JP5227201B2 - Bit commitment system, bit commitment method, bit commitment transmission device, bit commitment reception device, bit commitment transmission method, bit commitment reception method, bit commitment program - Google Patents

Description

  The present invention relates to a bit commitment system, a bit commitment transmitting device, a bit commitment receiving device, a method thereof, and a program thereof for committing (verifying) and verifying certain information in a telecommunication system.

  Non-Patent Document 1 is known as a prior art as a non-interactive system and a single bit commitment system. On the other hand, Non-Patent Document 2 is known as a prior art as a method for generating two commitments, which is an interactive method and a multi-bit commitment method.

Ran Canetti, Marc Fischlin, "Universally Composable Commitments", Advances in Cryptology-CRYPTO 2001, Springer Berlin / Heidelberg, 2001, Volume 2139/2001, p.19-40 Ivan Damgard, Jens Groth, "Non-interactive and reusable non-malleable commitment schemes", Annual ACM Symposium on Theory of Computing, San Diego, CA, USA, ACM, 2003, p.426-437

  However, although the prior art is a non-interactive system, there is only a non-interactive system that is not a multi-bit commitment system or a multi-bit commitment system. There is a problem of providing a non-interactive and multi-bit commitment type bit commitment system, a bit commitment method, and an apparatus therefor.

  The bit commitment system of the present invention includes a transmitting apparatus that commits information m of 1 bit or more, a receiving apparatus that verifies the commitment, and a public apparatus that is managed by a trusted third party. The publishing apparatus generates and publishes common reference information crs including a function index s of an All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”). The transmitting device obtains c0 from the function index s and the random number ra using the verification key vk as a loss branch using ABO-TDF, randomizes c0 using the random number rb, generates c1, and generates a random number. c2 is obtained from ra and information m, and a signature generation unit that generates a signature σ using a signature key sk from c1 and c2, a commitment generation unit that generates a commitment com including c1, c2, and σ, and information m And an unsealing information generation unit for generating unsealing information M including random numbers ra and rb. The receiving device includes a signature verification unit that verifies the signature σ using the verification key vk, and a commitment verification unit that verifies the commitment com using the common reference information crs and the opening information M.

The present invention uses an All-but-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”) and its homomorphism. For details on ABO-TDF, see Chris Peikert, Brent Waters, "Lossy trapdoor functions and their applications", Annual ACM Symposium on Theory of Computing, Victoria, British Columbia, Canada, ACM, 2008, p.187-196 (hereinafter " Reference 1 ”). Here, an outline of ABO-TDF will be described. Let λ be the security parameter of ABO-TDF. The security parameter is a measure representing the difficulty of forging a signature sentence. n (λ) represents the input length of the function, k (λ) represents the missing degree of the function (hereinafter, λ is omitted), r represents the residual leakage amount,
r (λ) = n (λ) −k (λ)
It is defined as ABO-TDF has branches, and B = {B _λ } _λ∈N represents a set of branches when the security parameter is λ. The ABO-TDF includes a one-way function algorithm G _bo , a function index generation algorithm S _bobo that generates a function index and a trapdoor, and an inverse function algorithm G ⁻¹ _abo , and has the following properties.
(1) For any loss branch LbεB _λ

を生成する。但し、ｓは関数のインデックスを、ｚは落とし戸を表す。但し、

Is generated. Here, s represents a function index, and z represents a trapdoor. However,

は、ｙがＡ（ｘ１，ｘ２，…；ｒ）と乱数ｒを用いて生成されることを意味する。よって、式（１）は、セキュリティパラメータλ、損失枝Ｌｂ及び乱数ｒを用いて関数インデックスｓ及び落とし戸ｚを生成することを意味する。
（２）任意の単射枝Ｉｂ∈Ｂ_λに対し（但し、Ｉｂ≠Ｌｂ）、Ｇ_ａｂｏ（ｓ，Ｉｂ，・）は定義域｛０，１｝^ｎ上で、全射関数ｇ_ｓ，Ｉｂ（・）を計算する。Ｇ^−１ _ａｂｏ（ｚ，Ｉｂ，・）は逆関数ｇ^−１ _ｓ，Ｉｂ（・）を計算する。Ｇ_ａｂｏ（ｓ，Ｌｂ，・）は定義域｛０，１｝^ｎ上で、全射関数ｇ_ｓ，Ｌｂ（・）を計算する。但し、その値域の大きさは２^ｒ＝２^ｎ−ｋである。
（３）任意のＬｂ_０、Ｌｂ_１∈Ｂ_λに対し、ｓ_０とｓ_１は多項式時間アルゴリズムでは識別不可能である。但し、（ｓ_０，ｔ_０）←Ｓ_ａｂｏ（１^λ，Ｌｂ_０）かつ、（ｓ_１，ｔ_１）←Ｓ_ａｂｏ（１^λ，Ｌｂ_１）である。

Means that y is generated using A (x1, x2,..., R) and a random number r. Therefore, Expression (1) means that the function index s and the trapdoor z are generated using the security parameter λ, the loss branch Lb, and the random number r.
(2) For any injective branch IbεB _λ (where Ib ≠ Lb), G _abo (s, Ib,...) Is a surjective function g _{s, Ib} on the domain {0,1} ⁿ Calculate (•). G ^-1 _abo (z, Ib, ·) calculates the inverse function g ^-1 _{s, Ib} (·). G _abo (s, Lb, •) calculates a surjective function g _{s, Lb} (•) on the domain {0, 1} ⁿ . However, the size of the value range is 2 ^r = 2 ^nk .
(3) For any Lb ₀ , Lb ₁ ∈B _λ , s ₀ and s ₁ are indistinguishable by the polynomial time algorithm. However, (s ₀ , t ₀ ) ← S _abo (1 ^λ , Lb ₀ ) and (s ₁ , t ₁ ) ← S _abo (1 ^λ , Lb ₁ ).

  Moreover, that the public key cryptosystem (Gen, Enc, Dec) has homomorphism means that the following is satisfied. Here, Gen represents a key generation algorithm, Enc represents an encryption algorithm, and Dec represents a decryption algorithm. Any n and

に対し、群Μ（メッセージ空間であり、群演算子は◎）とＣ（暗号文空間であり、群演算子は▲）において、
（１）任意のｍ∈Μに対し、Ｅｎｃ_ｐｋ（ｍ）∈Ｃである。
（２）任意のｍ１，ｍ２∈Μとｃ１，ｃ２∈Ｃ、かつ、ｍ１＝Ｄｅｃ_ｓｋ（ｃ１）かつｍ２＝Ｄｅｃ_ｓｋ（ｃ２）に対し、次が成立する。
Ｄｅｃｓｋ（ｃ１▲ｃ２）＝ｍ１◎ｍ２
但し、群演算はそれぞれΜとＣで実行される。

On the other hand, in group Μ (message space, group operator is ◎) and C (ciphertext space, group operator is ▲),
(1) For any m∈Μ, Enc _pk (m) ∈C.
(2) For any m1, m2εΜ and c1, c2εC, and m1 = Dec _sk (c1) and m2 = Dec _sk (c2), the following holds:
Decsk (c1 ▲ c2) = m1 ◎ m2
However, the group operation is executed by Μ and C, respectively.

  In the bit commitment method, the present invention realizes the same safety as the conventional bit commitment method, further simplifies the user operation as a non-interactive method, and reduces the calculation amount and communication amount by the multiple bit commitment method. There is an effect of improving efficiency.

The figure which shows the structural example of a bit commitment system. The figure which shows the example of a flow of a bit commitment system. The figure which shows the structural example of the disclosure apparatus 300. FIG. The figure which shows the example of a flow of the disclosure apparatus 300. FIG. 3 is a diagram illustrating a configuration example of a transmission device 100. The figure which shows the example of a flow of the transmitter 100. The figure which shows the example of a flow of the signature production | generation part 130. FIG. The figure which shows the structural example of the receiver 200. The figure which shows the example of a flow of the receiver 200. 2 is a block diagram illustrating a hardware configuration of a transmission device 100. FIG.

  Hereinafter, embodiments of the present invention will be described in detail.

[Bit commitment system 1]
FIG. 1 shows a configuration example of the bit commitment system 1, and FIG. 2 shows a flow example of the bit commitment system 1. The outline of the bit commitment system according to the first embodiment will be described with reference to FIGS. The bit commitment system 1 includes a transmitting device 100 that commits information m of 1 bit or more, a receiving device 200 that verifies the commitment, and a public device 300 that is managed by a trusted third party. In this embodiment, in order to realize ABO-TDF, a DDH (decisional Diffie-Hellman) problem is used.

  First, the transmission device 100 requests the common reference information crs from the disclosure device 300 (s10).

  The disclosure apparatus 300 generates crs in response to the request and transmits the crs to the transmission apparatus 100 (s12).

  The transmission device 100 generates a signature key sk and a verification key vk using a key generation algorithm Gen. (S14). The transmission apparatus 100 generates a signature σ for information generated based on the information m, using the common reference information crs and the signature algorithm Sign. Further, a commitment com including the signature σ and the verification key vk is generated and transmitted to the receiving apparatus 200 (s18).

  The receiving device 200 that has received the commitment requests the public device 300 for the common reference information crs (s20). The disclosure apparatus 300 responds to the request and transmits crs to the reception apparatus (s22). The receiving apparatus 200 verifies the validity of the signature σ using the verification algorithm Vrfy and the verification key vk (s24).

  The transmission device 100 transmits the information m to the reception device 200 (s26).

  Using the information m, the commitment com, and the common reference information crs, the receiving apparatus 200 verifies that the information m has not been tampered with until the information m is received after the commitment com is received (s28).

  Note that this embodiment does not limit the content of the invention. For example, the timing for requesting the common reference information crs may be before the commitment com verification. The timing for verifying the signature may be after the commitment com is received. The transmission device 100 stores Gen and Sign, and the reception device 200 stores Vrfy. However, Gen, Sign, and Vrfy are disclosed to the disclosure device 300, and the transmission device 100 and the reception device 200 are used as necessary. It is good also as a structure which receives. When it is certain that the public key vk is generated by the transmitting device 100, the public key vk is transmitted to the public device 300, the public device 300 discloses the public key vk, and the receiving device 200 Accordingly, the public key vk may be received from the public device 300. When communication between the transmission device 100 and the public device 300 is secure, the public device 300 performs key generation, transmits the signature key sk to the transmission device 100, discloses the public key vk, and the reception device 200 The public key vk may be received from the public device 300 as necessary. A signature generated using the signature key sk generated by the key generation algorithm Gen and the signature algorithm Sign can be verified using the paired verification key vk and the verification algorithm Vrfy. In addition, this electronic signature scheme is assumed to be strongly non-forgery against one or more selected document attacks.

[Public device 300]
FIG. 3 shows a configuration example of the disclosure apparatus 300, and FIG. The public device 300 is managed by a trusted third party or the like, and includes a communication unit 301, a storage unit 303, a control unit 305, a random number generation unit 310, and common reference information 320. The publication apparatus 300 publishes the common reference information crs. Note that “public” means that information (for example, common reference information crs) can be browsed or acquired according to a user's request. When the public device 300 requests the common reference information crs from the transmitting device 100 (s301a), the public device 300 generates a random number (s310), generates common reference information using the random number (s320), and records this in the storage unit. (S303), and transmits to the transmission device (s301c). Furthermore, when the common reference information crs is requested from the receiving device (s301e), the information is called from the storage unit 303 and transmitted to the receiving device 200 (s301g). Details of each part will be described below.

<Communication unit 301>
The disclosure apparatus 300 communicates with the transmission apparatus 100 and the reception apparatus 200 via the communication unit 301. Hereinafter, it is assumed that communication with the transmission device 100 and the reception device 200 is performed via the communication unit 301 even if not specifically described. Similarly, each device (the transmission device 100 and the reception device 200) communicates with other devices via the communication units 101 and 201. Each of the communication units 101, 201, and 301 includes, for example, a LAN adapter or the like, and is connected to a communication line including a LAN or the Internet. However, the communication unit may not necessarily be provided. For example, the common reference information crs or the like may be input from an input device such as a keyboard, or the common reference information crs or the like is stored in a portable medium such as a USB memory. You may enter it.

<Storage unit 303>
The storage unit 303 stores crs and the like (s303). In addition, storing the trapdoor information z _j in secret. Unless otherwise indicated, each input / output data and each data in the calculation process are stored and read out in the storage unit 303 one by one, and each calculation process proceeds. However, it is not necessarily stored in the storage unit 303, and data may be directly transferred between the units. The same applies to the storage units 103 and 203 in each device (the transmission device 100 and the reception device 200).

<Control unit 305>
The control unit 305 controls each process. Similarly, in each device (transmission device 100 and reception device 200), each control unit 105 and 205 controls each process.

<Random number generator 310>
The random number generator 310 generates random numbers r = (r1,..., Rn) (s310). Where p is a prime number, G is a cyclic group of order p, g is a generator of G, each ri is a random number, and i∈ [n], [n] = {1, 2,..., N}, Let rεZ _p . Note that Z _p = {0,..., P−1}. The random number generation unit 310 outputs the random number r to the common reference information generation unit 320. However, the random number generator 310 may not necessarily be provided. For example, the random number r may be input from an input device such as a keyboard, or the random number r is stored in a portable medium such as a USB memory, You may enter. The same applies to the random number generation unit 110 of the transmission device 100 described later. In this embodiment, p, G, and g are shared in advance by each device. However, a configuration may be adopted in which the public device 300 discloses the public parameter and the other device receives the public parameter.

<Common Reference Information Generation Unit 320>
The common reference information generation unit 320 generates common reference information crs including the function index s of ABO-TDF (s320). For example, h () is a pair-independent hash function, t _j = g ^ z _j, and crs is (s, h (), t _j ). However, a ^ b means a ^b, and let the trap door information be z _j εZ _p . Note that jε [n]. The pair-independent hash function is x ≠ x ′, y ≠ y ′, the domain is D, the range is R, and h is random for all different x, x′∈D and all y, y′∈R. Is a function that satisfies the following formula.
Pr [h (x) = y ^ h (x ') = y'] = 1 / | R | ²
The generated common reference information crs is output to the storage unit 303, and the storage unit 303 stores it.

The function index s is represented as the following matrix as the loss branch Lb.
s = (c _{i, j} )

なお、ｃ_ｉ，ｊ＝Ｅｎｃ_ｔｊ（Ｌｂ；ｒｉ）
とする。なお、Ｅｎｃ_ｔｊにおけるｔｊはｔ_ｊを意味する。ここで、Ｅｎｃは以下の処理を行う。
Ｅｎｃ_ｔ（ａ，ｒ）＝（ｇ^ｒ，ｔ^ｒｇ^ａ）
よって、
ｃ_ｉ，ｊ＝（ｇ^ｒｉ，ｔ_ｊ ^ｒｉｇ^Ｌｂ）
である。本実施例では、説明を簡単にするため、Ｌｂ＝０として計算する。よって、
ｃ_ｉ，ｊ＝（ｇ^ｒｉ，ｔ_ｊ ^ｒｉ）
となる。つまり、式（１）より、共通参照情報生成部は、損失枝を０とし、セキュリティパラメータをλとして、乱数ｒを用いて、関数インデックスｓ及び落とし戸ｚ_ｊを生成する。

C _{i, j} = Enc _tj (Lb; ri)
And It should be noted, tj in _{Enc tj} means _{t j.} Here, Enc performs the following processing.
^{_{Enc t (a, r) =}} (g r, t r g a)
Therefore,
c _{i, j} = (g ^ri , t _j ^rig g ^Lb )
It is. In the present embodiment, in order to simplify the description, the calculation is performed with Lb = 0. Therefore,
c _{i, j} = (g ^ri , t _j ^ri )
It becomes. That is, from the equation (1), the common reference information generation unit generates the function index s and the trapdoor z _j using the random number r with the loss branch as 0, the security parameter as λ.

なお、Ｌｂ≠０であっても同様に計算することができる。但し、通常、検証鍵ｖｋ≠０であることを考慮し、Ｌｂ≠ｖｋとするため、Ｌｂ＝０としてもよい。なお、情報ｍが入力される毎に異なる共通参照情報ｃｒｓが生成されることになる。但し、安全性が低くなるが、同一の共通参照情報を用いてもよい。

Even if Lb ≠ 0, the same calculation can be performed. However, since Lb ≠ vk in consideration of the fact that the verification key vk ≠ 0 is normally set, Lb = 0 may be set. Different common reference information crs is generated every time information m is input. However, although the safety is lowered, the same common reference information may be used.

[Transmitter 100]
FIG. 5 shows a configuration example of the transmission apparatus 100, and FIG. 6 shows a flow example of the transmission apparatus. The transmission device 100 (which may be called the bit commitment transmission device 100) includes a communication unit 101, a storage unit 103, a control unit 105, a random number generation unit 110, a key generation unit 120, a signature generation unit 130, a commitment generation unit 150, and unsealing information. And a generation unit 160.

When the information m of 1 bit or more is input from the input unit such as a keyboard or the like under the control of the control unit 105 (s100), the transmission device 100 transmits the information m via the communication unit 101 in order to commit the information m. The public device 300 is requested for the common reference information crs, and the common reference information crs is received from the public device 300 (s101a). However, mεZ _p . Further, the transmission device 100 generates commitment and opening information M, and transmits the commitment com to the reception device 200 (s101c). If the unsealing information M can be transmitted (s165), the unsealing information M is transmitted to the receiving device 200 (s101e). The case where the unsealing information M can be transmitted is, for example, a case where a predetermined time has elapsed. A non-interactive bit commitment system can be realized without requiring a response from the receiving device 200.

  The storage unit 103 stores the common reference information crs received from the public device, and stores the information m to be transmitted, the generated signature key sk, the verification key vk, the random number ra, rb, the signature σ, the commitment com, the unsealing information M, and the like. You may remember.

<Random number generator 110>
The random number generation unit 110 generates random numbers ra and rb (s110). However, the random numbers ra and rbεZ _p .

<Key generation unit 120>
The key generation unit 120 generates the signature key sk and the verification key vk using the key generation algorithm Gen (s120). For example, the random number generation unit 110 generates a random number r3, receives the security parameter and the random number r3, and generates a signature key sk and a verification key vk using a key generation algorithm. Since a different random number is selected every time the key generation algorithm is executed, a different public / private key pair is assigned each time the information m is input. However, although the security is lowered, the same public key / private key pair may be used.

<Signature generation unit 130>
The signature generation unit 130 receives the random numbers ra and rb from the random number generation unit 110, the signature key sk and the verification key vk from the key generation unit 120, the common reference information crs from the public device 100, and the information m from the input unit. The However, information stored in the storage unit 103 may be input once. The signature generation unit 130 generates information c1 and c2 from these pieces of information, and further generates a signature σ from c1 and c2. The generated c1, c2, and σ are output to the commitment generation unit 150.

FIG. 7 is a diagram illustrating a flow example of the signature generation unit 130. First, c0 is obtained from the function index s, the verification key vk, and the random number ra included in the common reference information crs using the trapdoor-equipped one-way function ABO-TDF (s131). Using the one-way function with a trapdoor ABO-TDF means that c0 is obtained by the one-way function algorithm _Gabo .
c0 = G _abo (s, vk, ra)
For example, G _abo is realized by the following equation.
c0 = y = ra (s * vk · I)
_{However, ra = (ra 1, ra} 2, ..., ra n), ra j ∈ {0,1}, y = y 1, ..., a _{y n,} I is the identity matrix, i.e., only the diagonal elements 1 And the rest are all zero matrices. Also, operators ★ is encryption algorithm Enc _{is, c = (c1, c2)} = Enc t (m; r) = (g r, t r g m) of the case (g is origin, t = g ^ z _j , z _j is the trapdoor information),
c ★ v = (c1, c2 ・ g ^v ) = Enc _t (m; r) Enc _t (v; 0) = Enc _t (m + v; r)
Is defined. The operator ■ represents multiplication for each component. ^{_{Further, Enc t (m; r)}} = (g r, t r g m) _{than, Enc t (m1; r1)} ■ Enc t (m2; r2) = (g r1, t r1 g m1) · (g r2 ^{, t r2 g m2) = (} g r1 + r2, t r1 + r2 g m1 + m2) = Enc t (m1 + m2; r1 + r2) , and the time of ^{_{x∈Z p Enc t (m; r}} ) x = (g rx, t rx g mx) = Enc _t (mx; rx).

Each element y _j of y can also be defined as follows.
y _j = ■ _{i∈ [n]} (c _{i, j} ★ vk ・ δ _{i, j} ) ^ ra _i = Enc _hj (vk ・ ra _j : <ra, r>)
However, y _j = ■ _{i∈ [n]} (c _{i, j} ★ vk · δ _{i, j} ) ^ ra _i is
y _j = (c _{1, j} ★ vk · δ _{1, j} ) ^ ra ₁ ■ (c _{2, j} ★ vk · δ _{2, j} ) ^ ra ₂ ■… ■ (c _{n, j} ★ vk · δ _{n, j} ) ^ ra _n
, If i = j, δ _{i, j} = 1, if i ≠ j, δ _{i, j} = 0, and _hj in Ench _j means h _j .

Next, c0 is generated by randomizing c0 using the random number rb and utilizing the homomorphism of the function index s (s133). For example, randomization is performed by the following equation.
c1 = y ′ = ra (s * vk · I) ☆ rb
However, the operator ☆
c ☆ rb = (c1 ・ g ^rb , c2 ・ t ^rb ) = Enc _t (m; r) Enc _t (0; rb) = Enc _t (m; r + rb)
Is defined. (Dec _sk (c * rb) = m.)
Therefore,
y ′ _j = Enc _hj ((vk−0) ra _j ; <ra, r> + rb _j ) (2)
To generate c1 = y ′ = (y ′ ₁ ,..., Y ′ _n ).

  For example, c2 is obtained as follows. A hash value h (ra) is obtained from the random number ra using the hash function h () (s135). An exclusive OR of the hash value h (ra) and the information m is obtained as c2 (s137).

このような方法によると少ない演算量でｃ２を求めることができる。但し、ｃ２の生成方法は、この方法に限るものではなく、ｃ２に情報ｍ及び乱数ｒａを含むが、ｃ２を見ただけでは、情報ｍ及び乱数ｒａを知ることはできない方法であれば、他の方法を用いてもよい。

According to such a method, c2 can be obtained with a small amount of calculation. However, the generation method of c2 is not limited to this method, and the information m and the random number ra are included in c2. However, any other method can be used as long as the information m and the random number ra cannot be known only by looking at c2. The method may be used.

A signature σ is generated from the c1 and c2 using the signature key sk and the signature algorithm Sign (s137).
σ = Sign _sk (c1, c2)
Either c1 or c2 may be generated first or may be processed in parallel.

<Commitment generator 150>
The commitment generation unit 150 generates a commitment com including c1, c2, σ, and vk (s150). The signature generation unit 130 receives c1, c2, and σ, and the key generation unit 120 receives vk, and outputs com.
com = (c1, c2, vk, σ)

<Opening information generation unit 160>
The unsealing information generation unit 160 generates unsealing information M including information m, random numbers ra and rb (s160). Information m is input from an input unit or the like, random numbers ra and rb are input from a random number generation unit 110, and unsealing information M is output.
M = (m, ra, rb)
It should be noted that the order of opening information M generation and key generation may be processed first or in parallel.
[Receiver 200]
FIG. 8 shows a configuration example of the receiving apparatus 200, and FIG. The receiving device 200 (which may be called the bit commitment receiving device 200) includes a communication unit 201, a storage unit 203, a control unit 205, a signature verification unit 230, and a commitment verification unit 250.

  The receiving apparatus 200 receives a commitment com from the transmitting apparatus 100 via the communication unit 201 under the control of the control unit 205 (s201a). The receiving apparatus 200 stores the commitment com in the storage unit 203 (s203). Then, the signature σ included in the commitment com is verified (s230). In order to verify the commitment com, the public device 300 is requested for the common reference information crs, and the common reference information crs is received from the public device 300 (s201c). Further, the receiving apparatus 200 receives the unsealing information M (s201e), and verifies the commitment com (s250).

<Signature Verification Unit 230>
The signature verification unit 230 verifies the validity of the signature σ using the verification key vk and the verification algorithm Vrfy included in the commitment com (s230). The signature verification unit 230 receives the commitment and outputs a verification result.
Vrfy _vk (σ, c1, c2)
If the signature does not pass verification, for example, an error is output (s231). The configuration may be such that the commitment com is requested to the transmission device 100 again.

<Commitment verification unit 250>
The commitment verification unit 250 verifies the commitment com using the common reference information crs and the opening information M (s250). The common reference information crs and the unsealing information M are input, and the verification result of the commitment com is output. If the commitment does not pass verification, for example, an error is output (s251). The commitment verification unit 250 can verify the commitment when the signature σ passes verification, receives the common reference information crs from the disclosure apparatus 300, and receives the opening information M.

From the function index s included in the common reference information crs, vk included in the commitment com, and ra and rb included in the opening information M,
ra (s ★ vk · I) ☆ rb
And verifies whether the obtained value is the same as c1 included in the commitment com.

  Further, from the hash function h () included in the common reference information crs and c2 included in the commitment com

を計算し、得られる値が開封情報Ｍに含まれる情報ｍと同一であるか検証する。何れか一方の検証を通過しなかった場合には、エラーを出力する。

And verify whether the obtained value is the same as the information m included in the opening information M. If either verification is not passed, an error is output.

  With such a configuration, it is possible to provide a non-interactive and multi-bit commitment bit commitment system. Also, if the digital signature method is strongly existent forgery against selected document attacks and the decisional Diffie-Hellman assumption is true, it is safe to be universally combined.

<Hardware configuration>
FIG. 10 is a block diagram illustrating a hardware configuration of the transmission device 100 according to the present embodiment. The receiving device 200 and the disclosure device 300 have the same configuration.

  As illustrated in FIG. 10, the transmission device 100, the reception device 200, and the disclosure device 300 in this example include a CPU (Central Processing Unit) 11, an input unit 12, an output unit 13, an auxiliary storage device 14, and a ROM (Read Only). Memory (Random Access Memory) 16, RAM (Random Access Memory) 16, and bus 17.

  The CPU 11 in this example includes a control unit 11a, a calculation unit 11b, and a register 11c, and executes various calculation processes according to various programs read into the register 11c. The input unit 12 is an input interface for inputting data, a keyboard, a mouse, and the like, and the output unit 13 is an output interface for outputting data. The auxiliary storage device 14 is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, or the like, and a program area 14a in which programs for causing the computer to function as the transmission device 100, the reception device 200, and the disclosure device 300 are stored. And a data area 14b for storing various data. The RAM 16 is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), or the like, and has a program area 16a in which the above program is stored and a data area 16b in which various data are stored. The bus 17 connects the CPU 11, the input unit 12, the output unit 13, the auxiliary storage device 14, the ROM 15, and the RAM 16 in a communicable manner.

  In addition, as a specific example of such hardware, a server apparatus, a workstation, etc. other than a personal computer can be illustrated, for example.

<Program structure>
As described above, each program for executing each process of the transmission device 100, the reception device 200, and the disclosure device 300 of the present embodiment is stored in the program areas 14a and 16a. Each program constituting the transmission program, the reception program, and the public program may be described as a single program sequence, or at least some of the programs may be stored in the library as separate modules. In addition, each program may realize each function alone, or each program may read each other library to realize each function.

<Cooperation between hardware and program>
The CPU 11 (FIG. 10) writes the above-described program stored in the program area 14 a of the auxiliary storage device 14 in the program area 16 a of the RAM 16 in accordance with the read OS (Operating System) program. Similarly, the CPU 11 writes various data stored in the data area 14 b of the auxiliary storage device 14 in the data area 16 b of the RAM 16. The address on the RAM 16 where the program and data are written is stored in the register 11c of the CPU 11. The control unit 11a of the CPU 11 sequentially reads these addresses stored in the register 11c, reads a program and data from the area on the RAM 16 indicated by the read address, causes the calculation unit 11b to sequentially execute the operation indicated by the program, The calculation result is stored in the register 11c.

  3, 5, and 8 are block diagrams exemplifying functional configurations of the disclosure apparatus 300, the transmission apparatus 100, and the reception apparatus 200 configured by reading and executing the above-described program in the CPU 11 as described above.

  Here, the storage units 103, 203, and 303 correspond to any one of the auxiliary storage device 14, the RAM 16, the register 11 c, other buffer memory and cache memory, or a storage area that uses these in combination. Further, the communication unit 101, the storage unit 103, the control unit 105, the random number generation unit 110, the key generation unit 120, the signature generation unit 130, the commitment generation unit 150, the unsealing information generation unit 160, and the CPU 11 It is configured by executing a transmission program. The communication unit 201, the storage unit 203, the control unit 205, the signature verification unit 230, and the commitment verification unit 250 are configured by causing the CPU 11 to execute a reception program. The communication unit 301, the storage unit 303, the control unit 305, the random number generation unit 310, and the common information generation unit 320 are configured by causing the CPU 11 to execute a public program.

  In addition, the transmission device 100, the reception device 200, and the disclosure device 300 according to the present embodiment execute each process under the control of the control units 105, 205, and 305.

  The bit commitment system according to the second embodiment will be described with respect to parts different from the first embodiment.

[Bit commitment system 1000]
The bit commitment system 1000 includes a transmitting device 1100 that commits information m of 1 bit or more, a receiving device 1200 that verifies the commitment, and a public device 1300 that is managed by a trusted third party. In this embodiment, in order to realize ABO-TDF, a DCR (decisional composite residuosity) problem is used.

[Public device 1300]
The public device 1300 is managed by a trusted third party or the like, and includes a communication unit 301, a storage unit 303, a control unit 305, a random number generation unit 1310, and common reference information 1320.

<Random number generator 1310>
The random number generation unit 1310 generates a random number rεZ ^* _N and outputs it to the common reference information generation unit 1320. N will be described later.

<Common Reference Information Generation Unit 1320>
The common reference information generation unit 1320 generates common reference information crs including the function index s of ABO-TDF. For example, odd prime numbers p and q satisfying RSA modulus N = pq and gcd (N, φ (N)) = 1 are selected, and N is generated. A function index s = (1 + N) ^−Lb r ^ N ^f is generated by using f as an integer of 1 or more, a loss branch of ABO-TDF as Lb, and a random number rεZ ^* _N. For the same reason as that in Example 1, when Lb = 0, the s = r ^ ^{N f.} Moreover, the trap door information τ = 1 cm (p−1, q−1) is generated using p and q. Further, common reference information crs including function indexes s, N, and f is generated. For such N, the multiplicative group Z ^* _{N ^ f + 1} is a direct product G × H. However, G is a cyclic group of order ^{N f,} H is ^Z _{* N} and isomorphic. Note that m∈Z ^* _{N ^ f} . The odd prime numbers p and q are managed secretly.

[Transmitter 1100]
The transmission apparatus 1100 includes a communication unit 101, a storage unit 103, a control unit 105, a random number generation unit 1110, a key generation unit 120, a signature generation unit 1130, a commitment generation unit 150, and an unsealing information generation unit 160.

<Random number generator 110>
The random number generator 1110 generates random numbers ra and rb. However, rbεZ ^* _N.

<Signature generation unit 1130>
First, c0 is obtained from the function index s, the verification key vk, and the random number ra included in the common reference information crs by using the trapdoor-equipped one-way function ABO-TDF. Using the one-way function with a trapdoor ABO-TDF means that c0 is obtained by the one-way function algorithm _Gabo .
c0 = G _abo (s, vk, ra)
For example, G _abo is realized by the following equation.
c0 = y = (s ◆ vk) ^ra
Here, the operator ◆ indicates that the encryption algorithm Enc is
c = Enc _N (m; r) = (1 + N) ^m r ^ N ^f mod N ^{f + 1}
When
c ◆ v = c ・ (1 + N) ^v = Enc _N (m; r) ・ Enc _N (v; 1) = Enc _N (m + v, r)
Is defined. Therefore,
y = (s ◆ vk) ^ra = Enc _N (vk · ra; r)
It is expressed. From Enc _N (m; r) = (1 + N) ^m r ^ N ^f mod N ^{f + 1} , Enc _N (m1; r1) · Enc _N (m2; r2) = Enc _N (m1 + m2; r1 · r2) Enc _N (m; r) ^x = Enc _N (mx; r ^x ).

Next, c0 is generated by randomizing c0 using the homomorphism of the function index s using the random number rb. For example, randomization is performed by the following equation.
c1 = y ′ = (s ◆ vk) ^ra ◇ rb
However, the operator ◇
c ◇ rb = c ・ rb ^ N ^f = Enc _N (m; r) ・ Enc _N (0; rb) = Enc _N (m; r ・ rb)
Is defined.
Therefore, c1 = Enc _N ((vk-0) ra; r ^ra · rb) is generated.
The generation method of c2 and signature σ is the same as that of the signature generation unit 130 of the first embodiment.

[Receiving device 1200]
The receiving apparatus 1200 includes a communication unit 201, a storage unit 203, a control unit 205, a signature verification unit 230, and a commitment verification unit 1250.

<Commitment verification unit 1250>
The commitment verification unit 1250 verifies the commitment com using the common reference information crs and the opening information M. The common reference information crs and the unsealing information M are input, and the verification result of the commitment com is output. For example, if the commitment does not pass verification, an error is output. The commitment verification unit 250 can verify the commitment when the signature σ passes verification, receives the common reference information crs from the disclosure apparatus 300, and receives the opening information M.

From the function index s included in the common reference information crs, vk included in the commitment com, and ra and rb included in the opening information M,
(S ◆ vk) ^ra ◇ rb
And verifies whether the obtained value is the same as c1 included in the commitment com.

  Further, from the hash function h () included in the common reference information crs and c2 included in the commitment com

を計算し、得られる値が開封情報Ｍに含まれる情報ｍと同一であるか検証する。何れか一方の検証を通過しなかった場合には、エラーを出力する。

And verify whether the obtained value is the same as the information m included in the opening information M. If either verification is not passed, an error is output.

  By adopting such a configuration, it is possible to provide a non-interactive and multi-bit commitment bit commitment system as in the first embodiment. In addition, if the electronic signature method is strongly existent forgery against selected document attacks and the decision of decisional composite residuosity is true, it is safe to combine universally.

1 bit commitment system 100 transmitting device 200 receiving device 300 public device 101, 201, 301 communication unit 103, 203, 303 storage unit 105, 205, 305 control unit 110, 310 random number generation unit 120 key generation unit 130 signature generation unit 150 commitment Generation unit 160 Unsealing information generation unit 230 Signature verification unit 250 Commitment verification unit 320 Common reference information generation unit

Claims (13)

A bit commitment system comprising a transmitting device that commits information m of 1 bit or more, a receiving device that verifies a commitment, and a public device managed by a trusted third party,
The public device is:
Generating and publishing common reference information crs including a function index s of an All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”);
The transmitter is
Using the verification key vk as a loss branch, c0 is obtained from the function index s and the random number ra using ABO-TDF, the c0 is randomized using the random number rb, c1 is generated, and the random number ra is generated. And c2 from the information m, and a signature generation unit that generates a signature σ using the signature key sk from the c1 and c2.
A commitment generation unit for generating a commitment com including the c1, c2, and σ;
An unsealing information generating unit for generating unsealing information M including the information m and random numbers ra and rb;
The receiving device is:
A signature verification unit that verifies the signature σ using the verification key vk;
A commitment verification unit that verifies the commitment com using the common reference information crs and the opening information M;
Bit commitment system characterized by that. The bit commitment system according to claim 1,
p is a prime number, G is a cyclic group of order p, g is a generator of G, i, jε [n], [n] = {1, 2,..., n}, r = (r1,. ..., rn), r∈Z _p is a random _{number, ra∈Z p, ra = (ra} 1, ..., ra n), ra j ∈ {0,1}, rb = (rb 1, ..., rb n), rbεZ _p is a random number, I is a unit matrix,
The public device is:
t _j = g ^ z _j , Lb is a loss branch, c _{i, j} = (g ^ri , t _j ^ri g ^Lb ), a function index s is generated as a matrix (c _{i, j} ), and ABO− TDF trapdoor information z _j ∈Z _p is generated, and common reference information crs including function index s and t of ABO-TDF is generated and disclosed,
The signature generation unit of the transmission device
When c = (c1, c2) = (g ^r , ^tr g ^m ), the operator ★ is defined as c ★ v = (c1, c2 · g ^v ), and the operator ☆ is defined as c ☆ rb = (C1 · g ^rb , c2 · t ^rb )
Generate c0 = ra (s * vk · I),
Randomize c0 using the random number rb, and generate c1 = ra (s * vk · I) * rb,
The commitment verification unit of the receiving device,
calculating ra (s * vk · I) * rb and verifying whether the obtained value is the same as the value of c1;
A bit commitment system characterized by The bit commitment system according to claim 1,
The public device is:
Select odd primes p and q satisfying N = pq, gcd (N, φ (N)) = 1, select an integer f of 1 or more, generate a random number r∈Z ^* _N, and lose ABO-TDF Let Lb be a branch, ^generate function index s = (1 + N) ^−Lb r ^ N ^f and trapdoor information τ = 1cm (p−1, q−1), and common reference information including function indexes s, N, and f create and publish crs
The signature generation unit of the transmission device
When c = (1 + N) ^m r ^ N ^f , the operator ◆ is defined as c ◆ v = c · (1 + N) ^v , the operator ◇ is defined as c ◇ rb = c · rb ^ N ^f , Generate as c0 = (s ◆ vk) ^ra , randomize c0 using the random number rbεZ ^* _N , and c1 = (s ◆ vk) ^ra ◇ rb
Produces as
The signature verification unit of the receiving device
(S ◆ vk) ^ra ◇ Calculate rb and verify whether the obtained value is the same as the value of c1;
A bit commitment system characterized by Using the ABO-TDF from the function index s of the ABO-TDF and the random number ra as the loss branch of the All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”), Obtain c0, randomize c0 using random number rb, generate c1, obtain c2 from random number ra and information m of 1 bit or more, and use signature key sk from c1 and c2 A signature generation unit for generating a signature σ;
A commitment generation unit for generating a commitment com including the c1, c2, and σ;
An unsealing information generating unit for generating unsealing information M including the information m and random numbers ra and rb;
A bit commitment transmitting device. The bit commitment transmission device according to claim 4,
p is a prime number, G is a cyclic group of order p, g is a generator of G, i, jε [n], [n] = {1, 2,..., n}, r = (r1,. ..., rn), r∈Z _p is a random _{number, ra∈Z p, ra = (ra} 1, ..., ra n), ra j ∈ {0,1}, rb = (rb 1, ..., rb n), rbεZ _p is a random number, I is a unit matrix,
When c = (c1, c2) = (g ^r , ^tr g ^m ), the signature generation unit defines the operator ★ as c ★ v = (c1, c2 · g ^v ), and the operator ☆ , C ☆ rb = (c1 · g ^rb , c2 · t ^rb ) and generate c0 = ra (s * vk · I), and use the random number rb to randomize the c0 Generating as c1 = ra (s * vk · I) * rb,
A bit commitment transmitter characterized by. The bit commitment transmission device according to claim 4,
p and q are odd prime numbers, N = pq, gcd (N, φ (N)) = 1, random number rεZ ^* _N ,
The signature generation unit
When c = (1 + N) ^m r ^ N ^f , the operator ◆ is defined as c ◆ v = c · (1 + N) ^v , the operator ◇ is defined as c ◇ rb = c · rb ^ N ^f , Generating c0 = (s ◆ vk) ^ra , randomizing c0 using the random number rbεZ ^* _N, and generating c1 = (s ◆ vk) ^ra ◇ rb;
A bit commitment transmitter characterized by. Using the verification key vk as a loss branch, the function index s of the All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”) and a random number ra are used to obtain c0 using ABO-TDF, The random number rb is used to randomize the c0, generate c1, obtain the c2 from the random number ra and the information m, and use the signature key sk from the c1 and c2 to generate the generated signature σ. A signature verification unit to verify using the verification key vk;
A commitment verification unit that verifies the commitment com using the common reference information crs including the function index s of ABO-TDF and the unsealing information M including the random numbers ra and rb.
A bit commitment receiver characterized by that. The bit commitment receiving device according to claim 7,
p is a prime, G is a cyclic group of order p, G is a generator of G, i, jε [n], [n] = {1, 2,..., n}, r = (r1,. , Rn), r∈Z _p is a random number, ra∈Z _p , ra = (ra ₁ ,..., Ra _n ), ra _j ∈ {0, 1}, rb = (rb ₁ ,..., Rb _n ), rb ΕZ _p is a random number, I is a unit matrix, t _j = g ^ z _j , Lb is a loss branch, c _{i, j} = (g ^ri , t _j ^ri g ^Lb ), and a function index s is a matrix (c _{i, j} ), And when c = (c1, c2) = (g ^r , ^tr g ^m ), the operator ★ is defined as c ★ v = (c1, c2 · g ^v ), and the operator ☆ is defined as c ☆ rb = (c1 · g ^rb , c2 · t ^rb ), and c1 = ra (s * vk · I) ☆ rb
The commitment verification unit
calculating ra (s * vk · I) * rb and verifying whether the obtained value is the same as the value of c1;
A bit commitment receiver characterized by. The bit commitment receiving device according to claim 7,
p and q are odd prime numbers, N = pq, gcd (N, φ (N)) = 1, and when c = (1 + N) ^m r ^ N ^f , the operator ◆ is c ◆ v = c · (1 + N ) Define ^v and define operator ◇ as c ◇ rb = c · rb ^ N ^f , rb∈Z ^* _N , and c1 = (s ◆ vk) ^ra ◇ rb
The signature verification unit of the receiving device
(S ◆ vk) ^ra ◇ Calculate rb and verify whether the obtained value is the same as the value of c1;
A bit commitment receiver characterized by. A bit commitment method using a transmitting device that commits information m of 1 bit or more, a receiving device that verifies commitment, and a public device managed by a trusted third party,
The public device generates and publishes common reference information crs including a function index s of an All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”);
The transmitting apparatus obtains c0 from the function index s and the random number ra using the verification key vk as a loss branch, using ABO-TDF, randomizes the c0 using the random number rb, and generates c1 A signature generation step of obtaining c2 from the random number ra and the information m, and generating a signature σ from the c1 and c2 using a signature key sk;
A commitment generating step in which the transmitting device generates a commitment com including the c1, c2 and σ;
A signature verification step in which the receiving device verifies the signature σ using the verification key vk;
The transmission device generates unsealing information M including the unsealing information M including the information m, random numbers ra and rb;
The reception device includes a commitment verification step of verifying a commitment com using the common reference information crs and the opening information M.
A bit commitment method characterized by that. Using the ABO-TDF from the function index s of the ABO-TDF and the random number ra as the loss branch of the All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”), obtaining c0;
Randomizing c0 using random number rb to generate c1;
Obtaining c2 from the random number ra and information m of 1 bit or more;
A signature generation step of generating a signature σ from the c1 and c2 using a signature key sk;
A commitment generation step of generating a commitment com including the c1, c2 and σ;
An unsealing information generating step for generating unsealing information M including the information m and random numbers ra and rb;
Bit commitment transmission method having. Using the verification key vk as a loss branch, the function index s of the All-But-One trapdoor unidirectional function (hereinafter referred to as “ABO-TDF”) and a random number ra are used to obtain c0 using ABO-TDF, The random number rb is used to randomize the c0, generate c1, obtain the c2 from the random number ra and the information m, and use the signature key sk from the c1 and c2 to generate the generated signature σ. A signature verification step for verifying using the verification key vk;
A commitment verification step of verifying the commitment com using the common reference information crs including the function index s of ABO-TDF and the unsealing information M including the random numbers ra and rb.
A bit commitment receiving method characterized by the above.   A bit commitment program for causing a computer to function as the bit commitment transmitting device or the bit commitment receiving device according to claim 4.

Images