EP3899844A1

EP3899844A1 - Method for generating a blind signature

Info

Publication number: EP3899844A1
Application number: EP19824235.6A
Authority: EP
Inventors: Tilo FRITZHANNS; Florian Gawlas
Original assignee: Giesecke and Devrient GmbH
Current assignee: Giesecke and Devrient Advance52 GmbH
Priority date: 2018-12-18
Filing date: 2019-12-09
Publication date: 2021-10-27
Also published as: WO2020126078A1; DE102018009943A1

Abstract

The invention relates to a method for generating a blind signature for an electronic coin dataset, eMD, having the steps of: obtaining an unsigned blinded eMD from a participant by a signature issuer; expanding the unsigned blinded eMD with issuer information by means of the signature issuer in order to obtain an expanded unsigned eMD; signing the expanded unsigned eMD using an issuer-generated random number and a secret key of the signature issuer in order to obtain an expanded signed blinded eMD; and transmitting the expanded signed blinded eMD and the issuer information to the participant. The invention also relates to a method for checking the generated and/or obtained blind signature. The invention also relates to a payment system for transmitting an electronic coin dataset between at least two participants.

Description

METHOD FOR RR WEARING A BLIND SIGNATURE

TECHNICAL FIELD OF THE INVENTION

The invention relates to a method for generating a blind signature for an electronic coin data record, eMD. The invention also relates to a method for obtaining a blind signature in a subscriber. The invention also relates to a method for deriving a partial monetary amount from an already blindly signed eMD by a subscriber. The invention also relates to several methods for checking the blind signature generated / obtained. Furthermore, the invention relates to a payment system for transmitting an electronic coin data record between at least two participants.

TECHNICAL BACKGROUND OF THE INVENTION

The "DigiCash" process is available for the anonymous exchange of electronic coin data records based on so-called blind signatures. A principle that is similar to the "DigiCash" process with blind signatures is shown in Fig.l.

Blind digital signatures can be generated, for example, using an elliptic curve digital signature algorithm, ECDSA, a variant of the digital signature algorithm, DSA, in which elliptic curve cryptography is used. An ECDSA is shown for example in Fig.2.

None of the known concepts enables a duplication of the monetary amount (coin denomination) of the signed digital coin. This means that, for example, if a coin data record has a monetary amount of € 1, then for payment of a monetary amount of € 100, one is forced to send and have one hundred generated electronic coin data records verified. This makes verification more difficult and increases the amount of data for transferring large amounts of money.

None of the known concepts enables the monetary amount (= coin denomination) of the signed digital coin to be divided. This means that if a coin data set has a monetary amount of € 1, then it is not possible to pay a fraction of this monetary amount, for example € 0.50 or a mixed fraction, for example € 1.50. Sometimes these concepts prevent appropriate payment. These known concepts also do not provide for a change in payment, for example if a participant compares an amount to be paid with a larger coin value, the paid person cannot generate and send a monetary amount in the form of change or change based on the eMD received. This makes the previous concepts unattractive and inflexible.

In addition, the known concepts are non-transparent for an inspection body and only the authenticity of a signature can be checked without being sure whether a participant has manipulated the eMD. In fact, blind signatures are not accepted in many sales outlets due to this lack of transparency.

It is therefore an object of the present invention to provide a method and a system in which it can be transparently checked whether a signature issuer of a blind signature actually signed an eMD. In addition, the monetary amount (coin value) of a signed eMD should be easily divisible without a blind signature losing its invalidity. The aim is to create a direct exchange between participants and the corresponding end devices, which is uncomplicated and fast. A participant should also be able to return appropriate change (change) in the form of an eMD shared by the received eMD. The procedure is intended to remain non-transparent for a third party in order to guarantee anonymous payment.

SUMMARY OF THE INVENTION

The object is achieved with the features of the independent claims 25. Further advantageous embodiments are described in the respective dependent Pa claims.

The object is achieved in particular by a method for generating a blind signature for an electronic coin data record, eMD. The method comprises the following steps: Receiving an unsigned, blinded eMD from a subscriber at a signature publisher; Expanding the unsigned, blinded eMD with a publisher information by the signature publisher to obtain an expanded unsigned eMD; Signing the expanded unsigned eMD using a publisher-generated random number 35 and a secret key of the signature publisher to obtain an expanded signed veneered eMD; and sending the expanded signed hidden eMD and the publisher information to the subscriber, the sent publisher information being part of the blind signature. With the (digital) blind signature process, it is possible to remain anonymous as the owner of an eMD, so that payment transactions that a participant makes cannot be verified by the signature issuer or a verifier. Accordingly, the signature issuer does not know the eMD because he only receives a blinded eMD. A delusion is understood to mean, for example, an addition or subtraction of the eMD with an integer random number generated by the subscriber. It is therefore not possible to draw any conclusions about the participant if they own the blinded unsigned eMD.

According to the invention, the publisher adds information to the signature, also referred to as a release message. As a result of the expansion according to the invention, this publisher information becomes an invariable part of the blind signature of the eMD. This publisher information - as well as the signed, blinded eMD - is made available to the participant, for example in plain text. Any unmanipulable information from a publisher is regarded as publisher information. The publisher information is independent and therefore not dependent on the eMD or the participant. Independent information is therefore independent information that is not dependent on other entities.

In this way, when the signature is checked later, it can be ascertained whether this sent publisher information matches the publisher information located in the signature or has been changed as part of a manipulation attempt. The blind signature generated with this method enables every participant in the payment system to verify the authorship of the signature via a blinded eMD. The publisher information thus serves in a checking step to verify the part of the signature that was formed by the publisher information more thoroughly. The publisher information is not secret and can be transmitted as plain text information in the sending step, for example.

The publisher information is preferably provided as independent information, regardless of the signed hidden eMD. This independent provision ensures that the publisher information and the eMD are completely separate information and were originally generated by different instances. While the eMD can be generated by the subscriber himself, the publisher information is from the (trustworthy) signal. tur publisher has been generated. In this way, anonymity in the payment system is preserved, on the one hand, and additional information independent of eMD is also signed by this publisher information. It is also conceivable that the publisher information is made available directly to a test body in an examination procedure.

The publisher information used to expand the unsigned, blinded eMD is preferably the result of a scatter value function (hash function) with a publisher value, the publisher value being sent as the publisher information.

A scatter value function (also hash function) is a mapping that maps a large input quantity (for example the publisher value or secret key) to a smaller target quantity (the hash values, for example the publisher information). A hash function is therefore generally not injective. The input quantity can contain elements of different lengths, whereas the elements of the target quantity usually have a fixed length. In this way, the signature can be reduced in size without reducing the level of security. The scatter value function is preferably a scatter value function that is fundamentally agreed in the signing method, for example when using an ECDSA, in which, in addition to the curve parameters, the scatter value function to be selected is also specified. By using a hash value as publisher information instead of the publisher value itself, security is further increased and manipulation is made more difficult. In addition, the amount of data to be sent consisting of publisher information and signed, blinded eMD is minimized. This is advantageous for example in M2M applications.

The publisher value can be at least one of the following values: a time value, for example a time stamp or a date; identification of the publisher, for example an ID, serial number, contract number; and / or an identifier of the publisher in the signing process; and / or a value generated by the publisher, for example a random number or an otherwise generated date. The publisher's value is preferably transmitted in plain text and placed as a hash value in the blind signature. If you are in possession of the publisher's information, you can check whether the blind signature is correct and verify the authenticity of the blind signature in an improved way by calculating the value again. The generation of the blind signature is preferably based on a standard for digital signatures, for example the digital signature algorithm, or DSA for short. The DSA is based on the discrete logarithm in finite fields. As with all signature methods that are based on the discrete logarithm, in particular for methods based on elliptic curves, security depends essentially on the properties of the random number used by the signature issuer.

A random value must be generated by the signature publisher for each signature. This must have sufficient entropy, be kept secret and may only be used once in the system. These requirements are critical, because if the random number is known, the signature issuer's key can be calculated from the signature. If the random number has a low entropy, an attacker can calculate a secret key for every possible random number and then use the public verification key to test which one is the right one.

The eMD is preferably the result of a scatter value function from a subscriber-generated serial number and a subscriber-calculated point of an elliptic curve. A variant of a digital signature algorithm, or DSA for short, namely an elliptic curve cryptography, ECDSA, is therefore used. The transmission of the DSA on elliptic curves is standardized in ANSI X9.62. This enables a high level of security with a minimal key length. The principle of the ECDSA is explained in Fig.2. The DSA is an exemplary standard for digital signatures. Other algorithms, for example an asymmetric cryptographic method, RSA, can also be used for digital signing. RSA uses a key pair consisting of a private key (the secret), which is used to decrypt or sign data, and a public key, which is used to encrypt or check signatures. The private key is kept secret and can only be calculated from the public key with a great deal of computing effort.

The eMD is preferably the result of a scatter value function consisting of a subscriber-generated public key and a subscriber-calculated point of an elliptic curve, the subscriber-generated public key being derived from the subscriber-generated serial number. The parties involved have checked the respective curve parameters prior to the signing process. agrees. In this embodiment, the subscriber-generated serial number remains with the subscriber as a secret (i.e. a private key) and the signature issuer is provided with a public key derived from the serial number. For example, this public key is generated on the subscriber side by linking the serial number to a base point of the elliptic curve, for example a logical link or a simple mathematical operation, for example multiplication. In this way, parts of a monetary amount of an eMD can also be transferred from one subscriber to another subscriber, which will be explained later. The signature is created over the entire monetary amount of the eMD; a second participant does not automatically have the right to own the entire amount after transmitting the eMD, since knowledge of the participant-generated serial number remains hidden if only partial amounts are to be transferred.

According to the invention, a method for checking a blind signature of an eMD is now also provided, the blind signature being generated in accordance with the previous method. To verify the signature, the unsigned, unblended (unblended) eMD and a serial number used to generate the eMD and a signed unblanked (unblended) eMD and the publisher information are obtained. This means that the full monetary amount of the eMD can be checked and, if the check is successful, it changes hands based on knowledge of the (secret) serial number. In contrast to the previous verification of blindly signed eMD, the eMD is now calculated using the received serial number, the signed unblended eMD, the publisher information and a public key of the signature publisher. Since the publisher information is also an invariable part of the blind signature, the blind signature can now be checked for correctness of the publisher information by receiving the (plain text) publisher information. The calculated eMD is compared with the received eMD and the authenticity of the blind signature is verified if the calculated eMD matches the received eMD.

The eMD obtained is preferably the result of a scatter value function from a combination of a subscriber-generated serial number with a base point and a subscriber-calculated point of an elliptical curve, a subscriber-generated public key being derived from the subscriber-generated serial number before the eMD is calculated. In this configuration, the blind signature of the eMD with the participant-generated public key instead of the participant-generated serial number. For example, this public key is generated on the subscriber side in that the serial number is linked to a base point of the elliptic curve, for example by a logical link or a simple mathematical operation, for example by multiplication. In this way, according to the invention, parts of a monetary amount of an eMD can also be transferred from one subscriber to another subscriber, which will be explained later. The blind signature is nevertheless created over the entire monetary amount of the eMD. The subscriber-generated public key must then be provided to verify the authenticity of the eMD.

In the eMD described so far, a monetary amount (= maximum amount of the eMD) is linked to the subscriber-generated serial number, that is, the blind signature of the publisher is valid for the total amount of the monetary amount. So far, this has prevented parts of the total monetary amount from eMD from being sent, since the signature check for partial amounts is invalid. In addition, the verification also transmits the serial number (the secret) of the eMD and if it is successfully verified, the secret is vented and the monetary amount can be redeemed - similar to DigiCash. Now it is often desirable to share the eMD and only hand over partial amounts of the signed eMD.

According to the invention, a method for checking a blind signature of an eMD is now provided for this purpose, the blind signature likewise being generated according to the previously described method. The eMD is received; a subscriber-generated public key used to generate the eMD; a signed unblended eMD; a monetary portion of the eMD; a (real) signature via a link between the monetary component and another participant-generated public key; the subscriber-generated secret; and the publisher information.

The monetary amount is a fraction of the total monetary amount associated with the eMD. This monetary partial amount can take on any value, it can be out of round and / or it can be the change in a payment process. In the process, the subscriber-generated serial number (the secret) is now intentionally not transmitted for checking in order to prevent the entire amount of the eMD from being redeemed. In contrast, a new (further) secret is generated on the subscriber side, which is based on the subscriber generated serial number is different. This subscriber-generated secret is transmitted for checking instead of the subscriber-generated serial number. In addition, another public key on the subscriber side is derived from this secret. This derivation is, for example, a mathematical operation or a logical combination of the subscriber-generated secret with a base point (generator point) or an alternative agreed value.

In the checking process, after the receiving step, the further public key is calculated from the subscriber-generated secret received. The agreed value, for example a base point, is used for this. In addition, the signature is calculated from the combination of the monetary partial amount and the calculated further public key. Thus, the (real) Sig can be calculated naturally and can be compared with the (real) signature received. The partial amount is authentically signed here, that is, without additional blinding, since otherwise a recipient of the partial amount cannot verify the authenticity and the correct derivation.

In the subsequent checking process, a comparison is then made between the calculated real signature and the received real signature and thus verification of the possession of the partial amount in money. In this way, the authenticity of the received real signature can be checked and it is ensured that the participant-generated secret was actually generated by the participant. The partial amount is therefore valid.

Finally, the eMD is calculated using the subscriber-generated public key, the signed uncovered eMD, the publisher information and a public key of the signature publisher. Finally, the calculated eMD is compared with the received eMD and the authenticity of the blind signature is verified if the calculated eMD matches the received eMD. During this calculation and verification, the participant-generated serial number of the eMD cannot be concluded, so that the blind signature can be checked, but the full monetary amount of the eMD cannot be decrypted. Only the partial amount confirmed with the real signature can be transferred in this way and used by the recipient (participant, inspection body). The verification is preferably carried out by the signature publisher or by a test body different from the signature issuer. This can be seen as a major advantage of the method, because the participant is now not forced to have his eMD checked by the signature issuer, which means less conclusions can be drawn about the payment behavior of a participant and anonymity is increased.

The publisher information is preferably also verified during the checking. In this way it can be determined whether the publisher information in the eMD has been changed and a manipulation attempt has been made.

The blind signature was preferably generated with an ECDSA, with the curve parameters of the elliptical curve agreed in the ECDSA being provided for checking the blind signature.

In another aspect of the invention, a payment system for transmitting an electronic coin data record between at least two participants comprises a first participant for generating an unsigned, blinded eMD; a signature issuer for generating a blind signature according to the previously described method and a second subscriber for receiving the generated eMD, a signed unblended eMD and a serial number used for generating the eMD.

In a preferred embodiment, the second participant checks the received generated eMD, the signed unblended eMD and the serial number used to generate the eMD using the previously described checking method.

The eMD is preferably the result of a scatter value function from a link between a subscriber-generated public key and a subscriber-calculated point. The subscriber-generated public key is derived from the subscriber-generated serial number. In this way, the participant-generated serial number is not sent, but a public key derived from it, which enables an eMD to be split.

In one aspect of the invention, the object is achieved by a method for obtaining a blind signature for an electronic coin data record, eMD, in a subscriber. This process comprises the process steps: gene of a public key from a subscriber-generated serial number by the subscriber; Generating an eMD using the generated public key by the subscriber; Blending the generated eMD to obtain a blended unsigned eMD by the participant; Sending the blinded unsigned eMD from the subscriber to a signature publisher; The subscriber receiving a signed, blinded eMD from the signature publisher; and removing the bezel to obtain a signed unblanked eMD by the subscriber. The subscriber-side generation of the public key from a subscriber-generated serial number by the subscriber has already been explained several times. A value already agreed in the procedure between the participants, the signature issuer and / or the testing authority is used. For example, the value is a base point of the elliptic curve. This agreed value is logically linked to the subscriber-generated serial number, for example via a logical link, such as AND; OR; XOR; NAND; NOR, or via a simple mathematical operation, for example a multiplication or an addition. The step of generating the eMD preferably comprises the steps of: calculating a point of an elliptical curve using agreed curve parameters; Linking the calculated point with the generated public key; Calculate a scatter value function from the combination of the calculated point and the generated public key, the result of the scatter value function being the eMD.

The derived public key is now used to obtain the blind signature instead of the subscriber-generated serial number. This subscriber-generated serial number is therefore secret for the signature publisher and remains secret.

This method makes it possible that the eMD does not have to be transferred between participants with its full monetary amount (maximum amount of the eMD), but that any partial amounts can also be derived and transferred from the full monetary amount.

In a preferred embodiment, the signed, blinded eMD obtained is a signed, blinded eMD that is expanded with a publisher's information. It is In particular, the publisher information used to expand the unsigned, blinded eMD is the result of a scatter value function with a publisher, the publisher value being sent as the publisher information and being part of the blind signature. The publisher value is preferably a time value, an identification of the publisher and / or a publisher-generated value.

In a preferred embodiment, the publisher information is obtained together with the expanded, signed, blinded eMD, with the publisher information preferably being provided as independent information, independently of the signed, blinded eMD.

This publisher information and the corresponding expansion of the signed, blended eMD have already been described in detail above. Reference is expressly made to this description. The publisher information thus serves to make the blind signing more transparent by (non-manipulable, non-manipulable, non-secret publisher information from the participant) becoming part of the blinking signature and can be checked.

In a preferred embodiment, a method is provided for deriving a monetary partial amount of a signed, blinded eMD in a subscriber. The eMD is preserved according to the procedure described above. This deriving method comprises the steps: generation by the subscriber of a subscriber-generated secret and a further public key from the subscriber-generated secret; Determination of a partial monetary amount of the eMD; and calculating a signature via a link from the monetary partial amount and the further public key.

The partial amount can be determined arbitrarily. It can be the change in a payment transaction or it can be any value.

The subscriber-generated secret is different from the subscriber-generated serial number and is used instead of the serial number to transfer monetary amounts between subscribers. In this case, only a partial amount can advantageously be transferred instead of the full monetary amount of the eMD. With this derivation, an already blindly signed eMD is set up for the transfer of monetary partial amounts. The generation of the subscriber-generated secret can be done by a first subscriber if he wants to divide a partial amount from the total amount. This generation is preferably carried out by a further subscriber who has not generated the subscriber-generated serial number. This means that a partial amount can also be divided by any other participant who has acquired the eMD legit. In this way, eMDs can be shared, but the blind signature of the eMD remains valid. In addition, payment processes using eMD can now be enabled, in which the eMD recipient (paid) can send back a compartmentalized eMD, for example comparable to change or change in cash transactions or as part of a discount campaign.

The further public key is preferably a link between a base point of the elliptic curve and the subscriber-generated secret. This linkage is, for example, a logical linkage or a simple mathematical operation, as a result of which the computation effort is minimized without endangering the security and manipulation resistance of the method. As an alternative to the base point, another agreed value can be used.

In a preferred embodiment, the derivation further comprises generating a second subscriber-generated secret and a second further public key from the second subscriber-generated secret by the subscriber or another subscriber; Determination of a second monetary partial amount of the eMD, the second monetary partial amount being smaller than the monetary partial amount and calculation of a second signature by linking the monetary partial amount and the second further public key.

The second subscriber-generated secret can be generated by the first subscriber if he would like to further split a partial amount. This generation is preferably carried out by a subscriber who has not generated the (first) subscriber-generated secret. This means that the partial amount can also be shared by any other participant. In this way, eMDs can be shared several times, although the blind signature remains valid. In addition, payment processes using eMD can now be enabled, in which the eMD recipient (paid) can send back a shared eMD, for example comparable to change or change in cash transactions or as part of a discount campaign. The second partial amount can be set as desired, i.e. it can be any value less than the (first) partial amount. The second further public key is preferably a link between a base point of the elliptic curve and the second subscriber-generated secret. This link is, for example, a logical link or a simple mathematical operation, as a result of which the computation effort is minimized without endangering the security and manipulation resistance of the method. As an alternative to the base point, another agreed value can be used.

In a preferred embodiment, a method for checking a blind signature of an eMD is provided, the blind signature being obtained in accordance with the method described above. Verification includes the following steps: Obtaining the eMD, a serial number used to generate the eMD, and a signed uncovered eMD. Since the serial number and not the public key derived from it is received, the entire monetary amount of the eMD can now be checked, decrypted and transmitted. The transfer of the serial number generally enables the disposal of the entire monetary amount. For verification purposes, the public key is calculated from the subscriber-generated serial number. In addition, the eMD is calculated using the calculated public key, the signed uncovered eMD and a public key of the signature issuer. It should be noted that the calculated public key is used for verification instead of the serial number, because in this aspect of the invention the serial number remains hidden from the signature issuer and the blind signature is created via the public key. The calculated public key must then be used to check the signature. Finally, the calculated eMD is compared with the received eMD and the authenticity of the blind signature is verified if the calculated eMD matches the received eMD.

In a preferred embodiment, a further method for checking a blind signature of an eMD is provided, in which the blind signature was also generated / obtained according to a previously described method. The further method comprises: obtaining the eMD, the subscriber-generated public key, a signed unblended eMD, a monetary partial amount of the eMD, a signature via a link from the monetary partial amount and another subscriber-generated public key; and a participant-generated secret. The partial amount is preferably the above-mentioned (first) partial amount of the total monetary amount. Now the further public key is calculated from the subscriber-generated secret; a calculating the Signature using the link between the monetary partial amount and the calculated further subscriber-generated public key; comparing the calculated signature with the received signature and verifying the authenticity of the monetary partial amount; and the calculation of the eMD already described above using the received public key, the signed unblended eMD and a public key of the signature issuer, so that - as already mentioned - the calculated eMD can be compared with the received eMD and the authenticity of the blind Signature is compared when the calculated eMD matches the received eMD.

The further method thus enables the authenticity of the eMD to be verified on the basis of the total amount of money, as it was signed (blindly) by the signature issuer. The partial amount can also be verified and used for other payment transactions. The subscriber-generated secret need not have been generated by the subscriber who generated the serial number, as a result of which a transmitted eMD can be further divided without having to be re-signed.

In a preferred embodiment, a further method for checking a blind signature of an eMD is provided, in which the blind signature was also generated / obtained according to a previously described method. The still further method comprises the procedural steps: obtaining the eMD, the subscriber-generated public key, a signed unblended eMD, a monetary partial amount of the eMD, a signature via a link from the monetary partial amount and another subscriber-generated public key, the further subscriber-generated public key ; a second partial monetary amount of the eMD; a second signature via a combination of the second monetary partial amount and a second further subscriber-generated public key; and a second subscriber-generated secret. It should be noted that the (first) participant-generated secret and also the serial number are not received, since their disclosure would also enable the (first) monetary partial amount or the total monetary amount to be held. The second partial amount is preferably the above-mentioned second partial amount of the total monetary amount, which is smaller than the (first) partial amount.

The second further public key is calculated from the second subscriber-generated secret; calculating the second signature via the linkage from the monetary partial amount and the calculated second additional one subscriber generated public key; comparing the calculated second signature with the received second signature and verifying the authenticity of the second monetary partial amount. In addition, the aforementioned calculation of the signature takes place via the link from the monetary partial amount and the calculated further subscriber-generated public key; comparing the calculated signature with the received signature and verifying the authenticity of the monetary partial amount; calculating the eMD using the received public key, the signed uncovered eMD and a public key of the signature issuer; comparing the calculated eMD with the received eMD and verifying the authenticity of the blind signature if the calculated eMD matches the received eMD. The (first) monetary partial amount and the (first) signature are created by a subscriber by linking the monetary partial amount and a further subscriber-generated public key in accordance with the derivation method described above. The participant does not have to be the participant who generated the serial number. This enables the eMD to be shared with the blind signature fully valid.

The second monetary partial amount and the second signature are preferably created by a subscriber by linking the second monetary partial amount and a second further subscriber-generated public key in accordance with the derivation method described above.

The publisher information is preferably also obtained in the receive step and this is also used in the calculate step for calculating the eMD.

The verification is preferably carried out by the signature issuer or a testing entity other than the signature issuer, for example also another participant.

The publisher information is preferably also verified during the checking. The blind signature is preferably generated with an elliptical curve signing algorithm, ECDSA, and agreed curve parameters of the elliptical curve are provided for checking the blind signature. In a further aspect of the invention, a payment system for transmitting an electronic coin data record, eMD, is provided between at least two participants. The payment system comprises a first participant for obtaining a blind signature for an eMD according to the described receiving method; a signature issuer for generating the blind signature and a second participant for receiving the generated eMD, a signed unblended eMD and a serial number used for generating the eMD.

The payment system also includes the second participant checking the received generated eMD, the signed unblended eMD and the serial number used to generate the eMD. It is provided that the second participant generates the secret and derives the partial amount and the one belonging to the partial amount. This partial amount is used in a payment process where the blind signature via the eMD remains valid. An eMD is in particular an electronic data record that represents a monetary amount and is also colloquially referred to as a “digital coin” or “electronic coin”. The right to this monetary amount changes in the process from a first account to another account. In the following, a monetary amount is understood to be a digital amount that can be credited to an account of a financial institution. The eMD therefore represents cash in electronic form.

The eMD differ significantly from electronic data records for data exchange or data transfer because, for example, a classic data transaction takes place on the basis of a question-answer principle or on intercommunication between the data transfer partners. In contrast, EMD are characterized by uniqueness, uniqueness and security features (signatures, encryption). In principle, an eMD contains all the data required for a receiving entity with regard to verification, authentication and forwarding to other entities. Intercommunication is therefore generally not necessary with this type of data record. Exceptions are the change payment transactions. A security element can be provided in a subscriber's terminal for transmission. A security element is preferably a special software, in particular in the form of a secure runtime environment within an operating system of a terminal device, English Trusted Execution Environments, TEE. Alternatively, the security element is designed, for example, as special hardware, in particular in the form of a secured hardware platform module, English Trusted Platform Module, TPM or as an embedded security module, cUICC, eSIM. The security element provides a trustworthy environment and, for example, also secures a machine-2-machine, M2M application.

The communication between two end devices or security element can take place contactlessly or with contacts and can be designed as a secure channel. This is the exchange of the eMD with cryptographic keys, for example a session key negotiated for an exchange of coin data sets or a symmetrical or asymmetrical pair of keys.

Any terminal processing a program code with user input output is disregarded as a terminal, for example a PC, a smartphone, a tablet. In addition, the terminal can also be part of an M2M environment, for example a machine, tool, machine or container and vehicle understood. A terminal device according to the invention is thus either stationary or mobile. M2M stands for the (fully) automated exchange of information between these end devices, for example using the Internet and the corresponding access networks, such as the mobile network.

BRIEF SUMMARY OF THE FIGURES

The invention or further embodiments and advantages of the invention are explained in more detail below with the aid of figures, the figures merely describing exemplary embodiments of the invention. The same components in the figures who provided the same reference numerals. The figures are not to be regarded as true to scale, individual elements of the figures can be exaggeratedly large or exaggeratedly simplified.

Show it:

Fig.l principle of the Digi-Cash method with blind signatures; 2 shows a known example for creating and checking a signature using ECDSA;

3 shows an exemplary embodiment of a process flow diagram of a signature generating method according to the invention;

4 shows an exemplary embodiment of a method sequence for generating and checking a blind signature for an eMD according to the invention; 5 shows an embodiment of a process flow diagram of a method according to the invention;

6 shows an exemplary embodiment of a method sequence for generating and checking a blind signature for an eMD with an entire monetary amount and monetary partial amounts divided therefrom according to the invention; and

7 shows an exemplary embodiment of a method sequence for generating and checking a blind signature for an eMD with an entire monetary amount and monetary partial amounts divided therefrom according to the invention.

FIGURE DESCRIPTION

Fig. 1 shows the principle of the "DigiCash" method with blind signatures. A first participant (buyer) TI, a second participant (seller) T2 transmits a coin signed by the signature issuer H. To this end, the first participant TI exchanges a monetary amount with a digital coin, the unique identifier, for example a serial number, of which he generates himself in step 1. The unique identifier is encrypted in step 2 and transmitted to the signature issuer H together with the value of the digital coin in step 3. The signature publisher H confirms the validity of the digital coin by signing the encrypted unique identifier in step 4 and sends the digital coin thus signed back to the first subscriber TI in step 5. In step 6 the first participant TI decrypts the signature and in step 7 transmits (pays) the digital coin consisting of the unique identifier and the decrypted signature to the second participant T2. The second subscriber T2 requests the signature issuer H to redeem the digital coin in step 8. The signature issuer H verifies the authenticity of the digital coin using the signature in step 9 and thus enables the monetary amount of the digital coin to be redeemed in step 10. 2 shows a method sequence 100 consisting of a method S for providing a signature between a first subscriber TI or its first end device M1 and a publisher H and a method P for checking the created signature between a first subscriber TI and a PI is shown.

In the signing method S, in step 101 all involved instances TI, H and P agree on the curve parameters, f, p, a, b, G, n, h of an elliptical curve. These curve parameters describe a curve used, where f is the order of the body on which the curve is defined; p is the specification of the basis used; a, b two body elements that describe the equation of the curve; G is the generator point (generator point, base point) of the curve; n, is the order of point G; and h is the cofactor. In addition, agreement is reached on a cryptographic scatter value function H () to be used, also referred to as a hash function, for example a SHA-2 algorithm.

In step 102, the publisher H generates a cryptographic key pair d, D based on the base point G and communicates the public part D to the first participant TI and the testing entity PI in steps 103, 103 '. The public key part D is also referred to as a verification key D. The private key part d is not given out as a secret.

In step 104, the first subscriber TI generates a serial number m and links it to a monetary amount for the electronic coin data record, eMD. In addition, the first subscriber TI generates two integer random numbers g, i. In step 105, the publisher H generates a random number r and calculates a point R of the curve which is transmitted to the first subscriber TI.

In step 106, the first participant TI calculates a point on the curve using equation (1):

A = R + g G + d D (1)

Point A is represented by an x coordinate A _x and a y coordinate A _y . The x coordinate A _x with the serial number m is used as the input parameter of the hash function H () in equation (2) in order to obtain an unsigned, unblended eMD c: c = H (m || A _x ) (2)

The unsigned, unblended eMD c is converted into an unsigned, blended eMD c 'using equation (3): c' = c - d (3)

In step 107, this unsigned, blinded eMD c 'is sent to the publisher H and there, in step 108, the signed, blinded eMD s' is obtained using equation (4) and transmitted in step 109 to the first subscriber TI: s' = r— c 'd (4)

In step 110, the signed, blinded eMD s 'is converted into an unblended signed eMD s using equation (5): s = s' + g (5)

As a result of the signing method S, an eMD c is obtained whose subscriber-generated serial number m has the signature (s, c), see equation (6): sig (m) = (s, c) (6)

In the PR test procedure, anyone who is aware of the above Curve parameters and the verification key D (public key of the publisher H) is to check the blind signature of the eMD c, for example by means of a test body PI or any participant T1, T2, T3, all of which do not have to be the publisher H. , he follows. For this purpose, in step 111, the unsigned unblended eMD c, the signed unblended eMD s and the subscriber-generated serial number m are transmitted from the subscriber TI to the testing entity PI. In step 112, the blind signature is verified there using the following equations (7) to (10):

(c D) + (s G) (7)

= (c d G) + (r G) - (c d G) + (dd G) + (g G) (8)

= R + Ö D + y G) = A (9) c == H (m | | A _x ) (10)

If the eMD c calculated in equation (10) corresponds to the eMD c sent (received) in step 111, the blind signature is regarded as confirmed and the eMD as genuine.

3 shows an exemplary embodiment of a process flow diagram of a signature-generating method 100 according to the invention. FIG. 4 shows an exemplary embodiment of a process flow for generating and checking a blind signature for an eMD according to the invention. The method in Figure 3 is explained in conjunction with Figure 4.

The method 100 for creating a blind signature according to FIG. 3 and FIG. 4 is based on the creation of a blind signature with a corresponding check by a testing entity PI according to FIG. 2 and reflects a process sequence in an ECDSA method. It should be noted that the checking with steps 111 and 112 can also be carried out by another subscriber T2, T3, for example in order to verify the monetary amount or partial amount. It should also be noted that checking PR with steps 111 and 112 can also take place between two participants T2, T3 who have not generated the serial number m of the eMD c. These participants then want to verify and transmit, for example, a total monetary amount or a partial amount derived therefrom or a second partial amount derived therefrom.

The use of the ECDSA is only exemplary and any method for generating a blind signature, for example DAS or RSA based, can be operated with the basic idea of the invention, namely the addition of issuer information, possibly in conjunction with the derivation of monetary partial amounts. This is indicated by the dashed lines of steps 101 to 105 in FIG. 4, which are therefore to be regarded as optional steps. The repetition of the explanation of these steps 101 to 105 of FIG. 2 is therefore dispensed with, even though they are part of the inventive method when using an ECDSA method.

The method steps 101 to 107 of FIG. 3 and FIG. 4 are the same as the method steps 101 to 107 of FIG. 2 and reference is made to this FIG. 2 for further explanations. In step 107, the unsigned, blinded eMD c 'described with equation (3) is sent to the publisher H. A publisher value w is generated there in step 113. The publisher value w is, for example, a time stamp or a random value. This publisher value w is converted into publisher information u by means of a scatter value function H (). This scatter value function H () is preferably the scatter value function that was agreed in step 101. This simplifies the procedure with regard to compatibility and agreement of the cryptographic functions to be used.

With this publisher information u, the unsigned veneered eMD c 'is expanded in accordance with step 113 in equation (11): c' + u (11)

In step 108, the extended signed blinded eMD s “is obtained using equation (12): s“ = r - (c ’+ u) -d (12)

In step 109, the extended, signed, blinded eMD s “is transmitted to the first subscriber TI together with the editor value w.

In step 110, the signed, blinded eMD s “is unblended using equation (13): s = s“ + g (13)

As a result of the signing method S, an eMD c with the subscriber-generated serial number m has the signature (s, c, w), see equation (14): sig (m) = (s, c, w) (14)

According to the invention, the subscriber TI generates the eMD c and blinds it in c 'with the random number g, so that the eMD c is not known to the publisher H. In addition to the unique serial number m, the eMD c is also assigned a monetary maximum amount.

The publisher H signs the blinded unsigned eMD c 'without knowing the eMD c or the serial number m. This is called blind signing. According to the invention, the publisher H adds a publisher-generated value w in the form of publisher information u. This publisher information u becomes an unchangeable part of the signed, blinded eMD s ”and, according to equation (13) as the publisher value w, also part of the signed, unblended eMD s.

In the PR test procedure, anyone who is aware of the above Curve parameters and the verification key D is, check the signature (s, c, w) of the eMD c with the serial number mer m and the publisher value w, which is done, for example, by means of a test body PI, T2, T3, which is not necessarily the publisher H. . When checking in the process PR of FIG. 4, a check is then carried out to determine whether m has been changed and whether w has been changed, which is described below.

For this purpose, in step 111 the unsigned unblended eMD c, the signed unblended eMD s, the subscriber-generated serial number m and the publisher value w are transmitted from the subscriber TI to the testing entity PI, T2, T3. In step 112, the signature is verified there using the following equations (15) to (17): u = H (w) (15)

A = s G + (c + u) D (16) c == H (m || A _x ) (17)

If it is determined with equation (17) that the unsigned, unblended eMD c obtained in step 111 corresponds to the calculated eMD, the blind signature is considered to be genuine.

5 shows an embodiment of a process flow diagram of a signature-obtaining method according to the invention. FIG. 6 shows an exemplary embodiment of a method sequence for obtaining S a blind signature and also for checking PR for a blind signature for an eMD according to the invention. The checking method PR has three different scenarios PR1, PR2, PR3. The method in Figure 5 is explained in connection with Figure 6. The method for obtaining a blind signature according to FIG. 5 and FIG. 6 is based on the creation of a blind signature with a corresponding check by a testing body PI, T2, T3 according to FIG. 2 and reflects a procedure in an ECDSA method. It should be noted that checking PR1, PR2, PR3 with steps 111, 111 ', 111 "and 112, 112% 112" can also be carried out by another participant T2, T3, for example to verify the monetary amount or partial amount . It should also be noted that checking PR1, PR2, PR3 with steps 111, 111% 111 "and 112, 112% 112" can also take place between two participants T2, T3 who have not generated the serial number m of the eMD c, for example, to verify and transfer a monetary total amount or a partial amount u derived therefrom or a second partial amount e derived therefrom. Subsequently, the testing entity PI is equated to another participant T2, T3.

The use of the ECDSA is only an example, and any method for generating / receiving a blind signature, for example DAS or RSA-based, can be carried out with the basic idea of the invention, namely the derivation of partial monetary amounts, possibly using publisher information from the signature publisher H done. Repetition of steps 101 to 105 of FIG. 2 is therefore dispensed with, although when using an ECDSA method they are part of the method according to the invention.

The method steps 101 to 105 of FIG. 5 and FIG. 6 are the same as the method steps 101 to 105 of FIG. 2 and reference is made to this FIG. 2 for further explanations.

In step 114, a public key M described in equation (18) is generated in the subscriber TI:

M = m G (18)

The subscriber-generated serial number m is to be regarded as a secret and the public key G is derived using the (agreed) base point G of the elliptical curve. Alternatively, other agreed values can be used to generate the public key M. In step 106, the first subscriber TI calculates a point on the curve using equation (1). The point A is represented by an x coordinate A _x and a y coordinate A _y . The x coordinate A _x is used with the public key M as the input parameter of the hash function H () in equation (19) in order to obtain an unsigned, unblended eMD c: c = H (M 11 A _x ) (19)

The unsigned, unblended eMD c is converted into an unsigned, blended eMD c '(M) using equation (20): c' (M) = c - d (20)

In step 107, the unsigned, blinded eMD c ′ (M) described with equation (20) is sent to the publisher H. In step 108, the signed, blinded eMD s' is obtained using equation (21) and transmitted in step 109 to the first subscriber TI: s' = r - c '(M) d (21)

In step 110, the signed, blinded eMD s' is obtained by means of equation (5). As a result of the signing method S, an eMD c is obtained whose public key M has the signature (s, c), see equation (22): sig (M) = (s, c) (22)

5 and 6, the subscriber TI generates the eMD c using a public key M instead of the serial number m. This serial number m is secret to the signature publisher H. This makes it possible to share the monetary amount of the eMD c and to transfer partial amounts u or second partial amounts e between participants TI, T2, T3 without the blind signature becoming invalid. This simplifies the administrative effort for the signature issuer H and enables a payment system with eMD c in which change can also be paid or in which non-circular amounts can be transferred or whose monetary value can be sent to different instances. FIG. 6 now shows three scenarios with which an eMD which can be divided using the signature method S obtained in FIG. 6 can be transmitted, the blind signature nevertheless remaining valid. With the test methods PR1, PR2, PR3, non-circular amounts can now be transferred very precisely or corresponding change (change) can be generated. For example, the maximum monetary amount of an eMD c could be sent from a first participant TI to a second participant T2 in the test procedure PR1. In the test procedure PR2, a partial amount u is then returned as change to the first participant TI by the second participant T2. The first participant TI can now further split the partial amount u and transfer the second partial amount e to the third participant T3 in the test procedure PR3: In the test procedure PR1 in FIG a second participant T2, T3 is to be redeemed.

In the test procedure PR1 of Fig. 6, each instance (PI, T2, T3) that is aware of the above Curve parameters and the verification key D (public key of the publisher H), check the blind signature of the eMD c, which is done, for example, by means of the test entity PI, which is not necessarily the publisher H.

For this purpose, in step 111, the unsigned, unblended eMD c, the signed, unblended eMD s and the subscriber-generated serial number m are transmitted from the subscriber TI to the testing entity PI. There, the blind signature is verified in step 112. The subscriber-generated public key M is first calculated using equation (23).

M = m- G (23)

The eMD c is then calculated in accordance with equations (7) to (9), and equations (24) are then used to check whether the calculated eMD corresponds to the eMD c obtained: c, s == b.sig (M); c == H (M \ \ A _X ) (24)

If the calculated eMD c matches the received eMD c, the blind signature is valid and the eMD c can be used by the testing body PI, or also by the other participants T2, T3, for further payment processes.

If the eMD c obtained in equation (24) corresponds to the eMD c sent in step 111, the blind signature is considered confirmed and the eMD is genuine. In the test method PR2 of FIG. 6, the derivation of a partial amount u from the monetary total amount is shown first with step 115. For this purpose, the subscriber TI (or another subscriber who is in possession of the eMD c) generates a secret p and a further public key P using the subscriber-generated secret p. The secret p is different from the serial number m. The further subscriber-generated key P is different from the subscriber-generated public key M. For example, the subscriber-generated public key P can be obtained by multiplying it by the base point G, see equation (25):

P = p G (25)

For derivation 115, a real signature o _{m is also} created using equation (26):

O _m = Sig _m (P || V) (26)

U is the partial amount to be derived, which is smaller than the total monetary amount of the eMD c. The real signature s _hi is a logical OR combination of the public key P and the partial amount u. Other logical links or mathematical operations are also conceivable for creating the real signature s _hi . In step 111 'the following variables are now exchanged between two participants TI, T2, T3:

• the eMD c

The subscriber-generated public key M

· The signed unblended eMD s

• the real signature s _hi

• the partial amount u

• The participant-generated secret p In step 112 ', the authenticity of the blind signature and the authenticity of the real signature s _hi can now be checked, as a result of which the partial amount u is considered to be - transmitted between the participants TI, T2, T3. For this purpose, the further public key P is first calculated using the participant-generated secret p and the agreed base point G, see equation (25). In addition, the blind signature is checked according to equations (7) to (9) and (24). In addition, the real signature is _hi the calculated further subscriber-generated public key P and the partial amount u obtained, and if equation (27) matches

O _m = = Sigm (P || Ό) (27), the partial amount u is considered to be verified and is also transmitted by transmitting the secret p. It should be noted that the test body PI, T2, T3 is not in possession of the subscriber-generated serial number m and can therefore verify the blind signature (using the key M) but does not have the total monetary value. 6, the derivation of a second partial amount e from the partial amount u is shown in step 116. For this purpose, the subscriber TI (or another subscriber who is in possession of the eMD c) generates a second secret q and a second further public key Q using the subscriber-generated secret q. The second secret q is different from the serial number m and from the secret p. The second further subscriber-generated key Q is different from the subscriber-generated public key M and the further ren subscriber-generated key P. For example, the second further subscriber-generated public key Q can be obtained by multiplication by the base point G, see equation (28):

Q = q G (28)

Equation (28) also creates a second real signature s _r for derivation 116:

< _P = sig _P (Q \\ e) (29)

Here, e is the second partial amount to be derived, which is smaller than the total monetary amount and which is also smaller than the partial amount u of the eMD c. The real signature s _r here is a logical OR combination of the public key Q and the partial amount e. Other logical links or mathematical operations are also conceivable for creating the real signature s _r . In step 111 “the following variables are now exchanged between two participants TI, T2, T3:

• the eMD c

· The subscriber-generated public key M • the signed unblended eMD s

• the real signature s _hi

• the partial amount u

The further subscriber-generated public key P

• the second real signature s _r

• the second partial amount e

• the second subscriber generated secret q

In step 112 “, the authenticity of the blind signature, the authenticity of the real signature s _hi and also the authenticity of the second real signature s _r can now be checked, as a result of which the second partial amount e is considered to be - between the participants TI, T2, T3 . For this purpose, the second further subscriber-generated public key Q is first calculated using the second subscriber-generated secret q and the agreed base point G, see equation (28). In addition, the blind signature is checked in accordance with equations (7) to (9) and (24). In addition, the second real signature s _{r is} calculated from the calculated second further subscriber-generated public key Q and the second partial amount e obtained and if the equation (30) s _R == sig _P (Q \\ e) (30) matches, the applies Partial amount e as verified and is also transmitted by the transmission of the second secret q. It should be noted that the test body PI, T2, T3 does not have the subscriber-generated serial number m or the subscriber-generated secret p. Thus, the blind signature and the real signature s _{hi can be} verified (by the subscriber-generated public keys M and P), but the test body PI, T2, T3 does not get the monetary total amount or the (first) partial amount u.

With the test methods PR1, PR2 and PR3 it was demonstrated that any monetary (partial) amounts u, e can now be transferred between any participants, whereby the authenticity of the blind signature and that with the respective partial amounts u, e e connected real signatures s _hi and s _r can be checked. By a suitable choice of the variables to be transmitted, the receiving entity PI, T2, T3 then receives full access rights to the respective partial amounts, whereby the eMD is considered to be transmitted. 7 shows a further exemplary embodiment of a method sequence for generating and checking a blind signature for an eMD with an entire monetary amount and monetary partial amounts divided therefrom according to the invention. The process sequences in FIGS. 4 and 6 were combined with one another. In addition to the use according to the invention of a publisher information u, w, the sharing of monetary amounts according to the invention is now also possible.

7 shows an exemplary embodiment of a method sequence for obtaining S a blind signature and also for checking PR for a blind signature for an eMD according to the invention. The checking process PR has three different scenarios PR1, PR2, PR3.

The method for obtaining a blind signature according to FIG. 7 is based on the creation of a blind signature with a corresponding check by a testing entity PI according to FIG. 2 and reflects a process sequence in an ECDSA method. It should be noted that checking PR1, PR2, PR3 with steps 111, 111 ', 111 "and 112, 112% 112" can also be carried out by another participant T2, T3, for example by adding the monetary amount or partial amount to verify. It should also be noted that checking PR1, PR2, PR3 with steps 111, 111% 111 "and 112, 112% 112" can also take place between two participants T2, T3 who have not generated the serial number m of the eMD c, for example to verify a monetary total amount or a portion derived therefrom or a second portion e derived therefrom and to receive it. Subsequently, the testing entity PI is equated to another participant T2, T3.

The use of the ECDSA is only exemplary and any method for generating / obtaining a blind signature, for example DAS or RSA-based, can be carried out with the basic idea of the invention, namely the derivation of monetary partial amounts using publisher information u, w of the signature publisher H done. Repetition of steps 101 to 105 in FIG. 2 is dispensed with, although they are part of the method according to the invention when using an ECDSA method. The method steps 101 to 105 of FIG. 7 are the same as method steps 101 to 105 of FIG. 2 and reference is made to this FIG. 2 for further explanations. In step 114, the generation of a public key M described in equation (18) in the subscriber TI is described.

In step 106, the first subscriber TI calculates a point on the curve using equation (1). The point A is represented by an x coordinate A _x and a y coordinate A _y . The x coordinate A _x is used with the public key M as the input parameter of the hash function H () in equation (19) in order to obtain an unsigned, unblended eMD c. The unsigned, unblended eMD c is converted into an unsigned, blended eMD c '(M) using equation (20).

In step 107, the unsigned, blinded eMD c ′ (M) obtained with equation (20) is sent to the publisher H. A publisher worth w is generated there in step 113. The publisher value w is, for example, a time stamp or a random value. This publisher value w is converted into publisher information u by means of a scatter value function H (). This scatter value function H () is preferably the scatter value function that was agreed in step 101. This simplifies the procedure with regard to compatibility and agreement of cryptographic functions to be used. The unsigned, blinded eMD c 'is then expanded in accordance with equation (11) with this publisher information u in step 113.

In step 108, the extended signed blinded eMD s “is obtained using equation (31): s“ = r - (c ’(M) + u) -d (31)

In step 109, the extended, signed, blinded eMD s “is transmitted to the first subscriber TI together with the editor value w. In step 110, the signed, blinded eMD s “is not blinded using equation (13).

As a result of the signing method S, an eMD c is obtained whose public key M has the signature (s, c, w), see equation (32): sig (M) = (s, c, w) (32)

7, the subscriber TI generates the eMD c using a public key M instead of the serial number m. This serial number m is secret to the signature publisher H. The signature publisher also generates H the publisher information u, w and adds this as an integral part of the blind signature.

This makes it possible to divide the monetary amount of the eMD c and to transfer partial amounts u or second partial amounts e between participants TI, T2, T3 without the blind signature becoming invalid. Each PI is also able to check the publisher information u, w. Trustworthiness and security are significantly improved, especially in the case of multiple shared eMDs and the corresponding monetary partial amounts u, e.

The possibility of sharing an eMD c simplifies the administrative work for the signature issuer H and enables a payment system with eMD c for which change can be paid or in which non-circular amounts of money can be electronically transferred. In Fig. 7, three scenarios are now shown, by means of which a divisible eMD obtained with the signing method S shown in Fig. 7 is transmitted and the blind signature nevertheless remains valid.

With the test methods PR1, PR2, PR3, non-circular amounts can now be transferred very precisely or corresponding change (change) can be generated. For example, the maximum monetary amount of an eMD c could be sent from a first participant TI to a second participant T2 in the test procedure PR1. In the test procedure PR2, a partial amount u is then returned as change to the first participant TI by the second participant T2. The first participant TI can now further split the partial amount u and transfer the second partial amount e to the third participant T3 in the test procedure PR3:

In the test procedure PR1 of FIG. 7, it is initially shown that the entire monetary amount of an eMD c is to be checked and, if necessary, to be redeemed by a second subscriber T2, T3.

In the test procedure PR1 of Fig. 7 anyone who is aware of the above. Curve parameters and the verification key D (public key of the publisher H) is to check the blind signature of the eMD c, which is done, for example, by means of a test entity PI, which is not necessarily the publisher H.

For this purpose, in step 111, the unsigned, unblended eMD c, the signed, unblended eMD s, the subscriber-generated serial number m and the publisher information w are transmitted from the subscriber TI to the testing entity PI. In the test procedure Ren PR1 of Figure 7 is then checked whether the public key M has been changed and whether w has been changed, which is described below.

In step 112, the blind signature is verified. The subscriber-generated public key M is first calculated using equation (23). The publisher information u is obtained with equation (15) and with equation (33)

A = s G + (c ’(M) + u) D (33) it is checked whether the condition of equations (24) is fulfilled. If the calculated eMD c matches the received eMD c, the blind signature is valid and the eMD c can be used by the testing body PI, or for example also by the other participants T2, T3, for further payment processes.

In the test method PR2 of FIG. 7, the derivation of a partial amount u from the monetary total amount is shown first with step 115. For this purpose, the participant TI (or another participant T2, T3 who is in possession of the eMD c) generates a secret p and a further public key P using the participant-generated secret p. The secret p is different from the serial number m. The further subscriber-generated key P is different from the subscriber-generated public key M. For example, the further public key P generated by the subscriber can be obtained by multiplying by the base point G, see equation (25). For derivation 115, a real signature s _{hi is also} created using equation (26). U is the partial amount to be derived, which is smaller than the total monetary amount of the eMD c. The real signature s _hi is a logical OR combination of the public key P and the partial amount u. Other logical links or mathematical operations for creating the real signature s _hi are also conceivable. In step 111 ', the following variables are now exchanged between two participants TI, T2, T3:

• the eMD c

The subscriber-generated public key M

• the signed unblended eMD s

· The real signature s _hi

• the partial amount u

• the participant-generated secret p • the publisher information w

In step 112 ', the authenticity of the blind signature and the authenticity of the real signature s _hi can now be checked, as a result of which the partial amount u is considered to be - transferred between the participants PI, TI, T2, T3. For this purpose, the further public key P is first calculated using the subscriber generated secret p and the agreed base point G, see equation (25). In addition, the blind signature is checked according to equations (15), (33) and (24). In addition, the real signature G _{m is} calculated from the calculated further subscriber-generated public key P and the partial amount u obtained, and if equation (26) matches, the partial amount u is considered to be verified and is transmitted by the secret p. It should be noted that the test body PI, T2, T3 is not in possession of the subscriber-generated serial number m and can therefore verify the blind signature (using the key M) but does not have the total monetary amount of the eMD c. When checking in method PR2 of FIG. 7, a check is therefore carried out to determine whether the public key M has been changed, whether w has been changed and whether the real signature G _{m has been} changed.

7, the derivation of a second partial amount e from the partial amount u is shown in step 116. For this purpose, the subscriber TI (or another subscriber who is in possession of the eMD c) generates a second secret q and a second further public key Q using the second subscriber-generated secret q. The second secret q is different from the serial number m and from the secret p. The second further subscriber-generated key Q is different from the subscriber-generated public key M and the further subscriber-generated key P. For example, the second further subscriber-generated public key Q can be obtained by multiplication by the base point G, see equation (28). Equation (29) also creates a second real signature s _r for derivation 116.

Here, e is the second partial amount to be derived, which is smaller than the total monetary amount and which is also smaller than the partial amount u of the eMD c. The real signature s _r here is a logical OR combination of the public key Q and the partial amount e. Other logical links or mathematical operations are also conceivable for creating the real signature s _r . In step 111 “the following variables are now exchanged between two participants TI, T2, T3: the eMD c

the subscriber generated public key M

the signed unblended eMD s

the real signature s _hi

the partial amount u

the further subscriber-generated public key P

the second real signature s _r

the second partial amount e

the second subscriber generated secret q

the publisher information w

In step 112 “, the authenticity of the blind signature, the authenticity of the real signature s _hi and also the authenticity of the second real signature s _r can now be checked, as a result of which the second partial amount e is considered to be - between the participants TI, T2, T3 . For this purpose, the second further public key Q is first calculated using the second subscriber-generated secret q and the agreed base point G, see equation (28). In addition, the blind signature is checked according to equations (15), (33) and (24). In addition, the second real signature s _{r is} calculated from the calculated second further subscriber-generated public key Q and the received second partial amount e and, if equation (30) matches, the partial amount e is verified and is also transmitted by the transmission of the second secret q . It should be noted that the test body PI, T2, T3 does not have the participant-generated serial number m or the participant-generated secret p. Thus, the blind signature and the real signature s _{hi can be} verified (by the subscriber-generated public keys M and P), but the verifier does not get the total monetary amount or the (first) partial amount u.

With the test methods PR1, PR2 and PR3 it was demonstrated that arbitrary monetary amounts u, e can now be transferred between any participants, the authenticity of the blind signature and the real signatures associated with the respective partial amounts u, e s _hi at any time and s _{r can be} checked. Through a suitable choice of the variables to be transmitted, the receiving entity then receives full access rights to the respective partial amounts, which means that the eMD is considered to be transmitted. By integrating subscriber-independent publisher information u, w in the test procedure PR1, PR2, PR3 it is determined whether the public keys M, P, Q have been manipulated by an entity and thus detected an attempt to defraud. The publisher information u, w is not secret and can be checked by any entity independently of the eMD c.

In the context of the invention, all the elements described and / or drawn and / or claimed can be combined with one another as desired.

REFERENCE SIGN LIST

1-10 process steps for classic blind signature

100-116 procedural steps

Ml first terminal

M2 second terminal

M3 third terminal

TI first participant

T2 second participant

T3 other participants

H publisher

PI test authority

m subscriber generated serial number of the eMD

M subscriber generated public key from m and G

p subscriber generated secret

P subscriber-generated further public key from p and G q second subscriber-generated secret

Q second subscriber-generated further public key from q and G g, d subscriber-generated random numbers (integer)

f, a, b, G, n, h agreed curve parameters

H () cryptographic scatter value function

R edited point

A participant-calculated point

d the publisher's secret key

D verification key (publisher's public key)

G Generator point (generator point, base point) of the elliptic curve

S Signing process

PR review process

r publisher-generated random number

w publisher information,

c electronic coin data set, eMD

c ‘unsigned blinded eMD

c ’+ u extended unsigned blinded eMD

s signed unblended eMD

s ‘signed blinded eMD

s ’’ extended signed blinded eMD

u non-cash partial amount

e second monetary partial amount

o _m u signature on the partial amount and the public key P _r s signature over the partial amount e and public key Q

Claims

PATENT CLAIMS

1. A method (100) for generating a blind signature for an electronic coin data set, eMD (c), with the method steps:

- Receiving (107) an unsigned, blinded eMD (c ') from a subscriber (TI) at a signature issuer (H);

- Extension (113) of the unsigned, blinded eMD (c ‘) with a publisher information (u, w) by the signature publisher (H) to obtain an extended unsigned eMD (c’ + u; c ’+ w);

- Signing (108) the extended unsigned eMD (c '+ u; c' + w) using a publisher-generated random number (r) and a secret key (d) of the signature issuer (H) to obtain an extended signed blinded eMD (s ''); and

- Sending (109) the expanded signed blinded eMD (s “) and the publisher information (u, w) to the subscriber (TI), the sent publisher information (u, w) being part of the blind signature.

2. The method (100) according to claim 1, wherein the publisher information (u, w) is provided independently of the signed, blinded eMD (s ") as independent information.

3. The method (100) according to one of the preceding claims, wherein the publisher information (u) used to expand (113) the unsigned, blinded eMD (c ') is the result of a scatter value function (H ()) with a publisher value (w ) where the publisher value (w) is sent as the publisher information (u, w) and is part of the blind signature.

4. The method (100) of 3, wherein the publisher value (w) is at least one of the following values:

- a current value;

- an identification of the publisher; and or

- a publisher-generated value.

5. The method (100) according to any one of the preceding claims, wherein the eMD (c) the result (106) of a scatter value function (H ()) from a subscriber-generated serial number (m) and a subscriber-calculated point (A) of an elliptical rule Curve is.

6. The method (100) according to one of the preceding claims, wherein the eMD (c) is the result of a scatter value function (H ()) from a subscriber-generated public key (M) and a subscriber-calculated point (A) of an elliptic curve, the subscriber-generated public key (M) being derived from the subscriber-generated serial number (m).

7. A method for checking a blind signature of an electronic coin data record, eMD (c), the blind signature being generated in accordance with the method (100) of the preceding claims 1 to 6, with the method steps:

- Received (111) from:

o the eMD (c),

o a serial number (m) used to generate the eMD (c), o a signed uncovered eMD (s), and

o the publisher information (u, w);

- Calculate (112) an eMD using the serial number obtained

(m), the signed uncovered eMD (s), the publisher information (w) and a public key (D) of the signature publisher (H); and

- Compare the calculated eMD with the received eMD (c) and verify the authenticity of the blind signature if the calculated eMD matches the received eMD (c).

8. The method according to claim 7, wherein the eMD (c) obtained is the result of a scatter value function (H ()) from a link (M) of a subscriber-generated serial number (m) with a base point (G) and a subscriber-calculated point ( A) is an elliptic curve and a subscriber-generated public key (M) is derived from the subscriber-generated serial number (m) before the eMD (c) is calculated.

9. A method for checking a blind signature of an electronic coin data set, eMD (c), the blind signature being generated according to a method of claims 1 to 6, with the method steps:

- Received (111) from:

o the eMD (c);

o a user-generated public key (M) used to generate the eMD (c);

o a signed uncovered eMD (s);

o a monetary portion of the eMD (s); o a signature (o _m ) via a link between the monetary part amount (u) and another subscriber-generated public key (P);

o the subscriber generated secret (p); and

o the publisher information (w);

Calculating the further public key (P) from the received subscriber-generated secret (p);

Calculating a signature (s _hi ) via the link from the monetary partial amount (u) and the calculated further public key (P); Comparing the calculated signature (s _hi ) with the received signature (s _hi ) and verifying the authenticity of the monetary partial amount (n);

Calculating an eMD using the subscriber-generated public key (M), the signed uncovered eMD (s), the publisher information (w) and a public key (D) of the signature publisher (H);

Comparing the calculated eMD with the received eMD (c) and verifying the authenticity of the blind signature if the calculated eMD matches the received eMD (c).

10. The method according to any one of claims 7 to 9, wherein the verification is carried out by the signature publisher (H) or a different from the signature publisher (H), test entity (PI).

11. The method according to any one of claims 7 to 10, wherein the publisher information (u, w) is also verified during the checking.

12. The method according to any one of claims 7 to 11, wherein the blind signature is generated with an elliptical curve signing algorithm, ECDSA, and agreed curve parameters for checking the blind signature (f, p, a, b, G, n, h, H ()) of the elliptic curve.

13. A payment system for transmitting an electronic coin record, eMD (c) between at least two participants (TI, T2, T3), the payment system comprising:

- a first participant (TI) for generating an unsigned, blinded eMD (c ');

- a signature issuer (H) for generating a blind signature according to the method (100) of one of the preceding claims 1 to 6; - And a second participant (T2) to receive the generated eMD (c), a signed unblended eMD (s) and a serial number (m) used to generate the eMD (c).

14. The payment system according to claim 13, wherein the second subscriber (T2) receives the generated generated eMD (c), the signed unblended eMD (s) and the serial number (m) used to generate the eMD (c) by means of the method of claims 7 checked to 12.

15. The payment system of claim 13 or 14, wherein the first participant

(TI) for generating (106) the eMD (c) is the result of a scatter value function (H ()) from a link between a subscriber-generated public key (M) and a subscriber-calculated point (A), the subscriber-generated public key (M) is derived from the subscriber generated serial number (m).