KR102001407B1 - Electronic signature apparatus and method using an error recovery scheme based on a parity check matrix - Google Patents

Abstract

An electronic signature apparatus and method using an error recovery technique based on a parity check matrix are disclosed. The present invention generates an arbitrary syndrome message based on a message to be transmitted to a data receiving apparatus, detects an error vector for an electronic signature from the syndrome message using a parity check matrix, and generates an electronic signature value based on the error vector for electronic signature And transmits it to the data receiving apparatus, it is possible to provide a non-repudiation function according to a completely different algorithm from the existing asymmetric key-based digital signature technique.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic signature apparatus and method using an error recovery technique based on a parity check matrix,

The present invention relates to techniques that can be utilized in an electronic signature system that performs non-repudiation utilizing an asymmetric key.

Recently, with the widespread use of the Internet, online banking services and payment systems have been actively introduced.

In such an online banking service or a payment system, it is necessary to accurately determine whether there is a money transfer or an electronic payment request from a true person who intends to transfer money or make electronic payment.

For example, when a user A transfers an account to a user B through an online banking service, it is necessary to check whether the account transfer request is really made by the user A in the system providing the online banking service .

In this way, a security service for checking whether a message delivered from a specific user is delivered by a real user is called a non-repudiation service.

Generally, the non-repudiation service introduced in general online banking service or payment system is mainly composed of electronic signature system using Public Key Infrastructure (PKI).

The digital signature system of the public key-based cryptosystem is a system for transmitting a message, encrypting the hash value of the message with its own private key to generate a digital signature value, The message receiver decrypts the digital signature value with a public key corresponding to the private key, calculates a hash value for the message received from the message transmission side, and decrypts the decrypted value with the public key, The digital signature value received from the message transmission side is proved to be a value that is really encrypted by the private key of the message transmission side, And confirms that the message is transmitted from the transmission side.

The digital signature system of the public key based encryption scheme generates a private key and a corresponding public key by using a public key exchange scheme according to a commonly known DH (Diffie-Hellman) algorithm, And verifies the digital signature value with the public key.

These existing digital signature generation and verification algorithms are already widely used in the related industries, and they are vulnerable due to high possibility of forgery and alteration of digital signatures.

Therefore, it is necessary to study new digital signature generation and verification algorithms different from existing digital signature generation and verification algorithms.

The present invention generates an arbitrary syndrome message based on a message to be transmitted to a data receiving apparatus, detects an error vector for an electronic signature from the syndrome message using a parity check matrix, and generates an electronic signature value based on the error vector for electronic signature And transmits it to the data receiving apparatus, thereby providing a non-repudiation function according to a completely different algorithm from the conventional asymmetric key-based digital signature technique.

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i -

임 - 를 생성하는 신드롬 메시지 생성부, 상기 변수 i가 '0'을 시작으로 해서 '1'씩 증가되면서 상기 신드롬 메시지 s_i가 생성될 때마다, 각 변수 i에서의 상기 신드롬 메시지 s_i에 대해 상기 패리티 검사 행렬 H를 기초로 완전 복호화(Complete Decoding)를 수행하여

- z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐 - 를 만족하는 z^T를 연산한 후 z^T의 해밍 무게(Hamming Weight)가 선정된 해밍 무게인 w 이하로 연산되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 연산된 z^T를 서명용 오류 벡터 z_s ^T로 선택하는 선택부, 상기 서명용 오류 벡터 z_s ^T의 좌측 변에 상기 순열 행렬 P의 역행렬인 P^-1을 곱하여

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성하는 전자 서명부 및 상기 데이터 수신 장치에 대해 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s를 전송하는 전자 서명 전송부를 포함한다.An electronic signature apparatus using an error recovery method based on a parity check matrix according to an embodiment of the present invention includes (nk) xn-n and k composed of Reed-Muller (RM) (Nk) x (nk) scrambling matrix Q and codes of '1' and '0' having a code value of the parity check matrix H, '1' and '0' A hash function h (x) which is a predetermined hash function, h (x), a plaintext message m to be transmitted to the data receiving apparatus, A first hash value calculation unit for calculating a first hash value h (m) by applying the input value as an input to a one-way function for converting an input value into an output value of (nk) bits, , The variable i - the variable i is an integer equal to or greater than 0 - is incremented from 0 to 1 , The result of concatenating the bit value of the variable i with the first hash value h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

Im-syndrome message generating unit for generating, each time while the variable i to "0" as a starting increased by '1', the syndrome message s _i is generated, relative to the syndrome message s _i for each variable i And performs complete decoding based on the parity check matrix H

- z ^T is a transpose of a vector z of size n and has a size of nx 1 - then computes z ^T , and then the Hamming Weight of z ^T is calculated to be less than or equal to the selected Hamming weight w selecting a variable i at the time when a signature variable i _s, and at the same time selecting unit for selecting a z ^T calculated in response to the signing variable i _s a signature error vector z _s ^T, the left side of the signing error vector z _s ^T By the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m; and a plaintext message m and a digital signature value < RTI ID = 0.0 >

And an electronic signature transmitter for transmitting the signature variable i _s .

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i -

임 - 를 생성하는 신드롬 메시지 생성부, 상기 변수 i가 '0'을 시작으로 해서 '1'씩 증가되면서 상기 신드롬 메시지 s_i가 생성될 때마다, 각 변수 i에서의 상기 신드롬 메시지 s_i에 대해 상기 패리티 검사 행렬 H를 기초로 완전 복호화를 수행하여

- z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐 - 를 만족하는 z^T를 연산하고, 상기 변형 패리티 검사 행렬 H_t에서 상기 복수의 선정된 제1 행들과 상기 복수의 선정된 제2 열들에 위치하는 코드 값에 기초하여 각 변수 i마다 연산되는 z^T의 성분을 조작함으로써,

를 만족하는 z_t ^T를 검출한 후 z_t ^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 검출되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 검출된 z_t ^T를 서명용 오류 벡터 z_s ^T로 선택하는 선택부, 상기 서명용 오류 벡터 z_s ^T의 좌측 변에 상기 순열 행렬 P의 역행렬인 P^-1을 곱하여

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성하는 전자 서명부 및 상기 데이터 수신 장치에 대해 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s를 전송하는 전자 서명 전송부를 포함한다.Also, an electronic signature apparatus using an error recovery method based on a parity check matrix based on a parity check matrix according to another embodiment of the present invention includes (nk) xn-n composed of RM codes, k is a natural number, n is a linear code The parity check matrix H for the parity check matrix H, the components located in the plurality of first rows selected in the parity check matrix H are replaced with random code values, and the components located in the plurality of second selected columns are replaced with codes of '0' (Nk) x (nk) scrambling matrix Q containing the code values of the transformed parity check matrix H _t , '1' and '0', and the code values of '1' and '0' And a hash function h (x), which is a hash function h (x), is used to convert the input value to ( nk) into a bit-sized output value. A first hash value calculator for calculating a first hash value h (m) by applying the first hash value h (m) as an input, The result of concatenating the first hash value h (m) with the bit value for the variable i while incrementing the integer from 0 to 1

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

Im-syndrome message generating unit for generating, each time while the variable i to "0" as a starting increased by '1', the syndrome message s _i is generated, relative to the syndrome message s _i for each variable i And performs a full decoding based on the parity check matrix H

- z ^T is a transpose of a vector z of size n and has a size of nx 1, and calculates z ^T in the modified parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

And then detecting the z _t ^T satisfying the variable i at the time is detected more than the Hamming weight of the Hamming weight of z _t ^T selection w and at the same time select a signature variable i _s corresponding to the signing variable i _s A selector for selecting the detected z _t ^T as a signature error vector z _s ^T , a left side of the signature error vector z _s ^T multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m; and a plaintext message m and a digital signature value < RTI ID = 0.0 >

And an electronic signature transmitter for transmitting the signature variable i _s .

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i -

임 - 를 생성하는 단계, 상기 변수 i가 '0'을 시작으로 해서 '1'씩 증가되면서 상기 신드롬 메시지 s_i가 생성될 때마다, 각 변수 i에서의 상기 신드롬 메시지 s_i에 대해 상기 패리티 검사 행렬 H를 기초로 완전 복호화를 수행하여

- z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐 - 를 만족하는 z^T를 연산한 후 z^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 연산되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 연산된 z^T를 서명용 오류 벡터 z_s ^T로 선택하는 단계, 상기 서명용 오류 벡터 z_s ^T의 좌측 변에 상기 순열 행렬 P의 역행렬인 P^-1을 곱하여

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성하는 단계 및 상기 데이터 수신 장치에 대해 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s를 전송하는 단계를 포함한다.Also, an electronic signature method using an error recovery method based on a parity check matrix based on a parity check matrix according to an embodiment of the present invention is characterized in that (nk) xn - n and k composed of RM codes are natural numbers and n is a linear code (Nk) x (nk) scrambling matrix Q including code values of the parity check matrix H, '1' and '0' for the scrambling matrix Q and the code values of '1' and '0' (Nk) of the hash function h (x), which is a predetermined hash function, h (x), and the hash function h (x) (M) by applying a first hash value h (m) to the input of the first hash value h (m) i is an integer equal to or greater than 0, is increased from '0' to '1', and the first hash value The result obtained by concatenating the bit values of the variable i with h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

The parity check for generating, each time while the variable i to "0" to start increasing by "1" be the syndrome message s _i is generated, the syndrome message s _i for each variable i - Im By performing a complete decoding based on the matrix H

- z ^T is the transpose matrix of vector z with size n and has the size of nx 1 - After computing the z ^T satisfying z ^T , the variable at the time when the Hamming weight of z ^T is calculated to be less than the selected Hamming weight w select i to i _s signature variable, and at the same time the signing variable i _s error the computed z ^T signature corresponding to the vector selecting a z _s ^T, the signature error vectors and a permutation matrix on the left side of the z _s ^T P Multiplied by the inverse of P ^-1

, Thereby calculating

Generating a plaintext message m and an electronic signature value m for the plaintext message m;

And transmitting the signature variable i _s .

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i -

임 - 를 생성하는 단계, 상기 변수 i가 '0'을 시작으로 해서 '1'씩 증가되면서 상기 신드롬 메시지 s_i가 생성될 때마다, 각 변수 i에서의 상기 신드롬 메시지 s_i에 대해 상기 패리티 검사 행렬 H를 기초로 완전 복호화를 수행하여

- z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐 - 를 만족하는 z^T를 연산하고, 상기 변형 패리티 검사 행렬 H_t에서 상기 복수의 선정된 제1 행들과 상기 복수의 선정된 제2 열들에 위치하는 코드 값에 기초하여 각 변수 i마다 연산되는 z^T의 성분을 조작함으로써,

를 만족하는 z_t ^T를 검출한 후 z_t ^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 검출되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 검출된 z_t ^T를 서명용 오류 벡터 z_s ^T로 선택하는 단계, 상기 서명용 오류 벡터 z_s ^T의 좌측 변에 상기 순열 행렬 P의 역행렬인 P^-1을 곱하여

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성하는 단계 및 상기 데이터 수신 장치에 대해 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s를 전송하는 단계를 포함한다.Also, an electronic signature method using an error recovery method based on a parity check matrix based on a parity check matrix according to another embodiment of the present invention is characterized in that (nk) xn-n composed of RM code and k are natural numbers and n is a linear code The parity check matrix H for the parity check matrix H, the components located in the plurality of first rows selected in the parity check matrix H are replaced with random code values, and the components located in the plurality of second selected columns are replaced with codes of '0' (Nk) x (nk) scrambling matrix Q containing the code values of the transformed parity check matrix H _t , '1' and '0', and the code values of '1' and '0' Storing a permutation matrix P having a size of nxn as a component; storing a plaintext message m to be transmitted to the data receiving apparatus as a hash function h (x) - the hash function h (x) Converts a value to an (nk) bit-sized output value (M) is computed by applying a first hash value h (m) to the input of the first hash value h (m), wherein the key i is a one-way function, The result of concatenating the first hash value h (m) with the bit value for the variable i while incrementing the integer from 0 to 1

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

The parity check for generating, each time while the variable i to "0" to start increasing by "1" be the syndrome message s _i is generated, the syndrome message s _i for each variable i - Im By performing a complete decoding based on the matrix H

- z ^T is a transpose of a vector z of size n and has a size of nx 1, and calculates z ^T in the modified parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

And then detecting the z _t ^T satisfying the variable i at the time is detected more than the Hamming weight of the Hamming weight of z _t ^T selection w and at the same time select a signature variable i _s corresponding to the signing variable i _s Selecting the detected z _t ^T as a signature error vector z _s ^T , multiplying the left side of the signature error vector z _s ^T by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

Generating a plaintext message m and an electronic signature value m for the plaintext message m;

And transmitting the signature variable i _s .

The present invention generates an arbitrary syndrome message based on a message to be transmitted to a data receiving apparatus, detects an error vector for an electronic signature from the syndrome message using a parity check matrix, and generates an electronic signature value based on the error vector for electronic signature And transmits it to the data receiving apparatus, it is possible to provide a non-repudiation function according to a completely different algorithm from the existing asymmetric key-based digital signature technique.

1 is a diagram illustrating a structure of an electronic signature apparatus using an error recovery scheme based on a parity check matrix according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of a form of a modified parity check matrix H _t according to an embodiment of the present invention.
3 is a flowchart illustrating an electronic signature method using an error recovery technique based on a parity check matrix according to an embodiment of the present invention.
4 is a flowchart illustrating an electronic signature method using an error recovery technique based on a parity check matrix according to another embodiment of the present invention.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings. It is to be understood that the description is not intended to limit the invention to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals in the drawings are used for similar elements and, unless otherwise defined, all terms used in the specification, including technical and scientific terms, are to be construed in a manner that is familiar to those skilled in the art. It has the same meaning as commonly understood by those who have it.

1 is a diagram illustrating a structure of an electronic signature apparatus using an error recovery scheme based on a parity check matrix according to an embodiment of the present invention.

1, an electronic signature apparatus 110 using an error recovery scheme based on a parity check matrix according to an embodiment of the present invention includes a private key storage unit 111, a first hash value operation unit 112, A generating unit 113, a selecting unit 114, a digital signature unit 115, and an electronic signature transmitting unit 116. [

The private key storage unit 111 includes code values of the parity check matrix H, '1' and '0' for the (nk) xn linear code composed of Reed-Muller A permutation matrix P having a size of (nk) x (nk) and a size nxn of the scrambling matrix Q and code values of '1' and '0' as components is stored.

Where n and k are natural numbers and n is a number greater than k.

The RM code means a linear code used as an error correction code. The RM code expressed by RM (r, m) has a length of 2 ^m and has m basic codes. The product of the m basic codes The code you have can also be the base code of the RM. And r is the maximum number of basic codes that can be used in the multiplication of the basic codes. For example, m = 4, when that r = 4, the length of the RM code is 16, at this time, so the RM code is represented by ^24, of the four basic codes R1, R2, R3, R4 (each primary code The length is 16). At this time, the RM code obtained by multiplying the product of the four basic codes R1, R2, R3, and R4 can also be a basic code. Here, since r = 4, the maximum number of usable products for the multiplication of the four basic codes is four for generating four additional basic codes for the four basic codes R1, R2, R3, and R4, Additional basic codes can be generated by combining up to four products of the basic codes R1, R2, R3, and R4. In relation to RM (4 and 4), 11 basic codes corresponding to R1, R2, R3 and R4 and 11 basic codes consisting of R1R2, R1R3, R1R4, R2R3, R2R4, R3R4, R1R2R3, R1R2R4, R1R3R4, R2R3R4 and R1R2R3R4 Since the basic code can be generated and the code having the bit value of '1' in the characteristic of the RM code also has to be the basic code, a total of 16 basic codes can be generated as a result. The RM code can be used to construct a generator matrix for encoding a message to be transmitted to a data receiver with a codeword, and a parity check matrix for verifying whether an error has occurred in the codeword received at the data receiver Lt; / RTI >

The parity check matrix is a matrix for verifying whether or not an error has occurred in the codeword received at the data receiving side. When there is a kxn generation matrix G, if the corresponding parity check matrix is 'H' The size of the matrix H is (nk) xn, and the parity check matrix H and the generator matrix G have the following Equation (1).

Here, H ^T denotes a transpose matrix of the parity check matrix H.

If the data transmission side generates the codeword c using the generator matrix G and transmits the codeword c to the data receiving side, if the codeword received at the data receiving end is 'r' and no error occurs in the codeword r , And the codeword r has the following characteristics in relation to the parity check matrix H: < EMI ID = 2.0 >

Here, r ^T denotes the transpose matrix of the codeword r.

However, if an error e occurs in the codeword c transmitted by the data transmission side, the codeword r received by the data receiver side will be 'c + e', and the parity check matrix H and the codeword r The following equation (3) is obtained.

As in the operation of Equation (3), the data receiving side can detect whether there is an error in the data received at the data receiving side using the parity check matrix. In Equation (3), 's' is referred to as a syndrome.

의 수식을 만족하는 복수의 e들 중 해밍 무게(Hamming Weight)가 최소인 e를 찾아낼 수 있다.When the parity check matrix H is composed of RM codes, if a complete decoding algorithm based on the parity check matrix H is used for the syndrome s expressed in Equation (3)

E among the plurality of e satisfying the equation of Eq.

가 있을 때,

를 만족하는 e들 중 해밍 무게가 최소인 e를 찾아내는 복호화 알고리즘이다. 완전 복호 알고리즘을 이용하면, 데이터 전송측이 부호어를 생성하기 위해 사용한 생성 행렬에 지정되어 있는 오류 정정 능력을 초과하는 오류에 대해서도 복호가 가능하며, RM 코드의 복호 방법 중 하나인 재귀 복호는 완전 복호가 가능한 특징이 있다.The complete decoding algorithm is a r × n-size parity check matrix and a syndrome

Lt; / RTI >

Is the decryption algorithm that finds the e with the smallest Hamming weight. By using the complete decoding algorithm, it is possible to decode an error exceeding the error correction capability specified in the generation matrix used for generating the codeword by the data transmission side, and recursive decoding, which is one of the RM code decoding methods, It is possible to decode it.

Here, Hamming weight means the number of code values of '1' in the set of code values composed of '0' and '1'.

If the plaintext message to be transmitted to the data receiving apparatus 120 is m in a state where the parity check matrix H, the scrambling matrix Q, and the permutation matrix P are stored on the private key storage unit 111, (112) applies the plaintext message m as an input to a predetermined hash function h (x) to calculate a first hash value h (m).

Here, the hash function h (x) is a one-way function for converting an input value into an output value of (n-k) bits.

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i를 생성한다.The syndrome message generation unit 113 increases the variable i (the variable i is an integer equal to or greater than 0) from 0 to 1, when the calculation of the first hash value h (m) is completed, 1 The result of concatenating the bit values for the variable i with the hash value h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

Is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to generate a syndrome message s _i .

Accordingly, the syndrome message s _i can be expressed as Equation (4) below.

(z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐)를 만족하는 z^T를 연산한 후 z^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 연산되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 연산된 z^T를 서명용 오류 벡터 z_s ^T로 선택한다.When the syndrome message s _i is generated while the variable i is incremented by '1' starting from '0', the selector 114 sets the parity check matrix for the syndrome message s _i in each variable i And performs complete decoding on the basis of H

(z ^T is a transpose matrix of vector z with size n), z ^T is computed to satisfy the following equation: z ^{T =} i is selected as the signature variable i _s , and at the same time, z ^T calculated corresponding to the signing variable i _s is selected as the signature error vector z _s ^T.

를 만족하는 z^T를 연산해 보고, z^T의 해밍 무게가 상기 선정된 해밍 무게인 w 이하로 연산되는 시점에서, z^T를 찾는 연산을 중단한 후 해당 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 연산된 z^T를 서명용 오류 벡터 z_s ^T로 선택할 수 있다.That is, the selector 114 performs the complete decoding while incrementing the variable i by '1' starting from '0' with respect to s _i shown in Equation (4)

From the time the report to calculate the z ^T, calculated below is the Hamming weight Hamming weight of the selection of z ^T w, and then stop the operation to find z ^T variable at that point in time i satisfying the signing variable i _s And at the same time, z ^T calculated corresponding to the signature variable i _s can be selected as the signature error vector z _s ^T.

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성한다.Thereafter, the digital signature unit 115 multiplies the left side of the signature error vector z _s ^T by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m.

및 상기 서명용 변수 i_s를 전송할 수 있다.The digital signature transmission unit 116 transmits the plaintext message m and the digital signature value < RTI ID = 0.0 >

And the signature variable i _s .

In this case, according to an embodiment of the present invention, the data receiving apparatus 120 may be configured to receive K _pub (nk) having a size of (nk) xn, which is a matrix obtained by multiplying the scrambling matrix Q by the parity check matrix H and the permutation matrix P, As a verification key for the digital signature.

Here, the verification key K _pub can be expressed by the following equation (5).

및 상기 서명용 변수 i_s가 수신되면, 데이터 수신 장치(120)는 상기 전자 서명 값

가 진정한 데이터 전송측에 의해서 전송된 데이터인지 여부를 검증하기 위해, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 검증키 K_pub와 상기 서명용 변수 i_s에 기초하여 상기 전자 서명 값

에 대한 검증을 수행할 수 있다.If the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signing variable i _s is received, the data receiving apparatus 120 transmits the digital signature value

In order to verify whether the data is the data transmitted by the true data transmission side,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Can be performed.

에 대한 검증을 수행하기 위한 구체적 구성으로, 상기 메모리 상에 상기 해시 함수 h(x)를 저장하고 있고, 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인할 수 있다.In this regard, the data receiving apparatus 120 transmits the digital signature value

Wherein the hash function h (x) is stored in the memory, and the plaintext message m and the digital signature value h

And when the signature variable i _s is received,

It is possible to confirm whether or not the hamming weight of the hamming weight is less than or equal to the predetermined hamming weight w.

을 생성하여 데이터 수신 장치(120)로 전송하였기 때문에, 데이터 수신 장치(120)에 수신된 전자 서명 값인

의 해밍 무게도 상기 선정된 해밍 무게인 w 이하가 되어야 데이터 수신 장치(120)에 정상적으로 데이터가 수신되었다고 볼 수 있을 것이다.The selection unit 114 of the digital signature apparatus 110 using the error correction scheme based on the parity check matrix selects the signature error vector z _s ^T whose Hamming weight has the predetermined Hamming weight w or less, value

And transmits the generated digital signature to the data receiving apparatus 120, the digital signature value received by the data receiving apparatus 120

The hamming weight of the received data may not be equal to or smaller than the predetermined hamming weight w.

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 먼저 확인하게 된다.Accordingly, the data receiving apparatus 120 transmits the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Whether or not the hamming weight of the hamming weight is less than or equal to the predetermined hamming weight w.

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 데이터 수신 장치(120)는 상기 평문 메시지 m을 상기 메모리 상에 저장되어 있는 상기 해시 함수 h(x)에 입력으로 인가하여 상기 제1 해시 값 h(m)을 연산할 수 있다.If the digital signature value

The data receiving apparatus 120 applies the plaintext message m as an input to the hash function h (x) stored on the memory to store the plaintext message m in the first The hash value h (m) can be calculated.

를 상기 해시 함수 h(x)에 입력으로 인가하여 검증용 해시 값인

을 연산할 수 있다.Then, the data receiving apparatus 120 obtains a result value of the bit value for the signature variable i _s by concatenating the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Can be calculated.

을 곱한 결과 값인

가 상기 검증용 해시 값인

의 전치 행렬인

와 일치하는지 비교하여 상기

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.Thereafter, the data receiving apparatus 120 transmits the verification key K _pub ,

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

을 곱한 결과 값인

은 하기의 수학식 6과 같이 나타낼 수 있다.In relation to this, the verification key K _{pub is set} to the digital signature value

Lt; RTI ID = 0.0 >

Can be expressed by Equation (6) below.

의 전치 행렬인

는 하기의 수학식 7과 같이 나타낼 수 있다.Then, the verification hash value

≪ / RTI >

Can be expressed by the following Equation (7).

는 상기 서명용 변수 i_s가 패리티 검사 행렬에 기초한 오류 복원 기법을 이용하는 전자 서명 장치(110)로부터 데이터 수신 장치(120)로 위조나 변조 없이 정상적으로 수신되었다면,

와 동일한 값이 될 것이다.In Equation (7)

If the signature variable i _s has been normally received from the digital signature apparatus 110 using the error correction scheme based on the parity check matrix to the data reception apparatus 120 without forgery or modulation,

Will be the same value.

가 패리티 검사 행렬에 기초한 오류 복원 기법을 이용하는 전자 서명 장치(110)로부터 데이터 수신 장치(120)로 위조나 변조 없이 정상적으로 수신되었다면, 상기 수학식 6에 따른

와 상기 수학식 7에 따른

는 하기의 수학식 8에서 나타낸 것처럼 동일한 값이 되어야 할 것이다.Thus, the digital signature value

Is normally received from the digital signature apparatus 110 using the error correction scheme based on the parity check matrix without any falsification or modulation from the data reception apparatus 120,

And Equation (7)

Lt; RTI ID = 0.0 > (8) < / RTI >

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.Therefore, the data receiving apparatus 120 receives

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

The digital signature apparatus 110 using the error correction scheme based on the parity check matrix according to an embodiment of the present invention has been described with reference to FIG.

In the embodiment described so far, the third embodiment includes a configuration for performing digital signature based on a parity check matrix composed of RM codes, and thus excludes the possibility that a third party can guess the parity check matrix based on the structural characteristic of the RM code There may be security weaknesses that can not be done. Therefore, in order to further enhance the security of digital signatures, the present invention is a modified embodiment that is different from the above-described embodiment. By changing the structure of the parity check matrix used for digital signatures, The parity check matrix can not be inferred based on the parity check matrix. Hereinafter, an electronic signature apparatus 110 using an error recovery scheme based on a parity check matrix according to a modified embodiment of the present invention will be described in further detail with reference to FIG.

In the private key storage unit 111, a parity check matrix H for a (nk) xn-sized linear code composed of RM codes and a plurality of predetermined first rows in the parity check matrix H are random code values (Nk) x (nk) which includes code values of the modified parity check matrix H _t , '1' and '0' whose components are replaced with code values of '0' (nk) sized scrambling matrix Q and a permutation matrix P of size nxn containing '1' and '0' code values as components.

Where n and k are natural numbers and n is a number greater than k.

Typically, the parity check matrix, as H is expressed in Equation (9) below, P _s ^T and the (nk) of the pre-matrix for the kx (nk) parity portion (sub) matrix P _s of size consisting of a parity bit x ( nk) size matrix I are connected to one another.

At this time, the modified parity check matrix H _t stored on the private key storage unit 110 is a random parity check matrix H in which the components located in a plurality of selected first rows in the parity check matrix H having the form of Equation (9) Code values, and the components located in a plurality of the selected second columns are replaced with code values of '0'.

In this regard, the modified parity check matrix H _t may be configured to have a shape as shown in FIG.

As shown in FIG. 2, the modified parity check matrix H _t is replaced with a random code value by codes existing from the lowermost row to the p rows of the parity check matrix H, as denoted by reference numeral 211, The codes existing from the rightmost column to the p columns of the parity check matrix H may be replaced with '0' as indicated by reference numeral 212.

At this time, the deformation is not performed on the codes located at the pxp size portion indicated by I _p in FIG. 2, so that the deformed parity check matrix H _t may be configured to have the unit matrix form for the I _p portion have.

When the parity check matrix H, the modified parity check matrix H _t , the scrambling matrix Q, and the permutation matrix P are stored on the private key storage unit 111, the plaintext message to be transmitted to the data receiving apparatus 120 is m The first hash value calculator 112 calculates the first hash value h (m) by applying the plaintext message m to the selected hash function h (x) as an input.

Here, the hash function h (x) is a one-way function for converting an input value into an output value of (n-k) bits.

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i를 생성한다.The syndrome message generation unit 113 increases the variable i (the variable i is an integer equal to or greater than 0) from 0 to 1, when the calculation of the first hash value h (m) is completed, 1 The result of concatenating the bit values for the variable i with the hash value h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

Is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to generate a syndrome message s _i .

Therefore, the syndrome message s _i can be expressed as Equation (10) below.

(z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐)를 만족하는 z^T를 연산하고, 상기 변형 패리티 검사 행렬 H_t에서 상기 복수의 선정된 제1 행들과 상기 복수의 선정된 제2 열들에 위치하는 코드 값에 기초하여 각 변수 i마다 연산되는 z^T의 성분을 조작함으로써,

를 만족하는 z_t ^T를 검출한 후 z_t ^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 검출되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 검출된 z_t ^T를 서명용 오류 벡터 z_s ^T로 선택한다.When the syndrome message s _i is generated while the variable i is incremented by '1' starting from '0', the selector 114 sets the parity check matrix for the syndrome message s _i in each variable i H < RTI ID = 0.0 >

(where z ^T is a transposed matrix of a vector z of size n, and has a size of nx 1), and calculates z ^T in the transformed parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

And then detecting the z _t ^T satisfying the variable i at the time is detected more than the Hamming weight of the Hamming weight of z _t ^T selection w and at the same time select a signature variable i _s corresponding to the signing variable i _s It selects the detected z _t ^T to the signature error vector z _s ^T.

를 만족하는 z^T를 연산할 수 있다.In relation to this, the selector 114 performs the complete decoding while incrementing the variable i from '0' to '1' with respect to s _i shown in Equation (10)

The operation can be the ^T z satisfying.

를 만족하는 z_t ^T를 검출할 수 있다. 관련해서, 상기 변형 패리티 검사 행렬 H_t는 상기 패리티 검사 행렬 H에서 도면부호 211과 도면부호 212로 표시된 부분의 코드 값만 변경된 행렬이므로,

를 만족하는 z^T가 연산되면, n x 1의 크기를 갖는 행렬인 z^T에 포함되어 있는 성분들 중 도면부호 211과 도면부호 212의 성분들이 변경됨에 따라

의 연산에 영향을 받는 성분들의 코드 값만을 조작함으로써,

의 연산을 만족하는 z_t ^T를 찾아낼 수 있다.The selector 114 selects the component of z ^T computed for each variable i based on the substituted code value denoted by reference numeral 211 and reference numeral 212 in the modified parity check matrix H _t having the form of FIG. 2 By operation,

Lt; RTI ID = 0.0 _> ^zT < / RTI > In this regard, since the modified parity check matrix H _t is a matrix in which only the code values indicated by reference numerals 211 and 212 in the parity check matrix H are changed,

When z ^T is calculated that satisfies, in accordance with changes to the matrix ^T z components are the components of the reference numeral 211 and reference numeral 212 which includes a having a size of nx 1

By manipulating only the code values of the components affected by the operation of < RTI ID = 0.0 >

A z _t ^T satisfying the operation can be found.

In this manner, the selector 114 increases the variable i by '1' and finds z _t ^T corresponding to each variable. At the time when the hamming weight of z _t ^T is detected to be equal to or less than the predetermined hamming weight w , to select a z _t ^T and then finding stop operation and at the same time select the variable i at the corresponding time point in signing variable i _s calculated in response to the signing variable i _s z _t ^T a signature error vector z _s ^T have.

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성한다.Thereafter, the digital signature unit 115 multiplies the left side of the signature error vector z _s ^T by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m.

및 상기 서명용 변수 i_s를 전송할 수 있다.The digital signature transmission unit 116 transmits the plaintext message m and the digital signature value < RTI ID = 0.0 >

And the signature variable i _s .

In this case, according to an embodiment of the present invention, the data receiving apparatus 120 has a (nk) size of xn, which is a matrix obtained by multiplying the scrambling matrix Q, the modified parity check matrix H _t , K _pub as the verification key for the digital signature.

Here, the verification key K _pub can be expressed by Equation (11) below.

및 상기 서명용 변수 i_s가 수신되면, 데이터 수신 장치(120)는 상기 전자 서명 값

가 진정한 데이터 전송측에 의해서 전송된 데이터인지 여부를 검증하기 위해, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 검증키 K_pub와 상기 서명용 변수 i_s에 기초하여 상기 전자 서명 값

에 대한 검증을 수행할 수 있다.If the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signing variable i _s is received, the data receiving apparatus 120 transmits the digital signature value

In order to verify whether the data is the data transmitted by the true data transmission side,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Can be performed.

에 대한 검증을 수행하기 위한 구체적 구성으로, 상기 메모리 상에 상기 해시 함수 h(x)를 저장하고 있고, 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인할 수 있다.In this regard, the data receiving apparatus 120 transmits the digital signature value

Wherein the hash function h (x) is stored in the memory, and the plaintext message m and the digital signature value h

And when the signature variable i _s is received,

It is possible to confirm whether or not the hamming weight of the hamming weight is less than or equal to the predetermined hamming weight w.

을 생성하여 데이터 수신 장치(120)로 전송하였기 때문에, 데이터 수신 장치(120)에 수신된 전자 서명 값인

의 해밍 무게도 상기 선정된 해밍 무게인 w 이하가 되어야 데이터 수신 장치(120)에 정상적으로 데이터가 수신되었다고 볼 수 있을 것이다.The selection unit 114 of the digital signature apparatus 110 using the error correction scheme based on the parity check matrix selects the signature error vector z _s ^T whose Hamming weight has the predetermined Hamming weight w or less, value

And transmits the generated digital signature to the data receiving apparatus 120, the digital signature value received by the data receiving apparatus 120

The hamming weight of the received data may not be equal to or smaller than the predetermined hamming weight w.

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 먼저 확인하게 된다.Accordingly, the data receiving apparatus 120 transmits the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Whether or not the hamming weight of the hamming weight is less than or equal to the predetermined hamming weight w.

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 데이터 수신 장치(120)는 상기 평문 메시지 m을 상기 메모리 상에 저장되어 있는 상기 해시 함수 h(x)에 입력으로 인가하여 상기 제1 해시 값 h(m)을 연산할 수 있다.If the digital signature value

The data receiving apparatus 120 applies the plaintext message m as an input to the hash function h (x) stored on the memory to store the plaintext message m in the first The hash value h (m) can be calculated.

를 상기 해시 함수 h(x)에 입력으로 인가하여 검증용 해시 값인

을 연산할 수 있다.Then, the data receiving apparatus 120 obtains a result value of the bit value for the signature variable i _s by concatenating the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Can be calculated.

을 곱한 결과 값인

가 상기 검증용 해시 값인

의 전치 행렬인

와 일치하는지 비교하여 상기

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.Thereafter, the data receiving apparatus 120 transmits the verification key K _pub ,

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

을 곱한 결과 값인

은 하기의 수학식 12와 같이 나타낼 수 있다.In relation to this, the verification key K _{pub is set} to the digital signature value

Lt; RTI ID = 0.0 >

Can be expressed by Equation (12) below.

의 전치 행렬인

는 하기의 수학식 13과 같이 나타낼 수 있다.Then, the verification hash value

≪ / RTI >

Can be expressed by the following equation (13).

는 상기 서명용 변수 i_s가 패리티 검사 행렬에 기초한 오류 복원 기법을 이용하는 전자 서명 장치(110)로부터 데이터 수신 장치(120)로 위조나 변조 없이 정상적으로 수신되었다면,

와 동일한 값이 될 것이다.In Equation (13)

If the signature variable i _s has been normally received from the digital signature apparatus 110 using the error correction scheme based on the parity check matrix to the data reception apparatus 120 without forgery or modulation,

Will be the same value.

가 패리티 검사 행렬에 기초한 오류 복원 기법을 이용하는 전자 서명 장치(110)로부터 데이터 수신 장치(120)로 위조나 변조 없이 정상적으로 수신되었다면, 상기 수학식 12에 따른

와 상기 수학식 13에 따른

는 하기의 수학식 14에서 나타낸 것처럼 동일한 값이 되어야 할 것이다.Thus, the digital signature value

Is normally received from the digital signature apparatus 110 using the error correction scheme based on the parity check matrix without any falsification or modulation in the data reception apparatus 120,

And the equation

Lt; RTI ID = 0.0 > (14) < / RTI >

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.Therefore, the data receiving apparatus 120 receives

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

3 is a flowchart illustrating an electronic signature method using an error recovery technique based on a parity check matrix according to an embodiment of the present invention.

In step S310, a scrambling matrix of size (nk) x (nk) including the code value of the parity check matrix H, '1' and '0' for the (nk) Q and a permutation matrix P of size nxn containing '1' and '0' code values as components.

Where n and k are natural numbers and n is a number greater than k.

In step S320, the plaintext message m to be transmitted to the data receiving apparatus is input to the selected hash function h (x) to calculate the first hash value h (m).

The hash function h (x) is a one-way function that transforms the input value into an output value of (n-k) bits in size.

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i(

임)를 생성한다.In step S330, when the calculation of the first hash value h (m) is completed, the variable i (the variable i is an integer equal to or greater than 0) is increased from '0' to '1' The result obtained by concatenating the bit values of the variable i with h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to generate a syndrome message s _i (

.

(z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐)를 만족하는 z^T를 연산한 후 z^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 연산되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 연산된 z^T를 서명용 오류 벡터 z_s ^T로 선택한다.Step (S340) In as the variable i is increased by "0", starting by '1', the syndrome message s _i is each time created, the parity check matrix for the syndrome message s _i for each variable i H To perform complete decoding based on

(z ^T is a transpose matrix of vector z with size n), z ^T is computed to satisfy the following equation: z ^{T =} i is selected as the signature variable i _s , and at the same time, z ^T calculated corresponding to the signing variable i _s is selected as the signature error vector z _s ^T.

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성한다.In step S350, the left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m.

및 상기 서명용 변수 i_s를 전송한다.In step S360, the plain text message m and the digital signature value < RTI ID = 0.0 >

And the signature variable i _s .

임)를 전자 서명에 대한 검증키로 저장하고 있고, 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 검증키 K_pub와 상기 서명용 변수 i_s에 기초하여 상기 전자 서명 값

에 대한 검증을 수행할 수 있다.In this case, according to an embodiment of the present invention, the data reception apparatus may further include: K _pub ((nk)) having a size of (nk) xn, which is a matrix obtained by multiplying the scrambling matrix Q by the parity check matrix H and the permutation matrix P,

) As a verification key for an electronic signature, and the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Can be performed.

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 평문 메시지 m을 상기 메모리 상에 저장되어 있는 상기 해시 함수 h(x)에 입력으로 인가하여 상기 제1 해시 값 h(m)을 연산하고, 상기 제1 해시 값 h(m)이 연산되면, 상기 제1 해시 값 h(m)에 상기 서명용 변수 i_s에 대한 비트 값을 연접한 결과 값

를 상기 해시 함수 h(x)에 입력으로 인가하여 검증용 해시 값인

을 연산하며, 상기 검증키 K_pub에 상기 전자 서명 값

을 곱한 결과 값인

가 상기 검증용 해시 값인

의 전치 행렬인

와 일치하는지 비교하여 상기

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.In this case, according to an embodiment of the present invention, the data receiving apparatus further stores the hash function h (x) on the memory, and the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w (M) is a result of concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

To the verification key K _pub ,

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

4 is a flowchart illustrating an electronic signature method using an error recovery technique based on a parity check matrix according to another embodiment of the present invention.

In step S410, a parity check matrix H for a (nk) xn-sized linear code composed of RM codes, components located in a plurality of selected first rows in the parity check matrix H are replaced with random code values, (Nk) x (nk) including the code values of the modified parity check matrix H _t , '1' and '0' whose components located in a plurality of selected second columns are replaced with code values of '0' Size scrambling matrix Q and a permutation matrix P of size nxn including the code values of '1' and '0' as components.

Where n and k are natural numbers and n is a number greater than k.

In step S420, the plaintext message m to be transmitted to the data receiving apparatus is input to the selected hash function h (x) to calculate the first hash value h (m).

The hash function h (x) is a one-way function that transforms the input value into an output value of (n-k) bits in size.

를 상기 해시 함수 h(x)에 입력으로 인가하여 제2 해시 값인

을 연산하고, 상기 제2 해시 값인

의 전치 행렬인

의 좌측 변에 상기 스크램블링 행렬 Q의 역행렬인 Q^-1을 곱하여 신드롬 메시지 s_i(

임)를 생성한다.In step S430, when the calculation of the first hash value h (m) is completed, the variable i (the variable i is an integer equal to or greater than 0) is increased from 0 to 1 and the first hash value h The result obtained by concatenating the bit values of the variable i with h (m)

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to generate a syndrome message s _i (

.

(z^T는 크기가 n인 벡터 z의 전치 행렬로 n x 1의 크기를 가짐)를 만족하는 z^T를 연산하고, 상기 변형 패리티 검사 행렬 H_t에서 상기 복수의 선정된 제1 행들과 상기 복수의 선정된 제2 열들에 위치하는 코드 값에 기초하여 각 변수 i마다 연산되는 z^T의 성분을 조작함으로써,

를 만족하는 z_t ^T를 검출한 후 z_t ^T의 해밍 무게가 선정된 해밍 무게인 w 이하로 검출되는 시점에서의 변수 i를 서명용 변수 i_s로 선택함과 동시에 상기 서명용 변수 i_s에 대응하여 검출된 z_t ^T를 서명용 오류 벡터 z_s ^T로 선택한다.Step (S440) In as the variable i is increased by "0", starting by '1', the syndrome message s _i is each time created, the parity check matrix for the syndrome message s _i for each variable i H To perform complete decoding based on

(where z ^T is a transposed matrix of a vector z of size n, and has a size of nx 1), and calculates z ^T in the transformed parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

And then detecting the z _t ^T satisfying the variable i at the time is detected more than the Hamming weight of the Hamming weight of z _t ^T selection w and at the same time select a signature variable i _s corresponding to the signing variable i _s It selects the detected z _t ^T to the signature error vector z _s ^T.

를 연산함으로써, 상기 연산된

을 상기 평문 메시지 m에 대한 전자 서명 값으로 생성한다.In step S450, the left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As a digital signature value for the plaintext message m.

및 상기 서명용 변수 i_s를 전송한다.In step S460, the plaintext message m and the digital signature value < RTI ID = 0.0 >

And the signature variable i _s .

임)를 전자 서명에 대한 검증키로 저장하고 있고, 상기 평문 메시지 m과 상기 전자 서명 값

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 검증키 K_pub와 상기 서명용 변수 i_s에 기초하여 상기 전자 서명 값

에 대한 검증을 수행할 수 있다.According to an embodiment of the present invention, the data receiving apparatus includes a memory for storing K _pub (k) having a size of (nk) xn, which is a matrix obtained by multiplying the scrambling matrix Q by the modified parity check matrix H _t and the permuted matrix P, (

) As a verification key for an electronic signature, and the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Can be performed.

및 상기 서명용 변수 i_s가 수신되면, 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인지 여부를 확인한 후 상기 전자 서명 값

의 해밍 무게가 상기 선정된 해밍 무게인 w 이하인 것으로 확인되면, 상기 평문 메시지 m을 상기 메모리 상에 저장되어 있는 상기 해시 함수 h(x)에 입력으로 인가하여 상기 제1 해시 값 h(m)을 연산하고, 상기 제1 해시 값 h(m)이 연산되면, 상기 제1 해시 값 h(m)에 상기 서명용 변수 i_s에 대한 비트 값을 연접한 결과 값

를 상기 해시 함수 h(x)에 입력으로 인가하여 검증용 해시 값인

을 연산하며, 상기 검증키 K_pub에 상기 전자 서명 값

을 곱한 결과 값인

가 상기 검증용 해시 값인

의 전치 행렬인

와 일치하는지 비교하여 상기

가 상기 검증용 해시 값

의 전치 행렬인

와 일치하는 것으로 판단되면, 상기 전자 서명 값

에 대한 검증을 성공으로 판단할 수 있다.In this case, according to an embodiment of the present invention, the data receiving apparatus further stores the hash function h (x) on the memory, and the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w (M) is a result of concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

To the verification key K _pub ,

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Can be judged to be successful.

An electronic signature method using an error recovery method based on a parity check matrix according to an embodiment of the present invention can be implemented by a computer program stored in a storage medium for execution through a combination with a computer.

In addition, an electronic signature method using an error recovery method based on a parity check matrix according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: Digital signature device using error recovery technique based on parity check matrix
111: Private key storage unit 112: First hash value operation unit
113: Syndrome message generation unit 114:
115: digital signature section 116: digital signature transmission section
120: Data receiving device

Claims (14)

The code of the parity check matrix H, '1' and '0' for (nk) xn - n and k composed of Reed - Muller (RM) codes is a natural number and n is a linear - A private key storage unit storing a scrambling matrix Q of size (nk) x (nk) including a value as an element and a permutation matrix P of nxn size including a code value of '1' and '0' as an element;
A plaintext message m to be transmitted to the data receiving apparatus is a predetermined hash function h (x) - the hash function h (x) is a one-way function for converting an input value into an output value of (nk) To calculate a first hash value h (m);
When the calculation of the first hash value h (m) is completed, the first hash value h (m) is incremented by 1 from the variable i - the variable i is an integer equal to or greater than 0 A result obtained by concatenating the bit values of the variable i

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

A syndrome message generating unit for generating a syndrome message;
Each time as the variable i to "0" to start increasing by "1" is the syndrome message s _i to be generated, full decoding on the basis of the parity check matrix H for the syndrome message s _i for each variable i (Complete Decoding)

- z ^T is a transpose of a vector z of size n and has a size of nx 1 - then computes z ^T , and then the Hamming Weight of z ^T is calculated to be less than or equal to the selected Hamming weight w Selecting a variable i at a time point as a signing variable i _s and selecting z ^T computed corresponding to the signing variable i _s as a signing error vector z _s ^T ;
The left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As an electronic signature value for the plaintext message m; And
The plaintext message m and the digital signature value < RTI ID = 0.0 >

And a transmission unit for transmitting the digital signature for signing the variable i _s
And an error recovery method based on a parity check matrix including the parity check matrix. The method according to claim 1,
The data receiving apparatus
K _pub having a matrix made of (nk) xn sizes the scrambling matrix Q and the parity check matrix H and the permutation matrix P is multiplied on the memory -

, And stores the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Based on a parity check matrix for performing a verification on a parity check matrix. 3. The method of claim 2,
The data receiving apparatus
Further storing the hash function h (x) on the memory, wherein the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w And,
When the first hash value h (m) is calculated, a result value obtained by concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Lt; / RTI >
The verification key K _pub may include the digital signature value

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Based on a parity check matrix for judging that the verification of the parity check matrix is successful. (Nk) xn-n and k composed of Reed-Muller (RM) codes are natural numbers and n is a parity check matrix H for a linear code having a magnitude larger than k, The modified parity check matrix H _t , '1' in which the components located in predetermined first rows are replaced with a random code value and the components located in a plurality of the selected second columns are replaced with code values of '0' (Nk) x (nk) sized scrambling matrix Q including code values of '0' and '0' as components and a permutation matrix P of size nxn containing the code values of '1' and '0' A private key storage unit;
The plaintext message m to be transmitted to the data receiving device is selected as a hash function h (x) - the hash function h (x) is input as an input to convert the input value into an output value of (nk) A first hash value calculator for calculating a first hash value h (m);
When the calculation of the first hash value h (m) is completed, the first hash value h (m) is incremented by 1 from the variable i - the variable i is an integer equal to or greater than 0 A result obtained by concatenating the bit values of the variable i

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

A syndrome message generating unit for generating a syndrome message;
Each time as the variable i to "0" to start increasing by "1" is the syndrome message s _i to be generated, full decoding on the basis of the parity check matrix H for the syndrome message s _i for each variable i (Complete Decoding)

- z ^T is a transpose of a vector z of size n and has a size of nx 1, and calculates z ^T in the modified parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

Z _t ^T detected then z _t ^T of the Hamming weight (Hamming Weight) the selection of a variable i at the time point is detected as a w less than the Hamming weight and at the same time select a i _s signature variable the signing variable satisfying i in response to the detected signature _{s t} z ^T error vector selection unit for selecting a z _s ^T;
The left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As an electronic signature value for the plaintext message m; And
The plaintext message m and the digital signature value < RTI ID = 0.0 >

And a transmission unit for transmitting the digital signature for signing the variable i _s
And an error recovery method based on a parity check matrix including the parity check matrix. 5. The method of claim 4,
The data receiving apparatus
The scrambling matrix in a memory Q with the modified parity check matrix H _t K _pub and having a matrix of (nk) xn size made the permutation matrix P is multiplied -

, And stores the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Based on a parity check matrix for performing a verification on a parity check matrix. 6. The method of claim 5,
The data receiving apparatus
Further storing the hash function h (x) on the memory, wherein the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w And,
When the first hash value h (m) is calculated, a result value obtained by concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Lt; / RTI >
The verification key K _pub may include the digital signature value

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Based on a parity check matrix for judging that the verification of the parity check matrix is successful. The code of the parity check matrix H, '1' and '0' for (nk) xn - n and k composed of Reed - Muller (RM) codes is a natural number and n is a linear - (Nk) size scrambling matrix Q containing (nk) x (nk) values as elements and a permutation matrix P of size nxn containing the code values of '1' and '0'step;
A plaintext message m to be transmitted to the data receiving apparatus is a predetermined hash function h (x) - the hash function h (x) is a one-way function for converting an input value into an output value of (nk) To calculate a first hash value h (m);
When the calculation of the first hash value h (m) is completed, the first hash value h (m) is incremented by 1 from the variable i - the variable i is an integer equal to or greater than 0 A result obtained by concatenating the bit values of the variable i

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

Generating an impulse;
Each time as the variable i to "0" to start increasing by "1" is the syndrome message s _i to be generated, full decoding on the basis of the parity check matrix H for the syndrome message s _i for each variable i (Complete Decoding)

- z ^T is a transpose of a vector z of size n and has a size of nx 1 - then computes z ^T , and then the Hamming Weight of z ^T is calculated to be less than or equal to the selected Hamming weight w Selecting a variable i at a time point as a signing variable i _s and simultaneously selecting z ^T computed corresponding to the signing variable i _s as a signing error vector z _s ^T ;
The left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As an electronic signature value for the plaintext message m; And
The plaintext message m and the digital signature value < RTI ID = 0.0 >

And transmitting the signature variable i _s
And an error recovery method based on a parity check matrix including the parity check matrix. 8. The method of claim 7,
The data receiving apparatus
K _pub having a matrix made of (nk) xn sizes the scrambling matrix Q and the parity check matrix H and the permutation matrix P is multiplied on the memory -

, And stores the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Based on a parity check matrix for performing a verification on the parity check matrix. 9. The method of claim 8,
The data receiving apparatus
Further storing the hash function h (x) on the memory, wherein the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w And,
When the first hash value h (m) is calculated, a result value obtained by concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Lt; / RTI >
The verification key K _pub may include the digital signature value

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Based on a parity check matrix for determining that the verification of the digital signature is successful. (Nk) xn-n and k composed of Reed-Muller (RM) codes are natural numbers and n is a parity check matrix H for a linear code having a magnitude larger than k, The modified parity check matrix H _t , '1' in which the components located in predetermined first rows are replaced with a random code value and the components located in a plurality of the selected second columns are replaced with code values of '0' (Nk) x (nk) sized scrambling matrix Q including code values of '0' and '0' as components and a permutation matrix P of size nxn containing the code values of '1' and '0' Maintaining a private key store;
The plaintext message m to be transmitted to the data receiving device is selected as a hash function h (x) - the hash function h (x) is input as an input to convert the input value into an output value of (nk) Computing a first hash value h (m);
When the calculation of the first hash value h (m) is completed, the first hash value h (m) is incremented by 1 from the variable i - the variable i is an integer equal to or greater than 0 A result obtained by concatenating the bit values of the variable i

Is applied as input to the hash function h (x) to obtain a second hash value < RTI ID = 0.0 >

, And the second hash value

≪ / RTI >

The left side of the scrambling matrix Q is multiplied by the inverse matrix Q ^-1 of the scrambling matrix Q to obtain a syndrome message s _i -

Generating an impulse;
Each time as the variable i to "0" to start increasing by "1" is the syndrome message s _i to be generated, full decoding on the basis of the parity check matrix H for the syndrome message s _i for each variable i (Complete Decoding)

- z ^T is a transpose of a vector z of size n and has a size of nx 1, and calculates z ^T in the modified parity check matrix H _t by multiplying the plurality of selected first rows and the plurality By manipulating the components of z ^T computed for each variable i based on the code values located in the selected second columns,

Z _t ^T detected then z _t ^T of the Hamming weight (Hamming Weight) the selection of a variable i at the time point is detected as a w less than the Hamming weight and at the same time select a i _s signature variable the signing variable satisfying i in response to the detected signature _{s t} z ^T error vector selecting a z _s ^T;
The left side of the signature error vector z _s ^T is multiplied by the inverse matrix P ^-1 of the permutation matrix P

, Thereby calculating

As an electronic signature value for the plaintext message m; And
The plaintext message m and the digital signature value < RTI ID = 0.0 >

And transmitting the signature variable i _s
And an error recovery method based on a parity check matrix including the parity check matrix. 11. The method of claim 10,
The data receiving apparatus
The scrambling matrix in a memory Q with the modified parity check matrix H _t K _pub and having a matrix of (nk) xn size made the permutation matrix P is multiplied -

, And stores the plaintext message m and the digital signature value < RTI ID = 0.0 >

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

If the confirmed to be not more than the Hamming weight w The selection of a Hamming weight, based on the verification key K _pub and the variable i for signing the electronic signature value _s

Based on a parity check matrix for performing a verification on the parity check matrix. 12. The method of claim 11,
The data receiving apparatus
Further storing the hash function h (x) on the memory, wherein the plaintext message m and the digital signature value

And when the signature variable i _s is received,

Of the hamming weight is less than or equal to the predetermined hamming weight w,

(M) is input as the input to the hash function h (x) stored on the memory, if it is determined that the hamming weight of the plaintext message m is equal to or less than the predetermined Hamming weight w And,
When the first hash value h (m) is calculated, a result value obtained by concatenating the bit value for the signature variable i _s with the first hash value h (m)

Is input to the hash function h (x) to generate a hash value for verification

Lt; / RTI >
The verification key K _pub may include the digital signature value

Lt; RTI ID = 0.0 >

Is the verification hash value

≪ / RTI >

And then,

The verification hash value

≪ / RTI >

The digital signature value < RTI ID = 0.0 >

Based on a parity check matrix for determining that the verification of the digital signature is successful. A computer-readable recording medium storing a program for causing a computer to perform the method according to any one of claims 7 to 12. 13. A computer program stored in a storage medium for executing the method of any one of claims 7 to 12 through a combination with a computer.

Images