本研究的研究目的是比較雙方秘密數值是否相等，而在以往的安全多 方計算的研究，通常雙方的秘密數值經過協定之後，一個為告知方，另外 一個為被告知方，由告知方通知計算後之結果，而被告知方只能相信此訊 息。如果藉由半誠實的第三方可解決上述問題並減少計算量，但找到可以 信任的第三方是比較不容易的。 基於以上問題，本研究提出一新的秘密計算協定，在此協定下參與的 雙方(告知方、被告知方)可以算出彼此所擁有的秘密是否相同。如果不同， 此協定不會洩漏任何秘密值的資訊。本方案亦提供驗證機制，讓被告知方 能驗證告知方是否屬實。 / The purpose of this study is to compare the equality of two secret values. Secure multiparty computation in the previous study, usually through the protocol the two sides, the one is announcer and the other one be told. The one be told by the announcer who notified the results of verification, and the one be told only can believe that the message. Through the semi-honest party can solve by the above problems and reduce the computation required, but you can find a trusted third party is not easy. Based on the above problems, this study proposed in the framework of both the secret of a new calculation of protocol, in this protocol the two parties (the one is announcer, the other one be told) can calculate each have a secret are equal or not. If different, this protocol does not leak any information about the secret value.

雙方相等性驗證即是在不洩漏任何自身私密資訊的情況下，進行秘密計算來了解彼此的資訊是否相等。然而在大多數的現有協議之中，多數為不公平的協定，也就是說其中的一方(被告知方)只能相信另一方(告知方)所告知的比較結果，而無從驗證。雖然邱等學者在2011 年提出的〝具隱私保護功能之兩方相等性驗證機制之提案〞已經提供了具雙方驗證的協定，但此方案因為在加密演算法上的限制導致實作較為困難。因此，在本論文中，將利用ElGamal 的加密機制，提出了一套新的雙方相等性驗證的協議，具備相同的雙方相等性驗證的功能，但對加密演算法的限制較少，實作及運算也較為有效率。另外，搭配模糊傳輸的協定，讓使用者藉由本研究所提出的協定跟伺服器端溝通，來獲得所欲取得的資料，並同時保障使用者以及伺服器端的隱私。同時除了理論的證明安全性及正確性之外，也撰寫程式模擬並證實協定的正確性及討論其效能。 / Two-party equality testing protocol allows two entities to compare their secrete information without leaking any information except the comparison result. In previous works, the comparison result can only be obtained by one entity (ie. informer) and then the entity informs the result to the other entity (ie. receiver). The receiver has to accept the received result since he has no way to verify its correctness. Ciou et al. in 2011 first mentioned this problem and proposed a new protocol to solve the aforementioned problem. However, their protocol has some specific restrictions which making it unpractical. In this paper, based on the ElGamal encryption, we propose a new two-party equality testing protocol. Our protocol has the same feature (ie. allows the two entries to test the correctness of the comparison result) as Ciou et al.’s protocol but is more efficient and practical than theirs. On the other hand, combining our protocol with an oblivious transfer protocol can let users communicate with servers and to get the data in a private way. It is useful on the issue of privacy protection. Finally, the security and correctness are discussed and proved. The efficiency of the protocol is also provided.

"全同態加密法"(Fully Homomorphic Encryption (FHE))一詞的介紹以及架構源於西元2009年由Gentry所提出。它讓加密後的密文執行特定的運算再將其解密即可得出該對應的明文運算結果，除此之外，全同態與同態最大的不同是它允許兩種或是多種以上的運算元進行資料運算，期間必須可以處理大量的資料並且保護其資料隱私性使其無洩漏之虞。也因為上述特點使得它可被廣泛使用在許多資料庫或是資料儲存上的應用，像是ASP、雲端運算或是雙方相等性驗證上，然而在Gentry的全同態加密中，它需要大量的空間來儲存所需要的公鑰，因此在實作上仍有一定的難度。為了解決上述問題，本文提供了一種新的改良方案使其更有效率來達到全同態加密的實作性，除此之外，我們也會在文章中提出安全性分析來證明本改良方案並不會對安全性造成影響，並且提出系統效能測試，說明本方案除了可減少公鑰儲存空間之外，在時間上，更可降低公鑰生成以及系統加密的時間，讓其全同態運算更具效率。 / C. Gentry in 2009 proposed the first practical scheme which can compute arbitrary functions of encrypted data. This scheme is named “Fully Homomorphic Encryption (FHE)”. FHE allows a worker without the secret decryption key to compute any result of the data on one hand and still keep the data privacy on the other hand. It can be widely used in data storage application or database application, such as ASP, cloud computing and two-party equality testing. However, one drawback of Gentry’s fully homomorphic encryption scheme is that the size of public keys used in this system is extremely large. This means that a lot of space is required in order to store those public keys. This problem causes Gentry’s FHE hard to be implemented. In this thesis, we address the problem above, and give an improvement encryption scheme. Our improvement scheme needs less space to store the public keys which also makes the new scheme more efficient than Gentry’s original scheme. We also give a rigorous security proof to show that our improvement scheme is as secure as Gentry’s original scheme. A system performance test is also provided which shows that our scheme can not only reduce the numbers of public keys, but also reduce the time for public key generation and for encryption. Therefore, our improvement scheme can make fully homomorphic encryption more practical.

本論文提出了一個免憑證加密系統的方案，並且將此方案實作出來，使得此方案更具實用性。此方案主要架構為免憑證加密系統，利用此系統的特性消除傳統公開金鑰密碼系統中需要公開金鑰憑證認證的麻煩，也不會產生基於身分認證加密系統的私鑰託管問題，有效的結合了兩項系統的優點，並且提高了這兩種系統的安全性及方便性。本論文的協定中，在基於身分認證加密系統的公鑰部分還加入了階級以及時間戳記的概念，用以限制接收方取得部份私鑰的能力，並且也將接收方的部分公鑰加入其中，來增加部份私鑰的安全性。另外此協定也加入了提早解密金鑰的部分，可讓傳送方在傳出密文後更改解密時間，而不需要重新使用新的公鑰加密資訊，便可提早讓接收方取得相對應的明文資訊。 / In this paper, we propose a new certificateless public key encryption system, and implement it for securing e-mail systems. Certificateless cryptography, which is in contrast to traditional public key crypto-systems, does not require the use of certificates to guarantee the authenticity of public key. It does rely on the use of a trusted third party (TTP) who is in possession of a master key, just like the identity-based public key cryptography. However, certificateless public key crypto-system does not suffer from the key escrow property, whereas, it is a problem in the identity-based public key crypto-systems. Moreover, in our system, we add some new properties like level and time-stamp to limit the ability of receivers and to promote the safety of the system. Time-stamp ensures that the ciphertext cannot be decrypted before the indicated time and a level ensures that only the user with the corresponding identity and level can decrypt the ciphertext. In addition, a new feature is also introduced which is called the time-release encryption. Time-release encryption allows the encrypter to publish a release key so that the ciphertext can be decrypted by the receiver before the time indicated in the time-stamp when necessary.

區塊鏈有著不可否認性、可追溯性以及共識性等特點，所有的交易內容都會完整的被記錄在區塊鏈上，基於上述幾項特性，我們利用區塊鏈來記錄公開資訊，將私密資料經由分散式秘密共享後再加密存放於智能合約中。其中，智能合約是一個能將交易狀態和交易狀態內嵌於區塊鏈上的應用，透過智能合約作為媒介，我們能夠將加密後的私密資料完整的存放於區塊鏈上，最後經由區塊鏈網路上的節點驗證後，達到資料正確性驗證的目的。 本研究分析現有的電子投票以及電子投標等應用的系統架構後，發現兩者皆存在著可信賴的第三方進行開票及開標的角色，且驗證流程繁瑣，無法提供一個便利性的投票與投標流程。此外，上述兩種應用皆須滿足機密性、不可否認性、匿名性以及可驗證性等安全性質，若能結合區塊鏈與智能合約於上述應用中，將可提升資料的可驗證性以及降低成本的負擔，對參與應用的人而言也能達到公開透明的需求。 因此，本文提出一個分散式架構下的電子投票與投標機制，結合區塊鏈以及智能合約的優點與技術，讓所有參與投票的選民、投標的廠商共同參與驗證與計算，並加強參與者的匿名性、資料傳輸的隱私性、開票與開標階段資料的可信賴性以及可驗證性。 / With the rise of blockchain technology, the core concept of decentralization has gradually drawn attention. In this context, the main objective of this study is to realize more convenient and secure electronic applications with the use of blockchain technology. This research is aimed to design a distributed e-voting and e-bidding system. The core idea is to combine the blockchain technology with secret sharing scheme and homomorphic encryption in order to realize the distributed e-voting and e-bidding application without a trusted third party. The system allows voters to participate in opening phase. It provides a public and transparent process while protecting the anonymity of voter’s and vendor’s identity, the privacy of data transmission and verifiability of data during the opening phase.

本文深入探討許多基於公開金鑰密碼和通行碼的密文運算方案。首先第一個主題是「公開金鑰密碼」，從其基本架構和安全定義開始，透過文獻探討逐步地討論公開金鑰密碼學的各項特性、以及討論公開金鑰密碼中兩個常見的密文運算：同態加密系統和可交換性加密系統。同態運算是針對同一把公鑰加密的不同密文間的運算：兩個以同一把公鑰加密的密文可以在不解密的前提下進行運算，進而成為另一個合法密文。這個密文運算的結果等同於兩個明文做運算後再以該公鑰加密。可交換性加密系統是一個容許重複的加密系統：已用甲方公鑰加密的密文可以再度用乙方公鑰再加密，進而之成一個多收件者的密文。第一個主題圍繞著這兩個密文運算的技巧討論相關的加密方案。接下來第二個研究的的主題是「基於公開金鑰密碼之密文相等性驗證」，「密文相等性驗證」是密文運算中一個基礎但重要的功能，經授權的測試者可以在不解密密文的前提下，驗證兩個加密後的訊息是否相等。此外，除了相等或不相等之外，測試者無法得知密文中的其他訊息。「基於公開金鑰密碼之密文相等性驗證」相當於在「公開金鑰密碼」的基礎上，再加上「授權」和「密文相等性驗證」的功能。其中「授權」的範圍和「授權」的設計，直接影響到該方案的實用性及安全性，本文提出三個關於「授權」的主題：「單一密文授權」、「相容性授權」和「語意安全授權」。第三個研究主題是「 可搜尋式加密系統」， 常被應用於以下情境：使用者一個檔案及數個「關鍵字」進行加密，然後儲存在雲端伺服器上。當使用者想要對加密檔案進行關鍵字搜尋時，他可以自訂幾個想搜尋的「關鍵字」並對雲端伺服器發出搜尋要求。在收到搜尋要求後，雖然關鍵字都是加密儲存，仍可利用「可搜尋式加密」技巧將符合關鍵字搜尋的檔案傳回給收件者。整個過程中檔案和關鍵字都被加密保護，伺服器無法得知其儲存及搜尋內容。本文提出兩個「 可搜尋式加密系統」，分別是「子集合式多關鍵字可搜尋式加密系統」和「基於通行碼的可搜尋式加密系統」 。 / This dissertation addresses the research about ciphertext computation skills over public key encryption and password-authenticated cryptosystems. The first topic is related to the public key encryption, the framework and security notions for public key encryption are revised; and two common ciphertext-computable public key encryptions including homomorphic encryption and commutative encryption are following discussed. The homomorphic encryption denotes computations over ciphertexts encrypted using the same public key. The homomorphic operation over ciphertexts may be equal to the encryption of a new message computed between two original messages. In terms of commutative encryption, it stands for a repeated encryption system that Alice’s ciphertext can be duplicated encrypted using Bob’s public key. A dual-receiver ciphertext will appear after the commutative encryption. Following, based on the public key encryption, the second topic focuses on the public key encryption with equality test schemes, the basic and fundamental ciphertext computation. Briefly, the user-authorized testers are able to verify the equivalence between messages hidden in ciphertexts after they acquire trapdoors from ciphertext receivers; and the ciphertexts were never decrypted in the whole equality testing process. The scope and architecture of the authorization directly influence the application and security for equality test schemes. Three authorizations including “cipher-bound authorization”, “compatible authorization” and “semantic secure authorization” will be proposed. The third topic is keyword search. It works in the following scenario: a user outsources encrypted files and encrypted keywords on a cloud file storage system; then, when needed, the user is able to request a search query to the file server, which is corresponding to some encrypted keywords. Although files and keywords are encrypted, the server is still able to verify the match-up and return related files to the user. Two researches about keyword search are proposed: the subset multi-keyword search based on public key encryption, and the password-authenticated keyword search.