and the non-linear layer 206.

(31) In this case, the linear layer 204 of the i-th round function may be defined as in Equation 5 below.
L.sub.i(x)=M.sub.i.Math.x.sub.i+b.sub.i(mod t)∈.sub.t.sup.n  [Equation 5]

(32) Here, x.sub.i represents an input vector for the linear layer 204 of the i-th round function.

(33) Meanwhile, the non-linear layer 206 of the i-th round function may be configured to generate an output vector by applying a preset non-linear function to an input vector input to the non-linear layer 206.

(34) Specifically, when the output vector of the linear layer 204 of the i-th round function is L.sub.i(x)=(y.sub.1, . . . , y.sub.n), the non-linear function may be, for example, a χ function defined as in Equation 6 below.
χ(L.sub.i(x)).sub.j=y.sub.j+2+y.sub.j+1.Math.y.sub.j+2(mod t)  [Equation 6]

(35) Here, j may be cyclically selected with mod n.

(36) Meanwhile, the non-linear function used in the non-linear layer 206 is not necessarily limited to the χ function described above, and in addition to the χ function, various non-linear functions may be used capable of generating an output vector that is an element of .sub.t.sup.n for the input vector that is an element of .sub.t.sup.n.

(37) Meanwhile, the key stream generator E may generate a key stream ks through modulo addition of the results generated by sequentially applying r round functions to the secret key K and the secret key K, as in Equation 7 below.
ks=K+Round.sub.r∘ . . . ∘Round.sub.1(K)(mod t)∈.sub.t.sup.n  [Equation 7]

(38) Meanwhile, the key stream generator E used by the encryption apparatus 110 is not necessarily limited to the example illustrated in FIG. 2, and in addition to the example illustrated in FIG. 2, may be implemented using various functions capable of generating any vector that is an element of the vector space .sub.t.sup.n from the nonce nc and the secret key K that are each elements of the vector space .sub.t.sup.n.

(39) Referring back to FIG. 1, the encryption apparatus 110 encodes the key stream ks by using a message encoding function Ecd.sup.int of the first homomorphic encryption algorithm.

(40) In this case, the message encoding function refers to a function used to encode multiple data to be encrypted into one polynomial (or a vector corresponding to the polynomial) in order to enable a single instruction, multiple data (SIMD) operation.

(41) For example, when the first homomorphic encryption algorithm is the B/FV homomorphic encryption algorithm, the encryption apparatus 110 may encode the key stream ks (that is, ks∈.sub.t.sup.n) that is an n-dimensional integer vector by using a message encoding function as in Equation 8 below.
Ecd.sup.int(ks)=(V.sub.n.sup.BFV).sup.−1.Math.ks∈.sub.t.sup.n  t[Equation 8]

(42) Here, V.sub.n.sup.BFV represents an n×n matrix (that is, V.sub.n.sup.BFV∈.sub.t.sup.n×n) having an inverse matrix.

(43) Meanwhile, the message encoding function of the first homomorphic encryption algorithm may be modified depending on the type of the first homomorphic encryption algorithm, and is not necessarily limited to a specific function.

(44) Meanwhile, the encryption apparatus 110 encodes a message M that is a real vector by using a message encoding function of a second homogeneous encryption algorithm, which is a real number-based homomorphic encryption algorithm.

(45) In this case, the real number-based homomorphic encryption algorithm refers to a homomorphic encryption algorithm that supports encryption and homomorphic operations on data of real numbers.

(46) For example, the second homomorphic encryption algorithm may be a homomorphic encryption algorithm based on the Cheon, Kim, Kim, and Song scheme (CKKS scheme) (hereinafter, CKKS homomorphic encryption algorithm); however, the first homomorphic encryption algorithm is not necessarily limited to a specific homogeneous cryptographic algorithm as long as it is a real number-based homomorphic encryption algorithm.

(47) Meanwhile, a message space of the second homomorphic encryption algorithm may be a real space .sup.n/2 or complex space .sup.n/2, and the message M may be an element of the message space of the second homomorphic encryption algorithm (that is, M∈.sup.n/2 or M∈.sup.n/2).

(48) Meanwhile, when the second homomorphic encryption algorithm is the CKKS homomorphic encryption algorithm, the encryption apparatus 110 may encode the message M by using a message encoding function as in Equation 9 below.
Ecd.sup.real(M)=[δ.Math.τ.sup.−1(M)]∈.sup.n  [Equation 9]

(49) Here, the message M is a real vector of M∈.sup.n/2, δ is a real scaling factor (δ>0), and [.Math.] is a rounding function rounding off to the nearest integer. In addition, when =exp(−πi/n), τ represents canonical embedding in which τ:[X]/(X.sup.n+1).fwdarw..sup.n/2 is defined as p(X)(P(),P(.sup.5), . . . , p(.sup.2n-3)).

(50) Meanwhile, the message encoding function of the second homomorphic encryption algorithm may be modified depending on the type of the second homomorphic encryption algorithm, and is not necessarily limited to a specific function.

(51) Meanwhile, the encryption apparatus 110 generates a ciphertext C for the message M by using an encoding result Ecd.sup.int(ks) for the key stream ks and an encoding result Ecd.sup.real(M) for the message M.

(52) In this case, according to an embodiment, the encryption apparatus 110 may generate the ciphertext C by performing modulo addition with a prime number t as a module t as in Equation 10 below.
C=Ecd.sup.int(ks)+Ecd.sup.real(M)(mod t)∈.sub.t.sup.n  [Equation 10]

(53) Then, the encryption apparatus 110 transmits the nonce nc, the ciphertext Enc.sup.int(K) for the secret key K, and the ciphertext C for the message M to the ciphertext conversion apparatus 120.

(54) The ciphertext conversion apparatus 120 converts the ciphertext C received from the encryption apparatus 110 into a ciphertext based on the second homomorphic encryption algorithm. In this case, the converting of the ciphertext C into a ciphertext based on the second homomorphic encryption algorithm may refer to the converting of the ciphertext into the same ciphertext as the ciphertext generated by encrypting the message M using the second homomorphic encryption algorithm.

(55) Specifically, the ciphertext conversion apparatus 120 generates a ciphertext Enc.sup.int(ks) based on the first homomorphic encryption algorithm for the key stream ks by performing the homomorphic operation based on the first homomorphic encryption algorithm for the key stream generator E using the ciphertext Enc.sup.int(K) and the nonce nc received from the apparatus encryption 110. In this case, the ciphertext Enc.sup.int(ks) based on the first homomorphic encryption algorithm for the key stream ks refer to the same ciphertext as the ciphertext generated by encrypting the key stream ks using the first homomorphic encryption algorithm.

(56) For example, when the key stream generation process by the key stream generator E is the same as the example illustrated in FIG. 2, the ciphertext conversion apparatus 120 may generate the ciphertext Enc.sup.int(ks) from the ciphertext Enc.sup.int(K) and the nonce nc by performing the homomorphic operation based on the first homomorphic encryption algorithm corresponding to each of the generation function 203, and the linear layer 204 and the non-linear layer 206 constituting each round function.

(57) On the other hand, when the ciphertext Enc.sup.int(ks) is generated, the ciphertext conversion apparatus 120 converts the ciphertext into a ciphertext Enc.sup.real(M) based on the second homomorphic encryption algorithm by using the generated ciphertext Enc.sup.int(ks) and the ciphertext for the message M received from the encryption apparatus 110.

(58) Specifically, the ciphertext conversion apparatus 120 may convert the ciphertext into the ciphertext Enc.sup.real(M) based on the second homomorphic encryption algorithm, for example, by using Equation 11 below.
Enc.sup.real(M)=Δ×C−Enc.sup.int(ks)(mod q)  [Equation 11]

(59) Here, q represents an integer of q≥2 as a modulus set for encryption using the second homomorphic encryption algorithm, and Δ represents a positive real number with Δ=[q/t].

(60) FIG. 3 is a flowchart of a method for encryption according to an embodiment.

(61) The method illustrated in FIG. 3 may be performed, for example, by the encryption apparatus 110 illustrated in FIG. 1.

(62) Referring to FIG. 3, first, the encryption apparatus 110 generates a ciphertext Enc.sup.int(K) for a secret key K, which is an integer vector, by using the integer-based first homomorphic encryption algorithm (310).

(63) Then, the encryption apparatus 110 generates the key stream ks, which is an integer vector, from the nonce nc and the secret key K using the key stream generator (320).

(64) Then, the encryption apparatus 110 encodes the key stream ks by using the message encoding function Ecd.sup.int of the first homomorphic encryption algorithm (330).

(65) Then, the encryption apparatus 110 encodes the message M by using the message encoding function Ecd.sup.real of the real number-based second homomorphic encryption algorithm (340).

(66) Then, the encryption apparatus 110 generates the ciphertext C for the message M by using the encoding result Ecd.sup.int(ks) for the key stream ks and the encoding result Ecd.sup.real(M) for the message M (350).

(67) Then, the encryption apparatus 110 transmits the nonce nc, the ciphertext Enc.sup.int(K) for the secret key K, and the ciphertext C for the message M to the ciphertext conversion apparatus 120 (360).

(68) Meanwhile, in the flowchart illustrated in FIG. 3, at least some of the steps may be performed in a different order, performed together in combination with other steps, omitted, performed in subdivided steps, or performed by adding one or more steps not illustrated.

(69) FIG. 4 is a flowchart of a method for converting a ciphertext according to an embodiment.

(70) The method illustrated in FIG. 4 may be performed, for example, by the ciphertext conversion apparatus 120 illustrated in FIG. 1.

(71) Then, the ciphertext conversion apparatus 120 receives the nonce nc, the ciphertext Enc.sup.int(K) for the secret key K, and the ciphertext C for the message M from the encryption apparatus 110 (410).

(72) Then, the ciphertext conversion apparatus 120 generates a ciphertext Enc.sup.int(ks) based on the first homomorphic encryption algorithm for the key stream ks by performing the homomorphic operation based on the first homomorphic encryption algorithm for the key stream generator E using the ciphertext Enc.sup.int(K) and the nonce nc received from the encryption apparatus 110 (420).

(73) Then, the ciphertext conversion apparatus 120 converts the ciphertext C into a ciphertext Enc.sup.real(M) based on the second homomorphic encryption algorithm by using the generated ciphertext Enc.sup.int(ks) and the ciphertext C for the message M received from the encryption apparatus 110 (430).

(74) Meanwhile, in the flowchart illustrated in FIG. 4, at least some of the steps may be performed in a different order, performed together in combination with other steps, omitted, performed in subdivided steps, or performed by adding one or more steps not illustrated.

(75) FIG. 5 is a block diagram for exemplarily illustrating a computing environment including a computing device according to an embodiment. In the illustrated embodiment, each component may have different functions and capabilities in addition to those described below, and additional components may be included in addition to those described below.

(76) The illustrated computing environment 110 includes a computing device 12. In an embodiment, the computing device 12 may be one or more components included in the encryption apparatus 110 or the ciphertext conversion apparatus 120 illustrated in FIG. 1.

(77) The computing device 12 includes at least one processor 14, a computer-readable storage medium 16, and a communication bus 18. The processor 14 may cause the computing device 12 to operate according to the above-described exemplary embodiments. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16. The one or more programs may include one or more computer-executable instructions, which may be configured to cause, when executed by the processor 14, the computing device 12 to perform operations according to the exemplary embodiments.

(78) The computer-readable storage medium 16 is configured to store computer-executable instructions or program codes, program data, and/or other suitable forms of information. A program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In an embodiment, the computer-readable storage medium 16 may be a memory (a volatile memory such as a random access memory, a non-volatile memory, or any suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, other types of storage media that are accessible by the computing device 12 and may store desired information, or any suitable combination thereof.

(79) The communication bus 18 interconnects various other components of the computing device 12, including the processor 14 and the computer-readable storage medium 16.

(80) The computing device 12 may also include one or more input/output interfaces 22 that provide an interface for one or more input/output devices 24, and one or more network communication interfaces 26. The input/output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input/output device 24 may be connected to other components of the computing device 12 via the input/output interface 22. The exemplary input/output device 24 may include a pointing device (a mouse, a trackpad, or the like), a keyboard, a touch input device (a touch pad, a touch screen, or the like), a voice or sound input device, input devices such as various types of sensor devices and/or imaging devices, and/or output devices such as a display device, a printer, a speaker, and/or a network card. The exemplary input/output device 24 may be included inside the computing device 12 as a component constituting the computing device 12, or may be connected to the computing device 12 as a separate device distinct from the computing device 12.

(81) Although the present invention has been described in detail through the representative embodiments as above, those skilled in the art will understand that various modifications may be made thereto without departing from the scope of the present invention. Therefore, the scope of rights of the present invention should not be limited to the described embodiments, but should be defined not only by the claims set forth below but also by equivalents of the claims.