JP5931797B2 - Signature system and method, signature generation apparatus, and signature verification apparatus - Google Patents

Description

  The present invention relates to information security technology. In particular, it relates specifically to electronic signature technology.

  Conventional public key security did not assume that private key information would be partially leaked, but in recent years, due to the development of side-channel attacks, the security in the event of a private key leak is considered. It is thought that it is necessary to do (for example, refer nonpatent literature 1).

  Even if a secret key is leaked, a signature scheme that is secure is first constructed by Katz, Vaikuntanathan et al. (See Non-Patent Document 2, for example).

  Also, Dodis, Haralambiev, Lopez-Alt, Wichs et al. Proposed a method that has key leakage resistance and can update a secret key (see, for example, Non-Patent Document 3).

  In addition, Malkin, Teranishi, Vahlis, Yung and others proposed a method that is secure even if a random number at the time of signature generation leaks in addition to the secret key leakage resistance (see Non-Patent Document 4, for example).

  Also, Boyle, Segev, Wichs et al. Proposed a method that is secure even if a random number at the time of signature generation leaks in addition to the secret key leakage resistance in the same manner as Malkin et al.

  Furthermore, Lewko, Rouselakis, Waters et al. Constructed an ID-based cipher with master secret key leakage resistance, so that a signature with secret key leakage resistance can be obtained from the scheme (see, for example, Non-Patent Document 6).

JAHalderman, SDSchoen, N. Heninger, W. Clarkson, W. Paul, JACalan-drino, AJFeldman, J. Appelbaum, and EWFelten. “Lest we remember: cold-boot attacks on encryption keys”, Commun. ACM, 52 (5), 2009. J.Katz and V.Vaikuntanathan, “Signature Schemes with Bounded Leakage Resilience”, In ASIACRYPT, volume 5912 of Lecture Notes in Computer Science, pages 703-720. Springer, 2009. Y.Dodis, K.Haralambiev, A.Lopez-Alt, and D.Wichs, “Efficient Public-Key Cryptogra-phy in the Presence of Key Leakage”, In ASIACRYPT, volume 6477 of Lecture Notes in Computer Science, pages 613- 631.Springer, 2010. T.Malkin, I.Teranishi, Y.Vahlis, and M.Yung. “Signatures Resilient to Continual Leakage on Memory and Computation”, In TCC, volume 6597 of Lecture Notes in Computer Science, pages 89-106. Springer, 2011. E. Boyle, G. Segev, and D. Wichs, “Fully Leakage-Resilient Signatures”, In EUROCRYPT, volume 6632 of Lecture Notes in Computer Science, pages 89-108, Springer, 2011. A.B.Lewko, Y.Rouselakis, and B.Waters, “Achieving Leakage Resilience through Dual System Encryption”, In TCC, volume 6597 of Lecture Notes in Computer Science, pages 70-88. Springer, 2011.

  However, all the proposed signature schemes with secret key leakage resistance have been configured using either non-interaction zero knowledge proof or ID-based cryptography with master secret key leakage resistance. It was bad.

  FIG. 3 shows whether the signature method described in each of Non-Patent Documents 2 to 6 uses non-zero knowledge proof or ID-based encryption. FIG. 3 also shows whether the signature schemes described in each of Non-Patent Documents 2 to 6 perform key update or have random number leakage resistance.

  It is an object of the present invention to provide a signature system and method, a signature generation device, and a signature verification device that are more efficient than those of the prior art.

In the signature system according to an aspect of the present invention, p ₁ , p ₂ , and p ₃ are prime numbers, the group of order N = p ₁ p ₂ p ₃ is G, G _T, and e: G × G → G _T As a bilinear map, random numbers g∈G _p1 , g ₂ ∈G _p2 , g ₃ , R ₃ ¹ ,…, R ₃ ^{n + 4} ∈G _p3 and random numbers x, y, x _e , y _e , r ^, , z ₁ , ..., z _n , w ₁ , ..., w _n ∈Z _N and K _z ¹ = g ^z1 R ₃ ¹ , ..., K _z ⁿ = g ^zn R ₃ ⁿ , K _r = g ^{r ^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ xeye} R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi , secret key SK = (K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy ) and a secret key generator, and a public key VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 , ..., g ^wn ), a key generation device including a second random number generation unit for generating random numbers r ~, z ₁ ′, ..., z _n ′ ∈Z _N , and a signature Let m be the target message, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ),…, σ _n = (K _z ⁿ ) ^{r ~} (g ^{r ~ zn ′} ), σ _{n + 1 ^{= (K r) r ~,}} σ n + 2 = (K y) r ~, _{n + 3 = (K x)} r ~ (K xy) r ~ m (Π i = 1 n (g wi) r ~ mzi) as, = a signature for the message m by using the secret key SK sigma (sigma _1, .., Σ _{n + 3} ), a signature generation device including the signature generation unit, m ≠ 0, and two expressions e (Y, σ _{n + 1} ) = e (g, σ _{n + 2} ), e Determine whether (X, σ _{n + 1} ) e (X, σ _{n + 2} ) ^m Π _{i = 1} ⁿ e (g ^wi , σ _i ) ^m = e (g, σ _{n + 3} ) holds, a signature verification device including a determination unit that accepts the signature σ when m ≠ 0 and two expressions are satisfied.

  A signature scheme having a secret key leakage resistance can be realized more efficiently than before.

The block diagram for demonstrating the example of a signature system. The flowchart for demonstrating the example of the signature method. The figure for demonstrating background art.

  Hereinafter, embodiments of a signature system and method, a signature generation device, and a signature verification device will be described with reference to the drawings.

  As shown in FIG. 1, the signature system includes, for example, a key generation device 1, a signature generation device 2, and a signature verification device 3. In the example of FIG. 1, the key generation device 1 is provided in the signature generation device 2.

<Step S1, FIG. 2>
The first random number generation unit 11 of the key generation device 1 includes random numbers gεG _p1 , g ₂ εG _p2 , g ₃ , R ₃ ¹ ,..., R ₃ ^{n + 4} εG _p3 and random numbers x, y, x _e , y _e , r ^, r ^ ′, z ₁ ,..., z _n , w ₁ ,..., w _n ∈Z _N are generated (step S1). Here, p ₁ , p ₂ , and p ₃ are predetermined prime numbers, and G and G _T are groups of order N = p ₁ p ₂ p ₃ . G _p1 , G _p2 , and G _p3 are groups of orders p ₁ , p ₂ , and p ₃ , respectively. Z _N is a residue class group related to N.

However, when λ ₁ = logp ₁ , λ ₂ = logp ₂ , and λ ₃ = logp ₃ , logN = λ ₁ + λ ₂ + λ ₃ is assumed. Here, λ ₂ = λ, λ ₁ = c ₁ λ, λ ₃ = c ₃ λ. λ is a security parameter and is an arbitrary positive natural number. c ₁ and c ₃ are constants and are arbitrary positive natural numbers. In other words, c ₁ and c ₃ may be any positive natural number.

Therefore, the security parameter λ represents the bit number of the order p ₂ of the group G _p2 , and the bit numbers of the orders p ₁ and p ₃ of the other groups are a constant multiple of the bit number of p ₂ .

<Step S2>
The secret key generation unit 12 of the key generation device 1 has K _z ¹ = g ^z1 R ₃ ¹ ,..., K _z ⁿ = g ^zn R ₃ ⁿ , K _r = g ^{r ^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ Xeye} R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi , using the random number generated by the first random number generator 11, the secret key SK = (K _z ¹ ,..., K _z ⁿ , K _r , K _x , K _y , K _xy ) are generated (step S2). The generated secret key SK is stored in the storage unit 23 of the signature generation device 2.

Here, the superscript “z1” of g in K _z ¹ = g ^z1 R ₃ ¹ means z ₁ . The superscript “zn” of g in K _z ⁿ = g ^zn R ₃ ⁿ means z _n . ^{_{K x = g r ^ x g}} 2 r ^ '"xe r ^" of on superscript g ₂ in the ^xe' refers to the r ^ 'x _e. The superscript “r ^ ′ ye” of g ₂ in K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} means r ^ ′ y _e . ^{_{K xy = g r ^ xy g}} 2 r ^ 'xeye R 3 n + 4 Π i = 1 n g of the above subscript g ₂ in ^-ziwi "r ^'xeye" is r ^ 'x _e y means _e, and the superscript “-ziwi” in g means -z _i w _i .

<Step S3>
The public key generation unit 13 of the key generation device 1 uses the random number generated by the first random number generation unit 11 to public key VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 ,..., g ^wn ) are generated (step S3). The generated public key VK is disclosed to the outside of the key generation device 1. In this example, the generated public key VK is stored in the storage unit 23 of the signature generation device 2, transmitted to the signature verification device 3, and stored in the storage unit 32.

Here, "w1" of the superscript of g means w _1. The superscript “wn” of g means w _n .

<Step S4>
The second random number generation unit 21 of the signature generation device 2 generates random numbers r˜, z ₁ ′,..., Z _n ′ εZ _N (step S4). The generated random numbers r˜, z ₁ ′,..., Z _n ′ are transmitted to the signature generation unit 22.

<Step S5>
The signature generation unit 22 of the signature generation apparatus 2 sets m as a message to be signed, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ),..., Σ _n = (K _z ⁿ ) ^{r ~} (g ^{r ~ zn ′} ), σ _{n + 1} = (K _r ) ^{r ~} , σ _{n + 2} = (K _y ) ^{r ~} , σ _{n + 3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ As m} (Π _{i = 1} ⁿ (g ^wi ) ^r˜mzi ), a signature for the message m is generated σ = (σ ₁ ,..., σ _{n + 3} ) using the secret key SK (step S5). The generated signature σ is transmitted to the signature verification apparatus 3 together with the message m.

Here, the superscript “r˜z1 ′” in σ ₁ = (K _z ¹ ) ^r˜ (g ^{r˜z1 ′} ) means r˜z ₁ ′. ^{_{σ n = (K z n)}} r ~ (g r ~ zn ') on superscript of g in the "r ~ zn'" means a r ~ z _n '. σ _{n + 3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ m} (Π _{i = 1} ⁿ (g ^wi ) ^{r ~ mzi} ) g superscript `` wi '' is g superscript w _i means the superscript “r ~ mzi” of (g ^wi ) means r ~ mz _i .

<Step S6>
The determination unit 31 of the signature verification device 3 uses the signature σ and the message m received from the signature generation device 2 and the public key VK read from the storage unit 32, and m ≠ 0 and two expressions e (Y, σ _{n + 1} ) = e (g, σ _{n + 2} ), e (X, σ _{n + 1} ) e (X, σ _{n + 2} ) ^m Π _{i = 1} ⁿ e (g ^wi , σ _i ) ^m = e It is determined whether (g, σ _{n + 3} ) holds, and if m ≠ 0 and the above two expressions hold, the signature σ is accepted (step S6). The superscript “wi” in g in the second expression means w _i . On the other hand, if m = 0 or any of the above two expressions does not hold, the signature σ is not accepted.

G, as a group of order N = p ₁ p ₂ p ₃ and _{G T, e: G × G} → G T is the bilinear map.

  When the signature verification apparatus 3 accepts the signature σ, the signature verification apparatus 3 may output information indicating that the signature σ is accepted, for example, “1”. If the signature verification device 3 does not accept the signature σ, the signature verification device 3 may output information indicating that the signature σ is not accepted, for example, “0”.

  The signature system and method described above does not use non-interactive zero knowledge proof and does not use ID-based encryption.

In addition, this signature system and method is a secure signature scheme having a secret key leakage resistance if a subgroup identification assumption on a so-called composite number group is established. In this signature system and method, the secret key SK = (K _z ¹ ,..., K _z ⁿ , K _r , K _x , K _y , K _xy ) has a large number of numerical values K _z ¹ ,…, K _z ⁿ , K _r. , K _x , K _y , K _xy , and these numbers K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy are in the remainder class group such as Z _N This is because there are no elements in the groups G _p1 , G _p2 and G _p3 . If this signature system and method is a so-called subgroup identification hypothesis on the composite number group, the details of the proof that the signature system and method are a secure signature scheme with secret key leakage resistance can be found in Reference 1. about.
[Reference 1] Yoshihiro Koseki, Ryo Nishimaki, Eiichiro Fujisaki, Keisuke Tanaka, “Dual Form Signature Secure against Secret Key Leakage”, SCIS2013

[Modification]
In the example of FIG. 1, the key generation device 1 is provided in the signature generation device 2, but the key generation device 1 may be provided outside the signature generation device 2. In this case, the key generation device 1 generates the secret key SK and the public key VK in the same manner as described above, transmits the secret key SK secretly to the signature generation device 2, and the public key VK is transmitted to the signature generation device 2 and the signature verification. Transmit to device 3.

  The processes described in the above apparatus and method are not only executed in time series according to the description order, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the process.

  Further, when each process in each apparatus of the signature system is realized by a computer, the processing contents of the functions that each apparatus should have are described by a program. Then, by executing this program on a computer, each process is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

  Needless to say, other modifications are possible without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Key generation apparatus 11 First random number generation part 12 Private key generation part 13 Public key generation part 2 Signature generation apparatus 21 Second random number generation part 22 Signature generation part 23 Storage part 3 Signature verification apparatus 31 Determination part 32 Storage part

Claims (4)

p ₁ , p ₂ , p ₃ are prime numbers, the group of order N = p ₁ p ₂ p ₃ is G, G _T , e: G × G → G _T is a bilinear map, and random number g∈G _p1 , g ₂ ∈G _p2 , g ₃ , R ₃ ¹ ,…, R ₃ ^{n + 4} ∈G _p3 and random numbers x, y, x _e , y _e , r ^, r ^ ′, z ₁ ,…, z _{n, w 1, ..., w} n and the first random number generation unit for generating a ^{_{∈Z n, K z 1 = g}} z1 R 3 1, ..., K z n = g zn R 3 n, K r = g r ^{^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ xeye} R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi , secret key SK = (K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy ) and a public key VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 , ..., g ^wn ) A key generation device including a key generation unit;
The second random number generator for generating random numbers r ~, z ₁ ′, ..., z _n ′ ∈Z _N , and the message to be signed is m, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ),…, σ _n = (K _z ⁿ ) ^{r ~} (g ^{r ~ zn ′} ), σ _{n + 1} = (K _r ) ^{r ~} , σ _{n + 2} = (K _y ) ^{r ~} , σ _{n +3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ m} (Π _{i = 1} ⁿ (g ^wi ) ^{r ~ mzi} ), and the signature for the message m using the secret key SK is σ = (σ ₁ , ..., σ _{n + 3} ), and a signature generation device including the signature generation unit,
m ≠ 0 and two equations e (Y, σ _{n + 1} ) = e (g, σ _{n + 2} ), e (X, σ _{n + 1} ) e (X, σ _{n + 2} ) ^m Π _{i = 1} ⁿ e (g ^wi , σ _i ) ^m = e (g, σ _{n + 3} ) is determined whether or not, and if m ≠ 0 and the above two expressions are satisfied, the determination unit accepting the signature σ A signature verification device including:
Including signature system. The first random number generator of the key generation device uses p ₁ , p ₂ , and p ₃ as prime numbers, the group of order N = p ₁ p ₂ p ₃ as G, G _T, and e: G × G → G _T Is a bilinear map, random numbers g∈G _p1 , g ₂ ∈G _p2 , g ₃ , R ₃ ¹ ,…, R ₃ ^{n + 4} ∈G _p3 and random numbers x, y, x _e , y _e , r ^ , r ^ ′, z ₁ , ..., z _n , w ₁ , ..., w _n ∈Z _N and
The secret key generation unit of the key generation device has K _z ¹ = g ^z1 R ₃ ¹ ,..., K _z ⁿ = g ^zn R ₃ ⁿ , K _r = g ^{r ^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ xeye} A secret key generation step for generating a secret key SK = (K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy ) as R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi ,
A public key generation unit for generating a public key VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 ,..., G ^wn ) ,
A second random number generation unit of the signature generation device, wherein the signature generation unit generates a random number r ~, z ₁ ′,..., Z _n ′ ∈Z _N ;
The signature generation unit of the signature generation apparatus sets m as a message to be signed, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ), ..., σ _n = (K _z ⁿ ) ^{r ~} ( g ^{r ~ z′n} ), σ _{n + 1} = (K _r ) ^{r ~} , σ _{n + 2} = (K _y ) ^{r ~} , σ _{n + 3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ m} (Π _{i = 1} ⁿ (g ^wi ) ^{r ~ mzi} ), and a signature generation step of generating σ = (σ ₁ ,..., Σ _{n + 3} ) as a signature for the message m using the secret key SK,
The determination unit of the signature verification apparatus determines that m ≠ 0 and two expressions e (Y, σ _{n + 1} ) = e (g, σ _{n + 2} ), e (X, σ _{n + 1} ) e (X, σ _{n +2} ) ^m Π _{i = 1} ⁿ e (g ^wi , σ _i ) ^m = e (g, σ _{n + 3} ) is determined to be satisfied, and if m ≠ 0 and the above two expressions are satisfied A determination step for accepting the signature σ;
Including signing method. p ₁ , p ₂ , p ₃ are prime numbers, the group of order N = p ₁ p ₂ p ₃ is G, G _T , e: G × G → G _T is a bilinear map, g∈G _p1 , g ₂ ∈G _p2 , g ₃ , R ₃ ¹ ,…, R ₃ ^{n + 4} ∈G _p3 and x, y, x _e , y _e , r ^, r ^ ′, z ₁ ,…, z _n , _Let w ₁ ,…, w _n ∈Z _N be random numbers, and K _z ¹ = g ^z1 R ₃ ¹ ,…, K _z ⁿ = g ^zn R ₃ ⁿ , K _r = g ^{r ^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ xeye} R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi , SK = (K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy ) is a secret key, VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 , ..., g ^wn )
A second random number generator for generating random numbers r ~, z ₁ ′,..., Z _n ′ ∈Z _N ;
Let m be the message to be signed, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ),…, σ _n = (K _z ⁿ ) ^{r ~} (g ^{r ~ z′n} ), σ _{n + 1} = (K _r ) ^{r ~} , σ _{n + 2} = (K _y ) ^{r ~} , σ _{n + 3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ m} (Π _{i = 1} ⁿ (g ^wi ) ^{r ~ mzi} ), a signature generation unit that generates σ = (σ ₁ ,..., σ _{n + 3} ) as a signature for the message m using the secret key SK, and
A signature generation device including: p ₁ , p ₂ , p ₃ are prime numbers, the group of order N = p ₁ p ₂ p ₃ is G, G _T , e: G × G → G _T is a bilinear map, g∈G _p1 , g ₂ ∈G _p2 , g ₃ , R ₃ ¹ ,…, R ₃ ^{n + 4} ∈G _p3 and x, y, x _e , y _e , r ^, r ^ ′, z ₁ ,…, z _n , _Let w ₁ ,…, w _n ∈Z _N be random numbers, and K _z ¹ = g ^z1 R ₃ ¹ ,…, K _z ⁿ = g ^zn R ₃ ⁿ , K _r = g ^{r ^} g ₂ ^{r ^ ′} R ₃ ^{n + 1} , K _x = g ^{r ^ x} g ₂ ^{r ^ ′ xe} R ₃ ^{n + 2} , K _y = g ^{r ^ y} g ₂ ^{r ^ ′ ye} R ₃ ^{n + 3} , K _xy = g ^{r ^ xy} g ₂ ^{r ^ ′ xeye} R ₃ ^{n + 4} Π _{i = 1} ⁿ g ^-ziwi , SK = (K _z ¹ ,…, K _z ⁿ , K _r , K _x , K _y , K _xy ) is a secret key, Let VK = (N, G, g, X = g ^x , Y = g ^y , g ₃ , g ^w1 ,…, g ^wn ) be the public key, r ~, z ₁ ′,…, z _n ′ ∈Z _N Is a random number, the message to be signed is m, and σ ₁ = (K _z ¹ ) ^{r ~} (g ^{r ~ z1 ′} ),…, σ _n = (K _z ⁿ ) ^{r ~} (g ^{r ~ zn ′} ), σ _{n + 1} = (K _r ) ^{r ~} , σ _{n + 2} = (K _y ) ^{r ~} , σ _{n + 3} = (K _x ) ^{r ~} (K _xy ) ^{r ~ m} (Π _{i = 1} ⁿ (g ^wi ) ^{r ~ mzi} ), and σ = (σ ₁ , ..., σ _{n + 3} ) as a signature for the message m,
m ≠ 0 and two equations e (Y, σ _{n + 1} ) = e (g, σ _{n + 2} ), e (X, σ _{n + 1} ) e (X, σ _{n + 2} ) ^m Π _{i = 1} ⁿ e (g ^wi , σ _i ) ^m = e (g, σ _{n + 3} ) is determined whether or not, and if m ≠ 0 and the above two expressions are satisfied, the determination unit accepting the signature σ ,
A signature verification device.

Images