JP2005072650A - Device to be verified, verifying device, method of being verified, and verifying method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize a message authentication method to which all problems of PSPACE class and NP class are applied. <P>SOLUTION: A device to be verified delivers Z, n constituting Z=T<SP>2</SP>mod n by a safe method from secret information T (S1). The device to be verified generates random numbers Ri using a forward error correction code from a message to be transmitted, calculates Xi=Ri<SP>2</SP>mod n, and transmits the Xi (S2). A verifying device randomly selects 0 or 1, and transmits a selected bi (S3). The device to be verified transmits Yi(=Ri) where bi=0, and transmits Yi(=TRi mod n) where bi=1 (S4). Then, the verifying device checks whether or not Xi=Yi<SP>2</SP>mod n is satisfied where bi=0 or whether or not ZXi=Yi<SP>2</SP>mod n is satisfied where bi=1 (S5). The verifying device applies the forward error correction code to answer information Yi(=Ri) for bi=0 to restore a received message. Since this transmission/reception is followed by verification of the correctness of the device to be verified, the function of message authentication is executed. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a verified device and a verification device that perform dialogue proof using a one-way function, and a verified method and a verification method performed in each of them.
[0002]
[Prior art]
As a method of delivering a message without falsification by communication between the two parties (when it is falsified, it can be detected), there are a method using a hash function and a digital signature. If two communicating parties (referred to as communication terminal A and communication terminal B) share a secret shared key in advance, generate a message digest with a keyed hash function (HMAC-SHA1, HMAC-MD5), etc. By attaching, tampering can be detected. This method cannot be performed unless the communication terminal A and the communication terminal B share a secret in advance.
[0003]
When the communication terminal A and the communication terminal B do not share the secret, the digital signature is made using the public key and the secret key. When the communication terminal A sends a message by digitally signing the communication terminal B, the communication terminal A first discloses its public key. The communication terminal B acquires the public key of the communication terminal A. Next, the communication terminal A creates an electronic signature for the message to be transmitted to the communication terminal B by using its own secret key, and transmits it to the communication terminal B with the attached electronic signature. The communication terminal B can verify the message and electronic signature sent from the communication terminal A using the public key of the communication terminal A, and can confirm whether the message has been tampered with.
[0004]
Many of the algorithms for electronic signature using the public key and the secret key are currently based on the prime factorization problem of the number theory and the discrete logarithm problem (see Patent Documents 1 and 2 below). The former is based on the characteristic that large integer prime factorization is difficult in terms of computational complexity, such as an RSA signature. The latter is based on the property that calculation of discrete logarithm in a remainder field (p is a prime number) by mod p is difficult in terms of computational complexity, such as Elgamal signature and DSA signature.
[Patent Document 1]
JP 2002-207426 A
[Patent Document 2]
JP 2002-135242 A
[0005]
[Problems to be solved by the invention]
At present, solutions for solving the prime factorization problem and the discrete logarithm problem at high speed are being studied, and it is said that a 1024-bit public key is necessary so that the secret key cannot be decrypted. Also, in the discrete logarithm problem on an elliptic curve, it is said that 160 bits is safe.
[0006]
However, there is no guarantee that these problems will remain safe, and a solution may be found that can be solved immediately even if the key length is increased. That is, a message transmission / reception method that can be applied to a wide range of problems including problems other than the prime factorization problem and the discrete logarithm problem and that has the same effect as an electronic signature has been desired.
[0007]
The present invention has been made to solve the above-described problems, and an object of the present invention is to prevent falsification of information by a third party interposed between a transmission side and a reception side.
[0008]
[Means for Solving the Problems]
The inventor of the present application has invented a message transmission / reception that can be realized by problems other than the prime factorization problem and the discrete logarithm problem, and has the same effect as an electronic signature. The present invention is a method in which a message can be transmitted and received between two communicating parties without falsification by applying a dialogue proof method using a one-way function. It has been proved that the dialogue proof method using the one-way function can be realized based on all PSPACE problems in which the one-way function exists (refer to the document “Shamir, A., * IP = PSPACE * Proc. Of. FOCS, pp. 11-15, 1990 ”). The present invention is a method capable of transmitting and receiving messages in the flow of the dialog proof method, and can realize message transmission and reception equivalent to an electronic signature based on the PSPACE problem and NP problem other than the prime factorization problem and the discrete logarithm problem. Become.
[0009]
Hereinafter, first, the principle of dialogue proof using a one-way function will be described, and then the details of the present invention will be described.
[0010]
[Principle of dialogue proof using one-way function]
By using the dialogue proof method using the one-way function, a device having certain secret information can make the other party recognize that “the secret information is held” without leaking the secret information. The principle is that a device (provided device) that proves possession of secret information first sends a calculation result obtained by applying a certain calculation to a random number to the verification device. Next, the verification device arbitrarily selects 0 or 1 (for example, the coin may be thrown to be front or back), and the selected value is sent to the verification target device. If the value is 0, the device to be verified sends the random number itself to the verification device, and if the value is 1, sends the operation result obtained by calculating the random number and the secret information. Then, the verification device verifies whether these pieces of information transmitted from the verification target device satisfy a known relationship.
[0011]
If the device to be verified does not have secret information, the device to be verified can pass this verification only with a probability of 50%. Therefore, by repeating such verification many times, it is possible to verify whether or not the device to be verified has confidential information with a probability close to 100%. Here, as an example, a dialogue proof method using the quadratic residue problem will be described with reference to FIG.
[0012]
In step S1, the device to be verified determines from the secret information T Z = T²  Send mod n Z and n to the verification device in a secure manner. Here, since n = pq (p and q are large prime numbers), it is very difficult to factorize n.
[0013]
In step S2, the device to be verified selects a random number R, and X = R²  Calculate mod n and send the resulting X to the verifier.
[0014]
In step S3, the verification apparatus randomly selects either 0 or 1 as b, and sends the selected b to the apparatus to be verified.
[0015]
In step S4, the device to be verified sends the next Y to the verification device. When b = 0, Y = R, and when b = 1, Y = TR mod n.
[0016]
In step S5, the verification apparatus checks whether or not the following expression is satisfied. That is, when b = 0, X = Y²  Does mod n hold? When b = 1, ZX = Y²Does mod n hold?
[0017]
In the dialog proof system as described above, if the device to be verified really knows the secret information T, the verification in step S5 always passes. If the above steps S2 to S5 are repeated k times, the probability that the false device to be verified continues to be cheated is (1/2)^kIt becomes.
[0018]
Note that steps S2 to S5 are not repeated k times, and instead, k random numbers (R₁, R₂, ... R_k) And X = R²  The result calculated by mod n (X₁, X₂, ... X_k) In the next step S3, the verification apparatus selects a sequence of k {0, 1} (b₁, B₂, ... b_k) To the device to be verified. Similarly, in step S4, the device to be verified sends a reply string (Y₁, Y₂, ... Y_k) To the verification device. The verification device then sends a reply string (Y₁, Y₂, ... Y_k) Are verified one by one, and only when all of them are correct, it is recognized that the device to be verified has confidential information. As described above, the dialog proof can be appropriately performed using the one-way function.
[0019]
[Claims concerning the present invention]
Hereinafter, the claims concerning the present invention will be described.
[0020]
In order to achieve the above-described object, a device to be verified according to the present invention receives input of a transmission message and generates redundant information from the transmission message and generates the transmission message from the redundant information as described in claim 1. A redundant information generating unit that generates the redundant information generated based on the calculation formula designed so as to be output and outputs the calculation formula used for generation; and the redundant information and the calculation formula output by the redundant information generating unit; And a dialogue for performing dialogue proof using a one-way function between the verification device and the verification device using the calculation-linked redundant information obtained by the linkage by the calculation-linkage unit as a random number. The dialogue proof means transmits a calculation result obtained by calculating a one-way function on a random number as a first message in the dialog proof, and from the verification device. Receives an efficient question and sends the result of computing a one-way function on the random number itself or a value obtained from the random number and secret information as a second message according to the received question It is characterized by doing.
[0021]
Here, as described in claim 2, the redundant information generation unit preferably generates redundant information using a forward error correction code, and the redundant information generated using the forward error correction code is It is possible to correct the error on the receiving side of the added message, and to eliminate the need for message retransmission.
[0022]
Further, as described in claim 3, the redundant information generating means adds a random number bit to the transmission message and generates the redundant information from the added message using a forward error correction code. Preferably, a replay attack by a malicious third party can be prevented by adding a random number bit to the transmission message.
[0023]
Furthermore, in the above-described device to be verified, as described in claim 4, a Reed-Solomon code is used as a forward error correction code, and redundant data and a power used for generating the redundant data are concatenated. It is desirable to use a configuration that is used for dialogue proof as a random number, which can shorten the processing time and transmit and receive a large amount of forward error correction codes at high speed.
[0024]
In order to achieve the above-described object, the verification apparatus according to the present invention includes, as described in claim 5, a calculation formula in which redundant information and a calculation formula designed to generate a transmission message from the redundant information are connected. Dialog verification means for performing dialog proof using a one-way function with a device to be verified using the connected redundant information as a random number, and message generation means for generating a transmission message, In the dialogue proof, a calculation result obtained by calculating a one-way function on a random number is received as a first message, a probabilistic question is transmitted to the verified device, and a random number is returned as an answer to the question. Or a result obtained by performing a one-way function operation on a value obtained from the random number and the secret information as a second message, transmitted, the first message, and the second message If the verified device is proved based on the message, and the validity of the verified device is proved, the random number itself is output among the answers according to the question, and the message generating means is included in the output random number. The transmission message is generated based on the redundant information and the calculation formula.
[0025]
Here, as described in claim 6, it is desirable that the message generation means is configured to generate a received message from a verified message using a forward error correction code, and error correction is possible using the forward error correction code. Thus, it is possible to eliminate the need for message retransmission.
[0026]
In the verification apparatus, as described in claim 7, it is desirable that a Reed-Solomon code is used as the forward error correction code, which shortens the processing time and allows a large amount of forward error correction code to be processed at high speed. You can send and receive.
[0027]
By the way, the claim relating to the device to be verified can be described as a claim relating to the method to be verified as follows. In other words, the method to be verified according to the present invention is a method to be verified in a verification target device that performs dialogue proof using a one-way function with a verification device, And generating redundant information from the transmission message based on a calculation formula designed to generate the transmission message from the redundant information, and generating the redundant information and the calculation formula used for generation Concatenate, use the concatenated redundant information calculated by the concatenation as a random number, send the result of the computation of the one-way function to the random number as the first message, and the probabilistic question from the verification device In response to the received question, a random number itself or a calculation result obtained by calculating a one-way function on a value obtained from the random number and secret information is transmitted as a second message. It is characterized in.
[0028]
Moreover, the claim regarding said verification apparatus can be described as a claim regarding the verification method as follows. That is, in the verification method according to the present invention, as described in claim 9, the redundant information and the redundant information that has been combined with the calculation formula designed to generate a transmission message from the redundant information, A verification method in a verification device that performs dialogue proof using a one-way function with a device to be verified used as a random number, and a calculation result obtained by calculating a one-way function on a random number is a first message. As a response to the question, the random number itself or a value obtained from the random number and the secret information is calculated as a one-way function. When the result of the operation performed is received as the second message and the verified device is proved based on the transmitted question, the first message, and the second message, and the validity of the verified device is proved, Outputting a random number itself of respondents in response to questions, and generates a transmission message based on the redundancy information and formulas are included in the output random number.
[0029]
[Description of Message Transmission / Reception According to the Present Invention]
In the present invention, a random number (R) of a dialog proof system using a one-way function is used.₁, R₂, ... R_k) Is a method for delivering an arbitrary bit string to a communication partner without falsification. If it has been tampered with, it can be detected that it has been tampered with. Hereinafter, the discussion proceeds as a case where communication terminal A and communication terminal B communicate.
[0030]
In the present invention, first, the communication terminal A selects two prime numbers p and q, and generates n where n = pq. Next, from the secret information T, Z = T²  Z which becomes mod n is calculated, and Z and n are disclosed. The communication terminal B acquires Z and n of the communication terminal A.
[0031]
Next, the communication terminal A having the secret information T equally divides the message M to be transmitted to the communication terminal B into m pieces of the same size data, and uses the forward error correction code from the m pieces of divided data. Redundant data are generated (k> m). The k pieces of redundant information are expressed as (r₁, R₂, ... r_k) And r_iThe calculation formula used to calculate₁, F₂, ... f_k). And each (r_i, F_i) Is a random number (R₁, R₂, ... R_k) And X = R²The result calculated by mod n (X₁, X₂, ... X_k) To the communication terminal B.
[0032]
If the message M cannot be divided equally, the message M is padded with a random number so that the message M can be divided equally. A value that can specify the size of the message M is also included in the padding.
[0033]
Next, the communication terminal B selects a sequence of k {0, 1} (b₁, B₂, ... b_k) To the communication terminal A. Communication terminal A receives {0, 1} string (b₁, B₂, ... b_k) And answer (Y₁, Y₂, ... Y_k) To the communication terminal B.
[0034]
b_i= 0 when Y_i  = R_i
b_i  = 1 Y_i  = TR_i  mod n
[0035]
Communication terminal B has been sent from communication terminal A (Y₁, Y₂, ... Y_k) Satisfies the following formula.
[0036]
b_i= 0 when X_i  = Y_i ²  mod n
b_i  = 1 when ZX_i  = Y_i ²  mod n
[0037]
The communication terminal B determines that the communication terminal A is surely communicating with the communication terminal A only when i is 1 to k and all satisfy the above equation.
[0038]
After determining that the communication terminal B is reliably communicating with the communication terminal A, b_i  R sent when = 0_i  The message M divided by the communication terminal A into m in the above description is decoded using a forward error correction code.
[0039]
Through the above procedure, the communication terminal A can deliver an arbitrary message to the communication terminal B without being tampered with. If a message in any communication in the above procedure is falsified, an abnormality is immediately detected from the inspection result of the communication terminal B. Further, even if the communication terminal B and the communication terminal that wiretapped all communication contents through the communication path, the secret information T of the communication terminal A cannot be calculated.
[0040]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments relating to the present invention will be described below. Here, a dialogue proof method using a one-way function based on the quadratic residue problem is used, a Reed-Solomon code is used as a forward error correction code, and the device to be verified (communication terminal A) is a verification device (communication terminal). A case where an 8192-bit message is transmitted to B) will be described.
[0041]
[Device configuration]
First, the configuration of the device to be verified and the verification device will be described.
[0042]
FIG. 4 shows a functional block configuration of the verification target device 401. As shown in FIG. 4, the device under verification 401 is designed to receive a transmission message 405 that is a message to be transmitted as an input, and to calculate the redundancy information 406 from the transmission message (the transmission message can be restored from the redundancy information 406). A redundant information generation unit 402 that generates the redundant information 406 and the calculation formula 407, and a calculation formula connection unit 403 that links the redundant information 406 and the calculation formula 407 used for the generation. 5 and the dialogue certifying means 404 for performing dialogue proof with the verification device 501 in FIG. 5 using the calculation formula linked redundant information 408 obtained by concatenation as an input, and using the inputted calculation formula linked redundant information 408 as a random number. Composed. Among these, the dialogue proof means 404 determines X (X = R from the random number.²  mod n) and output as the first message 409. Further, when the second message 410 that is a probabilistic question (0 or 1) is input from the verification device 501, the dialog proving means 404 generates an answer to the question, and the generated answer is the first answer. 3 message 411 is output.
[0043]
FIG. 5 shows a functional block configuration of the verification apparatus 501. As shown in FIG. 5, the verification apparatus 501 includes a dialog proof unit 502 that outputs a verified third message 507 when performing dialog proof with the verified apparatus 401 in FIG. 4, and a verified third When the message 507 is input, a message is generated based on the redundant information and the calculation formula included in the third message 507 (that is, the transmission message 405 in FIG. 4 is restored), and the generated message is generated. Message generation means 503 that outputs the message as a received message 508.
[0044]
[Processing content]
Hereinafter, as the processing of the present embodiment, a dialogue proof method using a one-way function based on the quadratic residue problem is used, and a Reed-Solomon code is used as a forward error correction code, and a device to be verified (communication terminal A) ) Will be described with reference to FIGS. 6, 7, 2, and 3, in which the 8192-bit message is transmitted to the verification device (communication terminal B). 6 shows the processing in the verification target device (communication terminal A), FIG. 7 shows the processing in the verification device (communication terminal B), FIG. 2 shows the random number generation processing, and FIG. Show.
[0045]
First, the communication terminal A selects two prime numbers p and q and randomly generates 1024-bit secret information T (S601 in FIG. 6). Then, the communication terminal A generates n of 1024 bits where n = pq, and from the secret information T, Z = T²A 1024-bit Z that is mod n is calculated, and Z and n are disclosed (S602 in FIG. 6). Note that the operation subject of the processing of S601 and S602 is not limited to the communication terminal A, and the management center other than the communication terminals A and B performs the processing of S601 and S602, and the prime numbers p and q and the secret information T are obtained. You may notify to the communication terminal A by a safe method.
[0046]
One communication terminal B acquires Z and n disclosed by the communication terminal A (S701 in FIG. 7). Note that the processing of S701 to S711 is executed by the dialogue proving means 502.
[0047]
Next, the communication terminal A uses the redundant information generation unit 402 and the calculation formula connection unit 403 to generate calculation formula linked redundant information from the 8192-bit message M to be transmitted to the communication terminal B as follows (see FIG. 6 S603). That is, as shown in FIG. 3, the communication terminal A divides the 8192-bit message M to be transmitted to the communication terminal B into 16 pieces of 512-bit data (S301 in FIG. 3), and from the divided 16 pieces of data, GF (2¹⁶), 32 pieces of redundant data (r₁, R₂, ... r₃₂) Is generated (S302). Note that 32 redundant data (r₁, R₂, ... r₃₂) For calculating GF (2¹⁶) Is a power of 0 to 2, respectively.¹⁶-1 is randomly selected. Here, GF (2¹⁶), The Reed-Solomon code calculated in 16 bits is calculated every 16 bits._iIs calculated by dividing it into 32 blocks. Since the power of calculating each block can be expressed by 16 bits, the set of powers of 32 blocks can be expressed by 512 bits, and this can be expressed by each (r₁, R₂, ... r₃₂) For (f₁, F₂, ... f₃₂). Communication terminal A then (r_i, F_i) For each pair (R₁, R₂, ... R₃₂(S303). At this time, R_iIs 512 bits of r_i  And 512-bit f_i  Because it is a pair of 1024 bits. In this way, redundant information that has been linked with the calculation formula is generated.
[0048]
FIG. 2 shows a random number (R when transmitting an N-bit message.₁, R₂, ... R_k) Generation processing. Here, the random number generation processing of FIG. 2 will be outlined.
[0049]
When an N-bit transmission message is input (S201 in FIG. 2), random bits are padded so that the message becomes (integer multiple of 512 bits + 448 bits) (S202). Then, 64 bits representing N are added after the padding (S203). As a result, the message becomes an integer multiple of 512 bits (here, m times 512 bits).
[0050]
Next, the message is divided into m pieces of 512-bit data (S204). Note that the divided 512-bit data is D (1), D (2),... D (m). Each 512-bit data is divided into 32 16-bit blocks (S205). A 16-bit block obtained by dividing 512-bit data D (1) is defined as B (1,1), B (1,2),... B (1,32), and 512-bit data D (m) Let B (m, 1), B (m, 2),... B (m, 32) be 16-bit blocks obtained by dividing.
[0051]
Next, the counter i is reset to 0 (S206), and thereafter, the processes of S208 to S215 to be described later are repeated until the counter i becomes equal to 2 m.
[0052]
In S208, 512-bit empty data is generated (S208), and 32 random numbers from 0 to 65535 are generated (S209). It is assumed that the generated random numbers are f (i, 1), f (i, 2),... F (i, 32). Then, the counter j is reset to 1 (S210), and thereafter, B (1, j), B (2, j),... B (m, j) and the power multiplier f (i) until the counter j exceeds 32. , J), Reed-Solomon encoding is performed to generate redundant data r (i, j) (S212), and counter j is incremented by one (S213).
[0053]
When the counter j exceeds 32, the loop of S211 to S213 is exited, and redundant data r (i, 1), r (i, 2),... R (i, 32) and a random number f (i, 1) are obtained in S214. ), F (i, 2),... F (i, 32) are concatenated and 1024-bit data R_iIs output as Thereafter, the counter i is incremented by 1, and the process returns to S207.
[0054]
Thereafter, the processes of S208 to S215 described later are repeated until the counter i becomes equal to 2 m. As a result, redundant data r (i, 1), r (i, 2),... R (i, 32) and random numbers f (i, 1), f (i, 2),. 1024-bit data R concatenated with_i(R₁, R₂, ... R₃₂) Will be output.
[0055]
Random number (R₁, R₂, ... R₃₂) Is generated and output.
[0056]
Returning to FIG. 6 and FIG. 7, the communication terminal A then (R₁, R₂, ... R₃₂) From X = R mod n (X₁, X₂, ... X₃₂) As a first message to the communication terminal B (S604). Note that the processing after S604 is executed by the dialogue proof means 404.
[0057]
The communication terminal B receives the first message (S702), and as a probabilistic question, 32 {0, randomly selected so that 0 becomes 16 or more out of 32 {0, 1}. , 1} (b₁, B₂, ... b₃₂) Is transmitted to the communication terminal A (S703). Communication terminal A receives 32 {0, 1} strings from communication terminal B (b₁, B₂, ... b₃₂) Is received (S605).
[0058]
Next, the communication terminal A receives the {0, 1} string (b₁, B₂, ... b₃₂) And answer (Y₁, Y₂, ... Y₃₂) To the communication terminal B (S304 in FIG. 3).
[0059]
b_i= 0 when Y_i  = R_i
b_i  = 1 Y_i  = TR_i  mod n
[0060]
Here, the procedure in which the communication terminal A transmits the answer Y will be described along S606 to S611 in FIG. In S606, the counter i is reset to 1, and thereafter, the processes of S608 to S611 described later are repeated until the counter i becomes equal to the maximum number k (here, “32”). In S608, b_iDetermine whether is 0 and b_iIf Y is 0, Y in S609_i= R_iY_iIs transmitted to the communication terminal B.
[0061]
Meanwhile, b_iIf is not 0 (if 1), Y in S610_i= TR_i  mod n becomes Y_iIs transmitted to the communication terminal B. Thereafter, the counter i is incremented by 1 in S611, and the process returns to S607.
[0062]
Thereafter, the processes of S608 to S611 are repeated until the counter i exceeds the maximum number k. As a result, the communication terminal A receives the {0, 1} sequence from the communication terminal B (b₁, B₂, ... b₃₂) (Y)₁, Y₂, ... Y₃₂) To the communication terminal B.
[0063]
Returning to FIG. 7, the communication terminal B responds to the response (Y₁, Y₂, ... Y₃₂) And whether the received answer satisfies the following equation is checked in accordance with S705 to S710 in FIG.
[0064]
b_i= 0 when X_i  = Y_i ²  mod n
b_i  = 1 when ZX_i  = Y_i ²  mod n
[0065]
Here, a procedure for the communication terminal B to check the answer Y will be described. In S705 of FIG. 7, the counter i is reset to 1, and thereafter, the processes of S707 to S710 described later are repeated until the counter i becomes equal to the maximum number k (here, “32”). In S707, b_iDetermine whether is 0 and b_iIf X is 0, X in S708_i= Y_i ²  It is determined whether mod n is satisfied. If it is not established, the processing is terminated because the verification result is abnormal. X_i= Y_i ²  If mod n is satisfied, the process proceeds to S710.
[0066]
On the other hand, b in S707_iIf is not 0 (if 1), ZX in S709_i  = Y_i ²It is determined whether mod n is satisfied. If it is not established, the processing is terminated because the verification result is abnormal. ZX_i  = Y_i ²If mod n is satisfied, the process proceeds to S710.
[0067]
In S710, the counter i is incremented by 1, and the process returns to S706. Thereafter, the processes of S707 to S710 are repeated until the counter i exceeds the maximum number k. As a result, the communication terminal B responds to the response (Y₁, Y₂, ... Y₃₂) Will check one by one whether the above formula is satisfied. However, the communication terminal B continues communication with the communication terminal A only when i is 1 to 32 and all of the above expressions are satisfied. Cancel (It is also possible to set a threshold for the correct answer rate for canceling communication in advance and continue communication if a correct answer rate equal to or higher than the set value is obtained).
[0068]
If all the verification results are normal, the communication terminal B determines that b in FIG._iAnswer Y when is 0_iIs output.
[0069]
Then, the communication terminal B uses the message generation unit 503 to generate (restore) the message M using the forward error correction code as follows (S712, S305 in FIG. 3). That is, the communication terminal B is b_i  = Y when 0_i(R_i16)_iAnd f_i  And r with Reed-Solomon code_i  F_i  The 8192-bit message is restored by decoding with a power of.
[0070]
The Reed-Solomon code can restore the original message by using any 16 of the 32 pieces of redundant information. However, since the power is randomly selected, the same power as the other redundant data is accidentally selected. Redundant data cannot be used for restoration processing. In this case, the 17th b_i= 0 Y_i(R_i) Is required.
[0071]
By the series of processes described above, the 8192-bit message restored when the verification of the dialogue proof is passed is a message that has not been tampered with, and the message transmission / reception equivalent to the electronic signature is realized even in the quadratic residue problem. become.
[0072]
【The invention's effect】
As described above, according to the present invention, a message can be delivered to a communication partner without being falsified by applying a dialog proof system using a one-way function. This method can be realized based on all PSPACE problems and NP problems in which one-way functions exist, and even if a fast solution of a prime factorization problem or a discrete logarithm problem is discovered, other PSPACE problems and NP problems Can be equivalent to an electronic signature. In addition, if there is a PSPACE problem and an NP problem with the same difficulty with a shorter key length than the discrete logarithm problem on an elliptic curve, an electronic signature with a short public key length can be realized.
[Brief description of the drawings]
FIG. 1 is a sequence diagram of a dialog proof system using a one-way function.
FIG. 2 is a flowchart showing random number generation processing;
FIG. 3 is a diagram for explaining a message transmission / reception procedure;
FIG. 4 is a functional block diagram of a device to be verified.
FIG. 5 is a functional block diagram of the verification apparatus.
FIG. 6 is a flowchart showing processing in the verification target device.
FIG. 7 is a flowchart showing processing in the verification apparatus.
[Explanation of symbols]
401 ... Verified device, 402 ... Redundant information generation means, 403 ... Calculation formula connection means, 404 ... Dialogue certification means, 501 ... Verification apparatus, 502 ... Dialogue certification means, 503 ... Message generation means.

Claims (9)

Receives input of a transmission message, generates redundant information from the transmission message based on a calculation formula designed to generate the transmission message from the redundancy information, and generates the redundant information and the calculation formula used for generation Redundant information generating means for outputting
Calculation formula connecting means for connecting the redundant information and the calculation formula output by the redundant information generating means;
Dialogue proof means for performing dialogue proof using a one-way function with a verification device using the calculation formula linked redundant information obtained by linking by the formula linking means as a random number, The proof means is the dialog proof,
Sending the result of computing the one-way function on the random number as the first message,
A probabilistic question is received from the verification device, and a calculation result obtained by calculating a one-way function on the random number itself or a value obtained from the random number and the secret information according to the received question is a second result. A device to be verified, which is transmitted as a message. The apparatus to be verified according to claim 1, wherein the redundant information generation unit generates the redundant information using a forward error correction code. The apparatus to be verified according to claim 1, wherein the redundant information generating unit adds a random number bit to the transmission message, and generates the redundant information from the added message using a forward error correction code. . Reed-Solomon code is used as the forward error correction code,
4. The device to be verified according to claim 2, wherein a concatenation of redundant data and a power used to generate the redundant data is used as a random number for dialogue proof. Dialogue using a one-way function between a redundant device and a device to be verified that uses redundant information combined with a calculation equation designed to generate a transmission message from the redundant information as a random number A dialog proof means for proof, and
Message generating means for generating a transmission message,
In the dialog proof, the dialog proof means
Received as a first message the result of computing a one-way function on a random number,
Sending a probabilistic question to the device to be verified, and as a response to the question, the result of computing the one-way function on the random number itself or the value obtained from the random number and secret information is 2 as a message,
Proving the verified device based on the transmitted question, the first message, and the second message,
When the validity of the device to be verified is proved, the random number itself is output among the answers according to the question,
The message generation means includes:
A verification apparatus that generates a transmission message based on redundant information and a calculation formula included in an output random number. 6. The verification apparatus according to claim 5, wherein the message generation unit generates a received message from the verified message using a forward error correction code. The verification apparatus according to claim 6, wherein a Reed-Solomon code is used as the forward error correction code. A verified method in a verified device that performs dialogue proof using a one-way function with a verification device,
Accept input of outgoing messages,
Generate redundant information from the transmission message, based on a calculation formula designed to be able to generate the transmission message from the redundant information,
Link the generated redundant information and the calculation formula used for generation,
The calculation formula connected redundant information obtained by concatenation is used as a random number, and a calculation result obtained by performing a one-way function operation on the random number is transmitted as a first message,
Receive a probabilistic question from the verifier,
According to the received question, a random number itself or a calculation result obtained by calculating a one-way function on a value obtained from the random number and secret information is transmitted as a second message. Method of verification. Dialogue using a one-way function between a redundant device and a device to be verified that uses redundant information combined with a calculation equation designed to generate a transmission message from the redundant information as a random number A verification method in a verification device that performs proof,
A calculation result obtained by calculating a one-way function on a random number is received as a first message from the device to be verified,
Send a probabilistic question to the device under verification,
As a response to the question, a random number itself, or a calculation result obtained by calculating a one-way function on a value obtained from a random number and secret information is received as a second message,
Proving the verified device based on the transmitted question, the first message, and the second message,
When the validity of the device to be verified is proved, the random number itself is output among the answers according to the question,
A verification method characterized by generating a transmission message based on redundant information and a calculation formula included in an output random number.

Images