JP3939586B2 - Forward secure electronic signature method, apparatus, program, and recording medium - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic signature method for electronically assigning a signature / seal with an electronic document deliberation / settlement, electronic voting system, etc., in particular, only a session signature key is updated without updating a master verification key. The present invention relates to a forward-secure signature method, an apparatus thereof, a program thereof, and a recording medium.
[0002]
[Prior art]
A number of electronic signature methods are known as prior art.
Recently, a new electronic signature called a Forward-Secure signature has attracted attention [References 1 to 4]. This signature feature can update only the session signature key without updating the master verification key, and even if the signature key of a session is stolen, it is created by the signature key before that session. It has the feature that the signature can be kept secure.
First, I will explain a simple method that anyone can think of, and then briefly describe the first Forward-Secure signature shown in document [2] and other methods.
Simple Construction Method (Part 1) The signer creates (pk ₁ , sk ₁ ),..., (Pk _T , sk _T ), _T verification key / signature key pairs, and verifies the verification keys pk ₁ ,. pk _T is registered and the signature key (sk ₁ ,..., sk _T ) is kept secret. The signer signs for the first period using sk ₁ as a signature key and pk ₁ as a session verification key. At the time of key update, to change the signature key from sk _i to sk i _{+ 1,} would destroy the sk _i.
[0003]
The disadvantage of this method is that it requires a large number of verification keys and signature keys first, and the number of signature key updates is limited.
(Part 2) The signer creates (pk ₁ , sk ₁ ) as a pair of verification key and signature key, registers the verification key pk ₁ , and keeps the signature key sk ₁ secretly. The signer signs for the first period using sk ₁ as a signature key and pk ₁ as a session verification key. When updating the key, a new signature (pk _{i + 1} , sk _{i + 1} ) is created, and a signature σ _i = sig _ski (pk _{i +)} that approves pk _{i + 1} using the immediately previous session verification key pk _{i. 1)} to generate, also to change the signing key from sk _i to sk i _{+ 1,} would destroy the sk _i.
[0004]
In order to verify pk _{i + 1} , it is necessary to verify σ ₁ ,..., σ _i using all previous verification keys. For this reason, as the update progresses, it takes a long time and the amount of information to verify the session verification key.
In Bellare-Miner's construction method and other literature [2], Bellare-Miner constructed the Forward-Secure signature as follows.
Create N = pq from large different primes p and q. Z ^* _n random numbers s ₁ from ... to select s _k, generating a relative _{1 <i <k, U i} = s i ^ 2 T + 1 mod N ( where A ^ B represents A ^B) To do. (U ₁ ,..., U _k N) are registered as master verification keys, (s ₁ ,..., S _k ) are stored as signature keys, and p and q are discarded.
[0005]
The signature is the Feige-Fiat-Shamir signature. The key is updated by assuming that the signature key in session j is SK _j = {sk ₁ ^j ,..., Sk _k ^j } (sk _i ¹ = s _i ), SK _{j + 1} = {(sk ₁ ^j ) ² mod N,..., (Sk _k ^j ) ² mod N}.
This method is superior to the above two methods, particularly (No. 1), but has the disadvantage that the number of signature key updates is limited. That is, if the key is updated T times, s _i ^ 2 ^{T is obtained} , and the T + 1 time becomes the master key.
In addition, there are methods shown in the literature [1, 3, 4] and the like, but there are drawbacks such as a limited number of signature key updates and an increase in the amount of calculation according to the number of signature updates. The method shown in document [4] proposes a general Forward-Secure signature configuration method with no limit on the number of updates, but this method is inefficient and the amount of calculation changes depending on the number of signature updates. To do.
[0006]
[Problems to be solved by the invention]
As described above, the conventional methods have drawbacks such as a limited number of signature key updates and an increase in the amount of calculation according to the number of signature updates. The object of the present invention is a forward-secure signature method in which the efficiency does not depend on the number of signature updates, the signature is equivalent to the efficiency of a conventional Feige-Fiat-Shamir type signature, and the number of signature key updates is not limited The present invention provides an apparatus, a program thereof, and a recording medium.
[0007]
[Means for Solving the Problems]
When G is a group used for the discrete logarithm problem and the group operation is expressed by multiplication, the signer device generates s and x satisfying h = g ^s and y = g ^x for the element g of G. Publish (h, y) as a master verification key, generate a session verification key based on h, y, g, s, store (s, x) as a session signature key, store these session keys,
A signature is created for the message m using the session signature key (s, x), the signature, the session verification key, and the message are transmitted to the verifier device.
At the time of session update, g, s, x are changed to g ′, s ′, x ′ satisfying h = g ′ ^s ′, y = g ′ ^x ′, and similar to the generation of the session verification key. A new session verification key is generated based on h, y, g ′, and s ′, and the stored session key is updated using (s ′, x ′) as a new session signature key.
[0008]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 shows a configuration example of a system to which the method of the present invention is applied. The signer device 100 and the verifier device 200 can be coupled via an insecure communication path 300. The signer apparatus 100 can register the public key of the signer apparatus in the registration center apparatus 400, and the verifier apparatus 200 can acquire the public key of the signer apparatus 100 from the registration center apparatus 400.
Example 1
The embodiment of the present invention places safety grounds on the discrete logarithm problem of multiplicative groups over a finite field. That is, this is a case where the group operation is represented by multiplication as a group used for the discrete logarithm problem.
(1) Key Registration A large prime number q that divides a large prime number p and p−1 is registered and disclosed in the registration center apparatus 400 as a public parameter. An example of the functional configuration of the signer apparatus 100 is shown in FIG. 2, and the processing procedure is shown in FIG.
[0009]
When the signer device 100 joins the system, the random number generation unit 102 in the master key generation unit 101 randomly generates a value g ₀ other than 1 from Z ^* _p (= {1,..., P−1}). (S1), the power of (p-1) / q is calculated for the g ₀ by the remainder power calculator 103 (S2). The calculation result is assumed to be g = g ₀ ^{(p-1) / q} mod p.
Next, the random number generation unit 104 randomly generates two values s and x from Z _q (= {0, 1,..., Q−1}) (S3). The remainder power multipliers 105 and 106 respectively calculate the s-th power and the x-th power of g to obtain the master public verification keys h = g ^s mod p and y = g ^x mod p (S4). These master public verification keys h and y are registered in the public verification key book 400a of the registration center device 400 (S5). A master public verification key h, y for each signer A is registered in the public verification key book 400a, and anyone can access it from the outside.
(2) Creation of Session Signature Key The signer apparatus 100 generates a random number uεZ _q by the random number generation unit 104 (S6), and the power calculation unit 112 in the session key generation unit 111 raises g to the u power to obtain a = g ^u is calculated (S7). Further, a, g, master verification keys h, y, and public parameters p, q are input by the hash function calculation unit 113, and e = H (a, h, y, p, q, g) is calculated (S8). Using the hash operation result e and the random numbers u and s, the remainder multiplication / subtraction unit 114 calculates v = u-esmod q (S9).
[0010]
(V, e, g) is stored in the storage unit 121 as a session verification key and (s, x) is stored as the session signature key (S10). (S, x) is secret information.
(3) A case where the signer apparatus 100 signs the message m will be described after the creation of the signature.
The message m is input from the input unit 122 and temporarily stored in the storage unit 121 as necessary. It is checked whether a message m is input and a signature creation request is made (S11). If so, a random number wεZ ^* _q is first generated from the random number generation unit 104 (S12), and a power operation unit in the signature generation unit 131 is generated. At 132, g is raised to the power of ^w to calculate b = g ^w (S13). The calculation result b, the master verification key h, y, the above g, and the message m are subjected to a hash calculation by the hash function calculation unit 133 to calculate c = H (b, h, y, p, q, g, m). (S14). The calculation result c, the random numbers w and c, and the session signature key x are input to the remainder multiplication / subtraction unit 134 to calculate z = w−cxmod q (S15). Using the calculation result c and z as a signature (c, z) for m, m, (c, z) and a session verification key (v, e, g) are transmitted from the communication unit 141 to the verifier device 200 (S16). ).
(4) The signature verification verifier apparatus 200 receives a verification request together with m, (c, z), (v, e, g) in the communication unit 201 as shown in FIG. The received information is temporarily stored in the storage unit 202. The verifier device 200 acquires the master public verification keys h and y of the signer A (signer device 100) from the registration center device 400, and verifies that these h and y are h ≠ y by the verification unit 203. The verification unit 204 verifies that h, y, and received g are not 1. These conditions are based on selecting g ₀ from a value other than 1 at the time of key registration and selecting two s and x.
[0011]
Further, g received by the power calculation units 206 and 207 of the session key verification unit 205 is raised by the received v, and the master verification key h is raised by the received e, and the multiplication result is multiplied by the multiplication unit 208. The multiplication result and h, y, p, q, performs hash operation by entering and g in the hash function operation unit 209, the calculation result ^{H (g v h e, h} , y, p, q, g) and The comparison unit 211 checks whether the received e matches.
Similarly, in the signature verification unit 213, the power calculation units 214 and 215 calculate g ^z and y ^c , and multiply these results by the multiplication unit 216. The multiplication result and h, y, p, q, g , and m On the other hand, the hash function calculation unit 217 performs a hash calculation, and the comparison unit 218 confirms whether the result matches the received c .
[0012]
If all the verifications of the verification units 203, 204, 205, and 213 pass, the received (v, e, g) from the verification result output unit 219 is a session verification key based on the master verification key (h, y). And (c, z) is recognized as the signature of the message m with the session verification key (v, e, g), and a signal indicating pass (OK) is output, and even one of them does not pass verification. A signal indicating failure (NG) is output as an illegal signature.
Incidentally, (v, e, g) if the correct, v = u-es, h = from a ^{g s g v h e = g} u-es g es = g u, from the power calculation unit 112 (FIG. 2) g ^u = a. Therefore, the hash calculation of the calculation unit 209 is H (a, h, y, p, q, g), which matches the calculation result e of the calculation unit 113. Similarly (c, z) if the correct, z = w-cx, because it is ^{y = g x, g z y} c = g w - cx g cx = g w = b , and the arithmetic calculation section 217 H (B, h, y, p, q, g , m ), which matches the calculation result c of the calculation unit 133.
(5) Updating the signing key When it is time to update the session signing key (FIG. 3, S17), for example, when a certain period of time has passed after the generation of the session signing key, or when it has been used a predetermined number of times (see FIG. 2), the random number generation unit 104 generates a random number rεZ _q (S18), the exponent operation unit 143 in the key update unit 142 calculates g ′ = g ^r , and the remainder multiplication units 144 and 145 respectively generate random numbers r. inverse r ^-1 and session signature key s of the x respectively remainder operation, s'= r ^-1 smod q, obtaining the ^{x'= r -1 xmod q (S19} ). The session signature key is updated to these (s ′, x ′).
[0013]
A new session verification key is created as follows. A random number u′εZ ^* _q is generated from the random number generation unit 104 (S20), calculated by a ′ = g ′ ^u ′ power calculation unit 146 (S21), and using a hash function calculation unit 147, e ′ = H (A ′, h, y, p, q, g ′) is calculated (S22), and the remainder multiplication / subtraction unit 148 uses the above u ′, e ′ and s ′ to generate v ′ = u′−e ′. s'mod q is calculated (S23).
(V ′, e ′, g ′) is stored as a new session verification key and (s ′, x ′) is stored as a new session signature key in the storage unit 121, and the old session signature key (s, x) is discarded. The process returns to S11 (S24). If not updated at step S17, the process proceeds to step S11. Therefore, the signatures for the subsequent message m are (s ′, x ′), (v ′, e ′, g ′), and s, x, v, e, g are used as signatures c and z by the signature creation unit 131. Then, the session verification key is sent to the verifier apparatus 200 as (v, e, g).
[0014]
Since the session key is updated as described above, it can be updated any number of times. Although g and its changed g ′ = g ^r are output to the outside, it is difficult to estimate r from g ′ and g because it is a discrete logarithm problem. Therefore, safety is maintained. Even if the session signature key s ′, x ′ is stolen, it is necessary to know r in order to obtain the previous session key by s = rs ′, x = rx ′, and it is difficult to know r. As such, there is no risk of forgery of signatures made prior to being stolen.
Also, only those who know y = h ^{x / s} mod p = h ^x ′ ^{/ s} ′ mod p and h = g ^s mod p , y = g ^x mod p , y = h ^{x / s} mod p Can create ^x ′ and s ′, and satisfy g ′ and s so that the relationship of h = g ′ ^{s ′} mod p , y = g ′ ^x ′ mod p , and y = h ^x ′ ^{/ s} ′ mod p is satisfied. 'And x' may be updated.
[0015]
In the signer apparatus 100, each unit is sequentially operated by the control unit 149. In the verifier apparatus 200, each unit is operated by the control unit 230.
Example 2
The second embodiment of the present invention is a case where the basis of safety is a discrete logarithm problem that can be constructed on a group formed by rational points on an elliptic curve.
(1) A group formed by F _p- rational points of an elliptic curve E defined on the key registration finite field F _p is E (F _p ), and a large prime q that divides the order of the group E (F _p ) the placing subgroup having the position number and G (G⊂E (F _p) and q | is #E (F _p)). The above is registered and disclosed in the registration center apparatus 400 as a public parameter. FIG. 5 shows a functional configuration example of the signer apparatus 100.
[0016]
When the signer apparatus 100 joins the system, the random number generation unit 151 in the master key generation unit 150 randomly generates a value g from G- {0} ({0} represents a unit element). The random number generator 152 randomly generates two values s and x from Z _q (= {0, 1,..., Q−1}), and the elliptic multiple calculators 153 and 154 generate h = s · g and y. = X · g is calculated to obtain the master verification key. Here, s · g and x · g represent s multiplication and x multiplication of the point g on the elliptic curve, respectively. Further, an addition operation on g and hεG is represented by g + h.
These master verification keys h and y are registered in the public verification key book 400 a of the registration center device 400.
(2) Creation of Session Signature Key The signer apparatus 100 generates a random number uεZ _q by the random number generation unit 152, multiplies g by the elliptic multiple calculation unit 157 in the session key generation unit 156, and a = u · g is calculated, and the calculation result a and the master verification key h, y, g, G are input to the hash function calculation unit 158, and e = H (a, h, y, G, g) is calculated. The u, e and s are input to the remainder multiplication / subtraction unit 159 to calculate v = u−es mod q.
[0017]
(V, e, g) is stored in the storage unit 161 as a session verification key and (s, x) is stored as the session signature key.
(3) A case where the signer apparatus 100 signs the message m will be described after the creation of the signature.
The message m is input from the input unit 162 and temporarily stored in the storage unit 161 as necessary. A random number wεZ _q is generated from the random number generation unit 152, w and g are input to the elliptic multiple calculation unit 164 in the signature generation unit 163, and b = w · g is calculated, and b, h, y, G , G, m are input to the hash function computing unit 165 to calculate c = H (b, h, y, G, g, m). The calculation result c, w and x are input to the remainder multiplication / subtraction unit 166 to calculate z = w−cx mod q. The calculation result z and c are used as a signature (c, z), and a session verification key ( v, e, g) and the verifier device 200 and the communication unit 167.
(4) When the verification / verification apparatus 200 for signatures receives m, (c, Z) (v, e, g) in the communication unit 240 as shown in FIG. Stored in the unit 241. The master public verification keys h and y of the signer apparatus 100 are acquired from the registration center apparatus 400, and it is verified by the verification unit 242 that these are h ≠ y, and h, y, and g are all not 0. Verification is performed by the verification unit 243. Further, H (v · g + e · h, h, y, G, g) is calculated by the hash function calculation unit 253 in the session key verification unit 244, and the comparison unit 256 determines whether the calculation result matches the received e. Then, H (z · g + c · h, h, y, G, g, m) is calculated by the hash function calculation unit 258 in the signature verification unit 257, and whether the result matches c is determined by the comparison unit 256. Check. Each verification result of the verification units 242, 243, 244, and 257 is input to the verification result output unit 261, and if these verification results satisfy all the conditions, (v, e, g) is used as the verification key (h, y). ) And pass information OK indicating that (c, z) is recognized as a signature with the session verification key (v, e, g) of the message m, and even one of the conditions is satisfied. If not, the failure information NG is output.
(5) Updating the signature key When the session key is updated, the signer apparatus 100 generates a random number rεZ _q from the random number generation unit 152, and the elliptic multiple calculation unit 176 in the key update unit 175 performs g ′ = r · g is calculated, and s ′ = r ⁻¹ smod q and x ′ = r ⁻¹ x mod q are calculated by the remainder multipliers 177 and 178, respectively, and these (s ′, x ′) are used as new session signature keys. Update. A random number u′∈Z _q is generated from the random number generator 152, a ′ = u ′ · g ′ is calculated by the elliptic multiple calculator 179, and e ′ = H (a ′, h) is further calculated by the hash function calculator 181. , Y, G, g ′), and v ′ = u′−e′s′mod q is calculated by the remainder multiplication / subtraction unit 182 using the above u ′, e ′ and s ′. (V ′, e ′, g ′) is stored in the storage unit 161 as a new session signature key using (s ′, x ′) as a new session verification key, and the old session signature key (s, x) is discarded. In order to create a signature for the message m using these new session keys (s ′, x ′) and (v ′, e ′, g ′), the signature creation unit 163 sets (s ′, x ′) to (s , X) and (v ′, e ′, g ′) as (v, e, g).
[0018]
As described above, the session key can be updated any number of times. Since g and g ′ leak to the outside and g ′ = r · g, it is difficult to estimate r based on the elliptic discrete logarithm problem. Therefore, safety is maintained. Even if the session signing key is stolen, r cannot be estimated, so the previous session signing key cannot be estimated, and the security of the signature made before it is stolen is maintained.
Also in this case, it is difficult to estimate r from g and g ′, and y = x · s− ¹ · h = x ′ · s′− ¹ · h and h = s · g, y = x · g Only those who know the relationship can update the session key.
[0019]
In the signer apparatus 100, each unit is sequentially operated by the control unit 170. In the verifier apparatus 200, each unit is sequentially operated by the control unit 263.
In the first and second embodiments, the random numbers s and x for generating the master verification keys h and y are used as the first session signature key, but may be generated by the key update units 142 and 165 from the first session signature key. . The calculation units 146, 147, and 148 that calculate a ′, e ′, and v ′ in the key update unit 142 in FIG. 2 have the same calculation formulas as the calculation units 112, 113, and 114 in the session key generation unit 111, respectively. Since u ′, g ′, s ′, and x ′ generated at the time of key update are u, g, s, and x, respectively, a ′, e ′, and v ′ are calculated by the calculation units 112, 113, and 114. Calculation may be performed, that is, the calculation units 146, 147, and 148 may be omitted. This also applies to the signer apparatus shown in FIG. 5 in the second embodiment, and the calculation units 169 to 171 and 172 can be omitted. From this point, for example, in the processing procedure shown in FIG. 3, the process proceeds from step S19 to step S6, and g ′, s ′, x ′ is used as g, s, x and new a ′, e ′, v ′. May be generated.
[0020]
In the example shown in FIG. 2 and FIG. 5, a power multiplication unit, a remainder multiplication unit, a hash function computation unit, a remainder multiplication / subtraction unit, an elliptic multiple computation unit, etc. are provided one by one. Various data required as a data source to be generated under control may be input and used for generation of various data. The same can be said for the verifier apparatus 200 shown in FIGS. 4 and 6.
As is clear from the above description, ^s and ^x satisfying h = g ^s , y = g ^x or satisfying h = s · g and y = x · g are generated, and (h, y) is set as the master public key. And the session signature key (s, x) itself, those updated as described above are used, and the session verification key created from h, y, g, s may be used. If the key is updated to g ′, s ′, x ′ satisfying h = g ′ ^s ′, y = g ′ ^x ′ or h = s ′ · g ′, y = x ′ · g ′ Good. In addition, it can be said that the session verification key is applied to h, y, g, and s by using s instead of x and the same method as the signature (c, z) creation method.
[0021]
The first embodiment and the signer devices 100 and the user devices 200 can each function as a computer. In that case, for example, a program for causing the computer to function as the signer device 100 shown in FIG. 2 is installed in the computer from a recording medium such as a CD-ROM or a flexible magnetic disk, or downloaded via a communication line. Then, the program may be executed.
The signature creation method is not limited to the examples shown in the first and second embodiments, and other methods may be used, and the session verification key generation method is changed accordingly.
[0022]
【The invention's effect】
As described above, according to the present invention, since the discrete logarithm problem is used, the session key can be updated infinitely, and the conventional and most efficient Forward-Secure electronic signature shown in the literature [2] can be used. Compared with the method, the Bellare-Miner method needs to have (U ₁ ,..., U _k , N) as a master verification key, but in the present invention, only (h, y) is required. The amount of information is 2 / (k + 1). Since the discrete logarithm problem on the elliptic curve is used in the second embodiment, the parameters of h and y can be further reduced, and the signature calculation time is short, so that the calculation amount is 1/4 and the information amount is 2 / (k + 1) or less. .
[Brief description of the drawings]
FIG. 1 is a diagram showing a simple example of a system configuration to which a method of the present invention is applied.
FIG. 2 is a diagram showing a functional configuration example of a signer apparatus 100 according to the first embodiment of the present invention.
3 is a flowchart showing an example of a processing procedure of the apparatus shown in FIG.
FIG. 4 is a diagram illustrating a functional configuration example of a verifier apparatus 200 according to the first embodiment.
FIG. 5 is a diagram illustrating a functional configuration example of a signer apparatus 100 according to the second embodiment.
6 is a diagram illustrating a functional configuration example of a verifier apparatus 200 according to Embodiment 2. FIG.
References
[1] M. Abdalla and L. Reyzin. A new forward-secure digital signature scheme. In T. Okamoto, editor, Advances in Cryptology-ASIACRYPT2000, volume 1976 of Lecture Notes in Computer Science, pages 116-129. Springer-Verlag 2000.
[2] M. Bellare and S. Miner. A forward-secure digital signature scheme. In M. Wiener, editor, Advances in Cryptoloty-CRYPTO'99, volume 1666 of Lecture Notes in Computer Science, pages 431-448. Springer- Verlag, 19999.
[3] H.Krawczyk. Simple forward-secure signatures from any signature scheme. In 7th ACM conference on Computer and Communications security, 2000.
[4] T. Malkin, D. Micciancio, and S. Miner. Efficient generic forward-secure signatures with an unbounded number of time periods. In Advances in Cryptology-EUROCRYPT'02, Lecture Notes in Computer Science. Springer-Verlag, 2002 .

Claims (13)

A step in which the g ₀ generation unit of the signer device randomly generates a value g ₀ other than 1 from Z ^* _p (= { 1,..., P−1 } , p is a prime number) ;
A step of calculating a power of g by g = g ₀ ^{(p−1) / q} mod p (q is a prime number and a divisor of ^p−1) using the above g ₀ , and
Comprising the steps of random number generation unit of the signer _{apparatus, Z q (= {0,1,} ···, q-1}) from the random two to values s, to produce the x,
A first power calculation unit of the signer apparatus calculating h = g ^s mod p;
A second power calculator of the signer device calculating y = g ^x mod p;
And the h and the y as the master verification key, the registration center device, and storing from the external device accessibly,
A step of the session key generation unit of the signer apparatus generates a session verification key using the h, y, g, and s,
Storing the session verification key in the storage unit of the signer device;
A step of the above s and the x and session signature key, stored in the storage unit of the signer apparatus,
Signature maker of the signer's apparatus includes the steps of creating a signature using the session signature key for a message m,
The communication unit of the signer apparatus, and transmitting the said signature and said session verification key and the message to the verifier apparatus,
Run
When updating a session,
A key update unit of the signer device calculates g ′, s ′, x ′ satisfying h = g ′ ^{s ′} mod p, y = g ′ ^{x ′} mod p;
A key update unit of the signer device generates a new session verification key using h, y, g ′, and s ′;
And storing in a storage unit and the s'the x'a new session signature key signer apparatus,
Storing the new session verification key in the storage of the signer device;
Forward secure electronic signature method, characterized by the execution. The random number s, x is varies each other,
The step of generating the session verification key includes:
Random number generation unit of the signer's apparatus includes the steps of generating a random number u,
The third power calculation unit of the signer apparatus, calculating a a = g ^u,
The first hash function calculation unit of the signer apparatus performs a hash function calculation on the bit combination values of a, h, y, and g using the hash function H , and a hash value e = H (a, h, y, g) and step asking you to,
The first modular multiplier-subtractor unit of the signer apparatus, the u, with respect to e及beauty s, calculating the v = u-e · s mod q,
Comprising
The above session verification key is above v, the above-mentioned e, the g,
Step to create the signature,
Random number generation unit of the signer's apparatus includes the steps of generating a random number w,
The fourth power operation of the signer apparatus, calculating a b = g ^w,
The second hash function calculation unit of the signer apparatus calculates a hash function with the hash function H for the bit combination values of b, h, y, g, m , and the hash value c = H (b, h, y, g, and a step asking you to m),
A second remainder multiplication / subtraction unit of the signer apparatus calculates z = w−c · x mod q for w, c and x ;
Comprising
The signature is the c and z,
During signature verification,
The communication unit of the verifier apparatus, receiving the and the signature the message and the session verification key,
A step first verification unit of the verifier apparatus, which uses the master verification key to verify that the h and y are not equal,
The second verification unit of the verifier apparatus, and a step of verifying that h, y, g is not each 1,
A fifth power calculator of the verifier device calculating g ^v ;
Sixth exponentiation of verifier device, calculating a h ^e,
First multiplication unit of the verifier apparatus, and a step of multiplying the g ^v and h ^e,
Third hash function operation unit of the verifier ^{apparatus, g v h e, h,} y, by the hash function H to the bit coupling value of g, the hash function calculation of ^{H (g v h e, h} , y, g) and line cormorant steps,
A step of first comparing section verifier device verifies that the hash function calculated value calculated in the third hash function operation unit and the e are equal,
A seventh power calculator of the verifier device calculates g ^z ;
An eighth power operation unit of the verifier device calculating y ^c ;
A second multiplying unit of the verifier device multiplying g ^z and y ^c ;
The fourth hash function calculation unit of the verifier device performs the hash function H on the bit combination value of g ^z y ^c , h, y, g, m to H (g ^z y ^c , H, y, g, and row Cormorant step hash function calculations m),
A step of second comparison unit of the verifier device verifies that the fourth hash function calculated value calculated by the hash function operation unit and c are equal,
The first verification unit determines that h and y are not equal, the second verification unit determines that h, y, and g are not 1, and the first comparison unit calculates the third hash function calculation unit. If the hash function calculation value and e are determined to be equal, and the second comparison unit determines that the hash function calculation value calculated by the fourth hash function calculation unit and c are equal, step verification result output unit, the v, the e, a session verification key of the g master verification key, which the c, the z outputs a signal admitted to be signed by the session verification key of the message When,
Run
The step of calculating g ′, s ′, x ′ satisfying h = g ′ ^{s ′} mod p, y = g ′ ^{x ′} mod p,
Random number generation unit of the signer's apparatus includes the steps of generating a random number r,
Ninth exponentiation of the signer apparatus, calculating a g '= g ^r,
A first remainder multiplication unit of the signer device calculating s ′ = r ⁻¹ · s mod q;
A second remainder multiplication unit of the signer device calculates x ′ = r ⁻¹ · x mod q ;
Comprising
The step of generating the new session verification key is as follows:
Random number generation unit of the signer's apparatus includes the steps of generating a random number u',
A step of calculating a ^′ = g ′ ^{u ′} by a tenth power operation unit of the signer device ;
The fifth hash function calculation unit of the signer apparatus performs a hash function calculation with the hash function H on the bit combination values of a ′, h, y, g ′ , and the hash value e ′ = H (a ′, h, comprising the steps of: y, Ru seek g'),
A step of calculating v ′ = u′−e ′ · s′mod q for u ′, e ′ and s ′ by the third remainder multiplication / subtraction unit of the signer device ;
Comprising
The new session verification key is above v', the e', is the above g',
The forward secure electronic signature method according to claim 1. The g generation unit of the signer device performs a finite field F _p Randomly generating a point g on the elliptic curve E defined above and excluding unit elements;
The random number generator of the signer device _q (= { Generating two values s, x randomly from 0, 1, ..., q-1);
A step of calculating a s multiplication value h = s · g of a point g on the elliptic curve E by a first elliptic multiplication unit of the signer apparatus;
A step of calculating a x multiplication value y = x · g of a point g on the elliptic curve E by a second elliptic multiple calculation unit of the signer apparatus;
Storing the above h and y as master verification keys in a registration center device so as to be accessible from an external device;
A session key generation unit of the signer device generates a session verification key using the h, y, g, and s;
Storing the session verification key in the storage unit of the signer device;
Storing s and x as a session signature key in a storage unit of a signer device;
A step in which a signature creation unit of the signer device creates a signature for the message m using the session signature key;
A communication unit of the signer device transmits the signature, the session verification key, and the message to the verifier device;
Run
When updating a session,
The key update unit of the signer apparatus performs h = s ′ · g ′ (s ′ multiplication of the point g ′ on the elliptic curve E), y = x ′ · g ′ (the point on the elliptic curve E) g ′, s ′, x ′ satisfying x ′ multiplication of g ′);
A key update unit of the signer device generates a new session verification key using h, y, g ′, and s ′;
Storing the above s ′ and x ′ as a new session signing key in the storage unit of the signer device;
Storing the new session verification key in the storage of the signer device;
A forward secure electronic signature method characterized in that: The random numbers s and x are different from each other,
The step of generating the session verification key includes:
A random number generator of the signer device generates a random number u;
A step of calculating a u multiplication value a = u · g of the point g on the elliptic curve E by a third elliptic multiple calculation unit of the signer apparatus;
The first hash function calculation unit of the signer device performs a hash function calculation on the bit combination values of a, h, y, and g using the hash function H, and a hash value e = H (a, h, y, g) A step of seeking
The first remainder multiplication / subtraction unit of the signer apparatus sets v = u−e · s for u, e and s. mod calculating q;
Comprising
The session verification keys are v, e, and g,
The step of creating the signature is
A random number generator of the signer device generates a random number w;
A step in which a fourth elliptic multiple calculation unit of the signer apparatus calculates a w multiplication value b = w · g of the point g on the elliptic curve E;
The second hash function calculation unit of the signer apparatus calculates a hash function with the hash function H for the bit combination values of b, h, y, g, m, and the hash value c = H (b, h, y, g, m), and
The second remainder multiplication / subtraction unit of the signer apparatus sets z = w−c · x for w, c and x. mod calculating q;
Comprising
The signature is c and z,
During signature verification,
A communication unit of the verifier device receives the message, the session verification key, and the signature;
A first verification unit of the verifier device using the master verification key to verify that h and y are not equal;
A second verification unit of the verifier device verifies that h, y, and g are not 0;
The third hash function calculation unit of the verifier device uses the hash function H for the bit combination value of v · g + e · h, h, y, and g to hash H (v · g + e · h, h, y, g). Performing a function calculation;
The first comparison unit of the verifier device verifies that e is equal to the hash function calculation value calculated by the third hash function calculation unit;
The fourth hash function calculation unit of the verifier device performs z · g + c · y Performing a hash function calculation of H (z · g + c · y, h, y, g, m) with a hash function H on the bit combination values of h, y, g, m,
The second comparison unit of the verifier apparatus verifies that the hash function calculation value calculated by the fourth hash function calculation unit is equal to c;
The first verification unit determines that h and y are not equal, the second verification unit determines that h, y, and g are not 1, and the first comparison unit calculates the third hash function calculation unit. If the hash function calculation value and e are determined to be equal, and the second comparison unit determines that the hash function calculation value calculated by the fourth hash function calculation unit and c are equal, A step of outputting a signal that the verification result output unit recognizes that v, e, and g are a session verification key of a master verification key, and c and z are signatures of a session verification key of the message;
Run
H = s ′ · g ′ (s ′ multiplication of point g ′ on the elliptic curve E), y = x ′ · g ′ (x ′ multiplication of point g ′ on the elliptic curve E) The step of calculating g ′, s ′, x ′ satisfying
A random number generator of the signer device generates a random number r;
A step in which a fifth elliptic multiple computing unit of the signer apparatus calculates an r-multiplied value g ′ = r · g of the point g on the elliptic curve E;
The first remainder multiplication unit of the signer device is s ′ = r ^-1 ・ S  mod calculating q;
The second remainder multiplication unit of the signer device sets x ′ = r ^-1 ・ X  mod calculating q;
Comprising
The step of generating the new session verification key is as follows:
A random number generator of the signer device generates a random number u ′;
A step of calculating a u ′ multiplication value a ′ = u ′ · g ′ of the point g ′ on the elliptic curve E by a sixth elliptic multiple calculation unit of the signer apparatus;
A fifth hash function operation unit of the signer device calculates a hash function for a ′, h, y, g ′ to obtain e ′ = H (a ′, h, y, g ′);
The third remainder multiplication / subtraction unit of the signer apparatus applies v ′ = u′−e ′ · s ′ to u ′, e ′, and s ′. mod calculating q;
Comprising
The new session verification keys are v ′, e ′, and g ′.
The forward secure electronic signature method according to claim 3. A g ₀ generator that randomly generates a value g ₀ other than 1 from Z ^* _p (= { 1,..., P−1 } , p is a prime number) ;
A power-of-residue calculating unit that calculates g by g = g ₀ ^{(p−1) / q} mod p (q is a prime number and a divisor of ^p−1) using the above g ₀ ;
A random number generator that randomly generates two values s and x from Z _q (= { 0, 1,..., Q−1 } ) ;
a first power calculator for calculating h = g ^s mod p;
a second power calculator for calculating y = g ^x mod p;
A session key generation unit that generates a session verification key using h, y, g, and s ;
A signature creation unit that creates a signature for the message m using the session signature key ;
A communication unit that transmits the signature, the session verification key, and the message to the verifier device;
Run
At the time of session update, g ′, ^{s ′} , ^{x ′} satisfying h = g ′ ^{s ′} mod p, y = g′x ^′ mod p is calculated, and a new session is generated using the above h, y, g ′, s ′. A key update unit for generating a verification key ;
A storage unit for storing s and x as a session signing key, s 'and x' as a new session signing key, and storing them together with the session verification key and the new session verification key. signer apparatus of forward secure electronic signature. The random numbers s and x are different from each other,
The session verification key generation unit
A random number generator for generating a random number u;
a third power calculator for calculating a = g ^u ;
a first hash function calculation unit that calculates a hash value e = H (a, h, y, g) by performing a hash function calculation on the bit combination values of a, h, y, and g using a hash function H;
A first modular multiplication / subtraction unit for calculating v = u−e · s mod q for u, e and s ;
Comprising
The session verification keys are v, e, and g ,
The signature creation part
A random number generator for generating a random number w;
a fourth power calculator for calculating b = g ^w ;
A second hash function computing unit that calculates a hash value c = H (b, h, y, g, m) by performing a hash function calculation with a hash function H on the bit combination values of b, h, y, g, m When,
A second modular multiplication / subtraction unit for calculating z = w−c · x mod q for w, c and x ;
Comprising
The signature is c and z,
The key update unit
A random number generator for generating a random number r and a random number u ′;
a ninth power calculating unit for calculating the g '= g ^r,
a first modular multiplication unit for calculating s ′ = r ⁻¹ · s mod q;
a second modular multiplication unit for calculating x ′ = r ⁻¹ · x mod q;
a tenth power calculation unit for calculating a ^′ = g ′ ^{u ′} ;
a', h, y, I row hash function calculated by the hash function H to the bit coupling value of g ', the hash value e'= H (a', h, y, g') fifth hash function for obtaining the An arithmetic unit ;
A third modular multiplication / subtraction unit for calculating v ′ = u′−e ′ · s ′ mod q for u ′, e ′ and s ′ ;
Comprising
The new session verification keys are v ′, e ′, and g ′.
6. The signer apparatus for a forward secure electronic signature according to claim 5 . A communication unit that receives the message, the session verification key, and the signature;
A first verification unit that verifies that h and y are not equal, using publicly available h and y ;
a second verification unit that verifies that h, y, and g are not 1, respectively;
a fifth power calculator for calculating g ^v ;
a sixth power calculator for calculating h ^e ;
a first multiplication unit for multiplying the g ^v and h ^{e,
g v h e, h, y} , by the hash function H to the bit coupling value of g, and the third hash function operation unit for performing ^{H (g v h e, h} , y, g) a hash function calculations,
A first comparison unit that verifies that the hash function calculation value calculated by the third hash function calculation unit is equal to e;
a seventh power calculator for calculating g ^z ;
an eighth power operation unit for calculating y ^c ;
a second multiplier for multiplying g ^z and y ^c ;
^{g z y c, h, y} , g, by the hash function H to the bit coupling values of m, H 4 hash function operation unit for performing ^{(g z y c, h,} y, g, m) hash function calculations When,
A second comparison unit for verifying that the hash function calculation value calculated by the fourth hash function calculation unit and c are equal;
The first verification unit determines that h and y are not equal, the second verification unit determines that h, y, and g are not 1, and the first comparison unit calculates the third hash function calculation unit. When the calculated hash function value and e are equal, and the second comparison unit determines that the hash function calculated value calculated by the fourth hash function calculation unit and c are equal, v, e, g is a session verification key of the master verification key, and c, z are verification result output units that output a signal that recognizes that the message is a signature by the session verification key of the message;
A forward secure electronic signature verifier device comprising: A g generator for randomly generating a point g on the elliptic curve E defined on the finite field F _p and excluding the unit element;
A random number generator that randomly generates two values s and x from Z _q (= { 0, 1,..., Q−1 } ) ;
A first elliptic multiple calculation unit for calculating an s multiplication value h = s · g of the point g on the elliptic curve E;
A second elliptic multiple calculation unit for calculating an x multiplication value y = x · g of the point g on the elliptic curve E;
A session key generation unit that generates a session verification key using h, y, g, and s ;
A signature creation unit that creates a signature for the message m using the session signature key ;
A communication unit that transmits the signature, the session verification key, and the message to the verifier device;
Run
At the time of session update, h = s ′ · g ′ (s ′ multiplication of point g ′ on the elliptic curve E), y = x ′ · g ′ (x ′ of point g ′ on the elliptic curve E) A key update unit that calculates g ′, s ′, x ′ satisfying (multiplication) and generates a new session verification key using h, y, g ′, s ′ .
A storage unit for storing s and x as a session signature key, s ′ and x ′ as a new session signature key, and storing them together with the session verification key and the new session verification key;
A signer device for forward secure electronic signature comprising: The random numbers s and x are different from each other,
The session verification key generation unit
A random number generator for generating a random number u;
A third elliptic multiple arithmetic unit for calculating a u multiplication value a = u · g of the point g on the elliptic curve E;
a first hash function calculation unit that calculates a hash value e = H (a, h, y, g) by performing a hash function calculation on the bit combination values of a, h, y, and g using a hash function H;
A first modular multiplication / subtraction unit for calculating v = u−e · s mod q for u, e and s ;
Comprising
The above session verification key is above v, the above-mentioned e, the g,
The signature creation part
A random number generator for generating a random number w;
A fourth elliptic multiple calculation unit for calculating the w multiplication value b = w · g of the point g on the elliptic curve E;
A second hash function computing unit that calculates a hash value c = H (b, h, y, g, m) by performing a hash function calculation with a hash function H on the bit combination values of b, h, y, g, m When,
A second modular multiplication / subtraction unit for calculating z = w−c · x mod q for w, c and x ;
Comprising
The signature is c and z,
The key update unit
A random number generator for generating a random number r and a random number u ′;
A fifth elliptic multiple computing unit for calculating an r-multiplied value g ′ = r · g of the point g on the elliptic curve E;
a first modular multiplication unit for calculating s ′ = r ⁻¹ · s mod q;
a second modular multiplication unit for calculating x ′ = r ⁻¹ · x mod q;
A sixth elliptic multiple calculation unit for calculating the u ′ multiplication value a ′ = u ′ · g ′ of the point g ′ on the elliptic curve E;
A fifth hash function operation for calculating a hash function e ′ = H (a ′, h, y, g ′) by performing a hash function calculation with a hash function H on the bit combination values of a ′, h, y, g ′ And
A third modular multiplication / subtraction unit for calculating v ′ = u′−e ′ · s ′ mod q for u ′, e ′ and s ′ ;
Comprising
The new session verification keys are v ′, e ′, and g ′.
9. The signer apparatus for a forward secure electronic signature according to claim 8. A communication unit that receives the message, the session verification key, and the signature;
A first verification unit that verifies that h and y are not equal, using publicly available h and y;
a second verification unit for verifying that h, y, and g are not 0,
a third hash function calculation unit that performs a hash function calculation of H (v · g + e · h, h, y, g) by a hash function H on the bit combination value of v · g + e · h, h, y, g;
A first comparison unit that verifies that the hash function calculation value calculated by the third hash function calculation unit is equal to e;
z · g + c · y , H, y, g, m, a fourth hash function calculation unit that performs a hash function calculation of H (z · g + c · y, h, y, g, m) by a hash function H with respect to the bit combination value of
A second comparison unit for verifying that the hash function calculation value calculated by the fourth hash function calculation unit and c are equal;
The first verification unit determines that h and y are not equal, the second verification unit determines that h, y, and g are not 1, and the first comparison unit calculates the third hash function calculation unit. It is determined that the calculated hash function value is equal to e, and the second comparison unit calculates the fourth hash function calculation unit. When it is determined that the calculated hash function value is equal to c, v, e, and g are session verification keys of the master verification key, and c and z are signatures of the message by the session verification key. A verification result output unit that outputs a signal that is recognized as
A forward secure electronic signature verifier device comprising:   The program for functioning a computer as a signer apparatus in any one of Claim 5,6,8,9.   A program for causing a computer to function as the verifier device according to claim 7.   A computer-readable recording medium in which the program according to claim 11 is recorded.

Images