JP2008113315A - Signature generation device, signature verification device, methods and programs therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a third party from generating an unauthorized message restoration signature to pass signature verification. <P>SOLUTION: X denotes a secret key of a signature generation device, "m<SB>rec</SB>is one element of a set ä0, 1}<SP>M</SP>" is used as a recovery message, "m<SB>clr</SB>is one element of a set ä0, 1}<SP>N</SP>" is used as a clear message, h denotes a shared value between the signature generation device and a signature verification device, k is set as an optional value, g denotes a generating element of a cyclic group G of an order q, R denotes "g<SP>k</SP>is one element of a set G", H<SB>0</SB>denotes a hash function H<SB>0</SB>:ä0, 1}<SP>*</SP>→ä0, 1}<SP>L+M</SP>of output variable length, H<SB>1</SB>denotes a hash function H<SB>1</SB>:ä0, 1}<SP>*</SP>→ä0, 1}<SP>L</SP>, H<SB>3</SB>denotes a hash function H<SB>3</SB>:ä0, 1}<SP>*</SP>→Z<SB>q</SB>, β is expressed as β=(R, M), γ is expressed as γ=(r, m<SB>clr</SB>, M), t is expressed as t=H<SB>3</SB>(γ), s is expressed as "s=k-t×x is one element of a set Z" , r is expressed as r=H<SB>0</SB>(β)(+)(h¾m<SB>rec</SB>), (+) is expressed as "(+) denotes an exclusive OR operator" and a signature is expressed as σ=(r, s). <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an application technology of information security technology, and more particularly to a message restoration signature that can restore a message from a signature.

  Non-patent document 1 discloses a conventional technique for message restoration signature. This method has an advantage that a message that can be restored can be of variable length. Hereinafter, the signature method of Non-Patent Document 1 will be described in a simplified manner.

[Definition in Background Art]
P: element of cyclic group consisting of points on elliptic curve E hε {0,1} ^L , q, L: shared parameters between signature generation device and signature verification device x: secret key of signature generation device Y: secret Public key corresponding to key x (Y = x · P∈E)
m: Message to be signed F ₀ : {0,1} ^* → {0,1} ^{L + M} (Output bit length variable)
F ₁ : {0,1} ^* → Z _q

[Signature generation]
(s-1) Divide message m∈ {0,1} ^{N + M} into recovery message m _rec ∈ {0,1} ^M and clear message m _clr ∈ {0,1} ^N
(s-2) Select a random number k∈ {1, ..., n-1}
(s-3) R = k ・ P = (R ₁ , R ₂ ) ∈E
(s-4) Π = F ₀ (R ₁ ) ∈ {0,1} ^{L + M} (δ | ε is a bit combination of δ and ε)
(s-5) d = h | m _rec ∈ {0,1} ^{L + M}
(s-6) r = d (+) Π∈ {0,1} ^{L + M} (δ (+) ε is exclusive OR of δ and ε)
(s-7) t = F ₁ (r | m _clr ) ∈Z _q
(s-8) s = (kx ・ t) mod q
(s-9) σ = (r, s), m _clr output

[Signature verification]
(v-1) σ '= (r', s '), m _clr ' input
(v-2) t '= F ₁ (r' | m _clr ') ∈Z _q
(v-3) R '= s' ・ P + t' ・ Y = (R ₁ ', R ₂ ') ∈E
(v-4) Π '= F ₀ (R ₁ ') ∈ {0,1} ^{L + M '} (M' is the bit length of r 'minus L)
(v-5) d '= r' (+) Π '∈ {0,1} ^{L + M'}
(v-6) Extracting upper L bit h 'and lower M' bit m _rec 'of d'
(v-7) If h '= h, the verification is passed. _{M rec} 'output as recovery message
"ECPV (Elliptic Curve Pintsov-Vanstone message recovery signature)", INTERNATIONAL STANDARD ISO / IEC 9796-3, pp.27-29.

However, in the case of the signature method of Non-Patent Document 1, an attacker who has obtained the signature σ = (s, r) and the clear message m _clr may be able to generate a signature for another message that passes the signature verification. There is a problem. Details will be described below.
An attacker who has obtained the signature σ = (s, r) and the clear message m _clr can divide the bits of r included in the signature σ into r1 and m2 _clr where r = r1 | m2 _clr . Furthermore, the attacker can generate m1 _clr = m2 _clr | m _clr by bit-combining the divided m2 _clr and the obtained clear message m _clr .

Here, in order to satisfy r1 | m1 _clr = r1 | m2 _clr | m _clr = r | m _clr , t for a pair of normal r and m _clr and t for illegal r1 and m1 _clr extracted by the attacker Is
(s-7) t = F ₁ (r | m _clr ) = F ₁ (r1 | m1 _clr )… (1)
Is equal to And s
(s-8) s = (kx ・ t) mod q… (2)
_Therefore , s for a pair of regular r and m _clr is equal to s for illegal r1 and m1 _clr extracted by the attacker. That is, an attacker who has obtained the obtained normal signature σ = (s, r) and the clear message m _clr can generate a signature (r1, s) for the illegal clear message m1 _clr .

When such a signature (r1, s) and an illegal clear message m1 _clr are verified as described above, the following is obtained.
(v-2) t '= F ₁ (r' | m _clr ') = F ₁ (r1' | m1 _clr ') = t (from (1))
(v-3) R '= s' ・ P + t' ・ Y = s ・ P + t ・ Y = (R ₁ , R ₂ ) ∈E
(v-4) Π '= F ₀ (R ₁ ') = F ₀ (R ₁ ) ∈ {0,1} ^{L + M '} (M' is the value obtained by subtracting L from the bit length of r ')
(v-5) d '= r' (+) Π '= r1 (+) Π'∈ {0,1} ^{L + M'}
(v-6) The upper L bit h ′ and the lower M ′ bit m _rec ′ of d ′ are extracted. Here, the bit number of the m2 _clr part (r = r1 | m2 _clr ) removed from the regular r when the attacker generates r1 is equal to or less than the bit number M of the recovery message m _rec , and the function F ₀ If the upper L bits of F ₀ (R ₁ ) do not change when the number of bits of the output value of (R ₁ ) is changed from L + M to L + M ′, the attacker changes the r to r1. However, the upper L bits h ′ of d ′ are not affected. That is, h ′ = h and the verification is passed.

The present invention has been made in view of the above points, and a signature that can detect an attack in which an attacker who has obtained a signature σ = (s, r) and a clear message m _clr forges a signature on another message can be detected. The purpose is to provide a method.

[First Invention]
In the first aspect of the present invention, in order to solve the above-described problem, the signature generation apparatus generates a signature as follows.
First, an integer secret key x is stored in the first storage unit of the signature generation apparatus, and an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M is stored in the second storage unit, and N bits The clear message m _clr ε {0, 1} ^N of (N ≧ 1) is stored in the third storage unit. Next, the arbitrary value generation unit of the signature generation device generates an integer arbitrary value k, and the group operation unit sets G as the cyclic group of order q and g as the generation source of the cyclic group G. R = g ^k εG is calculated, and the calculation result R is output. Note that “g ^k εG” means that an operation forming the cyclic group G is executed k times for g (details will be described later). Next, the first hash operation unit of the signature generation apparatus has a hash function H ₀ : {0, 1} ^* → {0, whose output bit length is L + M bits (L is a positive integer shared with the signature verification apparatus). 1} ^{L + M} is applied to a value β determined depending on the operation result R, and an L + M bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the operation result, is output. Note that “acting a function ε on δ” means “substituting a value for specifying δ or δ into the function ε”. Further, the bit combination unit of the signature generation device places the shared value hε {0,1} ^L with the signature verification device at the first bit position, and sets the recovery message m _rec ε {0,1} ^M as the second bit. L + M bit combination value d = h | m _rec ∈ {0, 1} ^{L + M} arranged at the position is calculated, and the bit combination value d is output. The first bit position is not necessarily a continuous L bit position, and may be a total L bit position that is discretely arranged. Similarly, the second bit position is not necessarily a continuous M-bit position, and may be a total M-bit position that is discretely arranged. However, the bit positions of the “first bit position” and the “second bit position” are unified between the signature generation apparatus and the signature verification apparatus. Also, the exclusive OR operation unit of the signature generation apparatus calculates the exclusive OR r = Π (+) dε {0, 1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive logic The sum value r is output. Note that (+) is an exclusive OR operator, and δ (+) ε is an exclusive OR of δ and ε. Further, the third hash calculation unit of the signature generation device determines the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer depending on the exclusive OR value r and the clear message m _clr. The hash value t = H ₃ (γ) εZ, which is the calculation result, is output on the value γ. Then, the integer calculation unit of the signature generation apparatus calculates s = kt · xεZ and outputs the calculation result s, and the signature output unit outputs the signature σ = (r, s) and the clear message m _clr. Is output. Note that at least one of the value β and the value γ is a value determined depending on the bit length M of the recovery message m _rec .

The signature verification apparatus according to the first aspect of the present invention verifies the signature generated in this way as follows. The signature received by the signature verification apparatus is expressed as σ ′ = (r ′, s ′), and the clear message is expressed as m _clr ′.
First, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g is the signature verification apparatus. In the first storage unit. The signature σ ′ = (r ′, s ′) and the clear message m _clr ′ are input to the signature input unit of the signature verification apparatus and stored in the second storage unit. Further, the bit length extraction unit of the signature verification apparatus sets a value M ′ obtained by subtracting the value L (L is a positive integer shared with the signature generation apparatus) from the bit length of r ′ of the signature σ ′ to the signature σ ′. Extracted as the bit length M ′ of the corresponding recovery message m _rec ′ and stored in the third storage unit. Next, the first hash calculator of the signature verification apparatus outputs a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value, r ′ included in the signature σ ′, and a clear message m _clr ′. The hash value t ′ = H ₃ (γ ′) εZ, which is the result of the calculation, is output. In addition, the group calculation unit of the signature verification apparatus calculates R ′ = g ^{s ′} · y ^{t ′} εG and outputs the calculation result R ′. Note that “g ^{s ′} · y ^{t ′} ∈ G” means that the operation forming the cyclic group G is performed s ′ times for g, the operation is performed t ′ times for y, and the operation is performed on the respective operation results. (Details will be described later). In addition, the second hash calculation unit of the signature verification apparatus generates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M ′} having an output bit length of L + M ′ bits depending on the calculation result R ′. It acts on the fixed value β ^′ and outputs the hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} of the L + M ′ bit as the calculation result. Further, the exclusive OR operation unit of the signature verification apparatus performs an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} between the hash value Π ′ and r ′ included in the signature σ ′. ^' Is calculated and the exclusive OR value d' is output. Then, the comparison unit of the signature verification apparatus performs the shared value hε {0, 1} ^L with the signature generation device and the L-bit value h′ε {0, L at the first bit position of the exclusive OR value d ′. 1} Compares with ^L, and outputs information indicating that the verification is successful on condition that h ′ = h. Note that at least one of the values β ′ and γ ′ is a value determined depending on the bit length M ′ of the recovery message m _rec ′. Also, the bit configurations of the values β and γ used in the signature generation device and the bit configurations of the values β ′ and γ ′ used in the signature verification device need to be the same. For example, in the signature generation apparatus, when r is the upper L + M bits, m _clr is the next N bits, and the subsequent L bits are combined as M, the value of 2L + M + N bits is γ. The value of 2L + M ′ + N bits obtained by combining “L” as the upper L + M ′ bits, m _clr ′ as the next N ′ bit, and M ′ as the subsequent L bit is γ ′ (details will be described later).

As described above, according to the first aspect of the present invention, in the signature generation device, at least one of the value β and the value γ is further determined depending on the bit length M of the recovery message m _rec. , Each of the values β ′ and γ ′ is further determined depending on the bit length M ′ of the recovery message m _rec ′. Then, the signature verification apparatus extracts the value M ′ obtained by subtracting the value L from the bit length of r ′ of the input signature σ ′ as the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′.
Here, when the r ′ of the signature σ ′ input to the signature verification apparatus is r1 (r = r1 | m2 _clr ) generated by the above attack method, the bit length M ′ is a valid r∈ { 0, 1} shorter than the bit length ^M of ^{L + M} (M ′ <M). In this case, since at least one of the values β ′ and γ ′ is a value determined depending on the bit length M ′ extracted by the signature verification apparatus, at least one of β = β ′ and γ = γ ′ is not established. It becomes.
When β ≠ β ′, Π ′ = H ₀ (β ′) ≠ H ₀ (β) = Π and d ′ = Π ′ (+) r ′ ≠ d, so that the first of d ′ The value h ′ of the bit position is different from the value h of the first bit position of d (h ′ ≠ h), and signature verification fails. Further, when γ ≠ γ ′, t ′ = H ₃ (γ ′) ≠ H ₃ (γ) = t, so that R ′ = g ^{s ′} · y ^{t ′} ≠ g ^k = R, and R ′ The value β ′ determined depending on ## EQU1 ## becomes β ′ ≠ β, and similarly signature verification fails. Thereby, an illegal signature generated by the above-described attack method can be detected with high probability.

[Second Invention]
In the second aspect of the present invention, in order to solve the above-described problem, the signature generation apparatus generates a signature as follows.
First, an integer secret key x is stored in the first storage unit of the signature generation apparatus, and an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M is stored in the second storage unit, and N bits The clear message m _clr ε {0, 1} ^N of (N ≧ 1) is stored in the third storage unit. Next, the arbitrary value generation unit of the signature generation device generates an integer arbitrary value k, and the group operation unit sets G as the cyclic group of order q and g as the generation source of the cyclic group G. R = g ^k εG is calculated, and the calculation result R is output. Also, the first hash calculator of the signature generation device has a hash function H ₀ : {0, 1} ^* → {0, 1 with an output bit length of L + M bits (L is a positive integer shared with the signature verification device). } ^{L + M} is applied to a value β determined depending on the operation result R, and an L + M bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the operation result, is output. Further, the bit combination unit of the signature generation device places the shared value hε {0,1} ^L with the signature verification device at the first bit position, and sets the recovery message m _rec ε {0,1} ^M as the second bit. L + M bit combination value d = h | m _rec ∈ {0, 1} ^{L + M} arranged at the position is calculated, and the bit combination value d is output. Then, the exclusive OR operation unit of the signature generation apparatus calculates an exclusive OR r = Π (+) dε {0, 1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive logic The sum value r is output, and the third hash calculator calculates the hash function H ₃ : {0,1} ^* → Z whose output value is an integer depending on the exclusive OR value r and the clear message m _clr A hash value t = H ₃ (γ) εZ, which is the calculation result, is output on the fixed value γ. Then, the integer calculation unit of the signature generation apparatus calculates s = kt · xεZ and outputs the calculation result s, and the signature output unit outputs the signature σ = (r, s) and the clear message m _clr. Is output. Note that at least one of the values β and γ is a value determined depending on the bit length N of the clear message m _clr .

The signature verification apparatus according to the second aspect of the present invention verifies the signature generated in this way as follows.
First, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g is the signature verification apparatus. In the first storage unit. The signature σ ′ = (r ′, s ′) and the clear message m _clr ′ are input to the signature input unit of the signature verification apparatus and stored in the second storage unit. Further, the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ is stored in the third storage unit of the signature verification apparatus, and the bit length N ′ of the clear message m _clr ′ is stored in the fourth storage unit. Note that a method by which the signature verification apparatus acquires the value of the bit length M ′ will be described later. In addition, the first hash calculator of the signature verification apparatus converts the hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value into r ′ included in the signature σ ′ and the clear message m _clr ′. The hash value t ′ = H ₃ (γ ′) εZ, which is the calculation result, is output by acting on the value γ ′ determined depending on the dependency. Further, the group calculation unit of the signature verification apparatus calculates R ′ = g ^{s ′} · y ^{t ′} εG, outputs the calculation result R ′, and the second hash calculation unit outputs the output bit length L + M ′. A hash function H _{0 of} bits (L is a positive integer shared with the signature generation device): {0, 1} ^* → {0, 1} ^{L + M ′} is set to a value β ′ determined depending on the operation result R ′. The L + M′-bit hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} , which is the operation result, is output. Also, the exclusive OR operation unit of the signature verification apparatus performs exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} between the hash value Π ′ and r ′ included in the signature σ ′. ^' Is calculated and the exclusive OR value d' is output. Then, the comparison unit of the signature verification apparatus performs the shared value hε {0, 1} ^L with the signature generation device and the L-bit value h′ε {0, L at the first bit position of the exclusive OR value d ′. 1} Compares with ^L, and outputs information indicating that the verification is successful on condition that h ′ = h. Note that at least one of the value β ′ and the value γ ′ is a value determined depending on the bit length N ′ of the clear message m _clr ′. Further, the bit configurations of the values β and γ used in the signature generation device and the bit configurations of the values β ′ and γ ′ used in the signature verification device need to be the same (details will be described later).

As described above, according to the second aspect of the present invention, in the signature generation device, at least one of the value β and the value γ is further determined depending on the bit length N of the clear message m _clr. In FIG. 5, at least one of the value β ′ and the value γ ′ is set to a value determined depending on the bit length N ′ of the clear message m _clr ′, and each process is performed.
Here, if the clear message m _clr ′ input to the signature verification apparatus is m1 _clr (m1 _clr = m2 _clr | m _clr ) generated by the above attack method, the bit length N ′ is a valid clear. message _{m clr} ∈ ^{0,1} longer than the bit length N of the ^N (N '> N). In this case, since at least one of the value β ′ and the value γ ′ is a value determined depending on the bit length N ′ of the clear message m _clr ′, at least one of β = β ′ and γ = γ ′ is not established. It becomes. As a result, similar to the first aspect of the present invention, an illegal signature generated by the above attack method can be detected with high probability.

[Third Invention]
In the third aspect of the present invention, in order to solve the above-described problem, the signature generation apparatus generates a signature as follows.
First, an integer secret key x is stored in the first storage unit, an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M is stored in the second storage unit, and N bits (N ≧ 1) ) Clear message m _clr ε {0, 1} ^N is stored in the third storage unit. Then, the arbitrary value generation unit of the signature generation device generates an integer arbitrary value k, and the group calculation unit determines that the cyclic group of order q is G, and the generation source of the cyclic group G is g. = G ^k εG is calculated, and the calculation result R is output.
Next, the first hash operation unit of the signature generation apparatus has a hash function H ₀ : {0, 1} ^* → {0, whose output bit length is L + M bits (L is a positive integer shared with the signature verification apparatus). 1} ^{L + M} is applied to a value β determined depending on the operation result R, and an L + M bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the operation result, is output. Next, the second hash calculator of the signature generation device determines the hash function H ₁ : {0,1} ^* → {0,1} ^L having an output bit length of L bits depending on the recovery message m _rec. An L-bit hash value h = H ₁ (α) ε {0, 1} ^L , which is the result of the operation, is output on the value α. In addition, the bit combination unit of the signature generation device arranges the hash value hε {0,1} ^L at the first bit position and L + M arranges the recovery message m _rec ε {0,1} ^M at the second bit position. Bit combination value d = h | m _rec ∈ {0, 1} ^{L + M} is calculated, and the bit combination value d is output. Next, the exclusive OR operation unit of the signature generation apparatus calculates the exclusive OR r = Π (+) d∈ {0, 1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive OR The logical sum r is output, and the third hash calculator depends on the exclusive logical value r and the clear message m _clr for the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer. The hash value t = H ₃ (γ) εZ that is the calculation result is output. Thereafter, the integer operation unit calculates s = kt · xεZ, outputs the operation result s, and the signature output unit outputs the signature σ = (r, s) and the clear message m _clr. .

The signature verification apparatus according to the third aspect of the present invention verifies the signature generated in this way as follows.
First, when the first storage unit of the signature verification apparatus sets G as the cyclic group of order q and g as the generation source of the cyclic group G, the public key corresponding to the secret key xεZ of the signature generation apparatus Store y = g ^x ∈G. The signature σ ′ = (r ′, s ′) and the clear message m _clr ′ are input to the signature input unit of the signature verification apparatus and stored in the second storage unit. Further, the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ is stored in the third storage unit. Note that a method by which the signature verification apparatus acquires the value of the bit length M ′ will be described later. Then, the first hash calculation unit of the signature verification apparatus depends on the hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value depending on r ′ included in the signature σ ′ and the clear message m _clr The hash value t ′ = H ₃ (γ ′) εZ, which is the result of the operation, is output. Further, the group calculation unit of the signature verification apparatus calculates R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the calculation result R ′. Next, the second hash calculator calculates a hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} with an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device). ^' Is applied to a value β ′ determined depending on the operation result R ′, and an L + M′-bit hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} , which is the operation result, is output. . Further, the exclusive OR operation unit calculates an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. , The exclusive OR value d ′ is output. In addition, the third hash calculation unit of the signature verification apparatus converts the hash function H ₁ having an output bit length of L bits: {0, 1} ^* → {0, 1} ^L to the second exclusive OR value d ′. The value m _rec '∈ {0, 1} of the M ′ bit at the bit position is _operated on the value α ′ determined depending on ^{M ′} , and the L-bit hash value H ₁ (α ′) ∈ {0 as the operation result , 1} ^L is output. Then, the comparison unit of the signature verification apparatus compares the L-bit value h′∈ {0, 1} ^L at the first bit position of the exclusive OR value d ′ with the hash value H ₁ (α ′). , H ′ = H ₁ (α ′) is output on the condition that the verification is successful.

The “value α determined depending on m _rec ” includes not only the case where the value α depends only on m _rec but also the case where the value α depends on m _rec and other information. The “value β determined depending on R” includes not only the case where the value β depends only on R, but also the case where the value β depends on R and other information. “R and m _clr The value γ determined depending on “” includes not only the case where the value γ depends only on r and m _clr , but also the case where the value γ depends on Π, m _rec and other information. Similarly, in “value α ′ determined depending on m _rec ′”, not only when value α ′ depends only on m _rec ′, but also on value α ′ depends on m _rec ′ and other information. The value “β ′ determined depending on R ′” includes not only the case where the value β ′ depends only on R ′ but also the case where the value β ′ depends on R ′ and other information. The “value γ determined depending on r ′ and m _clr ′” includes not only the case where the value γ ′ depends only on r ′ and m _clr ′, but also the value γ ′ is r ′. A case where it depends on m _clr ′ and other information is also included.
However, the bit configurations of the values α, β, and γ used in the signature generation device and the bit configurations of the values α ′, β ′, and γ ′ used in the signature verification device need to be the same. For example, in the signature generation apparatus, when r is an upper L + M bit and m _clr is a lower N bit and the value of L + M + N bits is γ, also in the signature verification apparatus, r ′ is an upper L + M ′ bit and m _clr The value of the L + M ′ + N ′ bits combined with “lower N” bits must be γ ′ (details will be described later).

As described above, in the third aspect of the present invention, the signature generation apparatus calculates the hash value h = H ₁ (α) ∈ {0, 1} ^L of the value α determined depending on the recovery message m _rec, and The bit combination value d = h | m _rec ε {0, 1} ^{L + M} is calculated by placing the value h in the first bit position and the recovery message m _rec in the second bit position, and depending on the operation result R The hash value ま る = H ₀ (β) ε {0,1} ^{L + M} of the fixed value β is calculated, and r = Π (+) dε {0,1} ^{L + M} is calculated. Also, in the signature verification apparatus, d ′ = Π ′ (+) r ′ is calculated, and the value α ′ determined depending on the value m _rec ′ ′ {0, 1} ^{M ′} of the second bit position of d ′. The hash value H ₁ (α ′) ε {0,1} ^L is compared with the value h′ε {0,1} ^L of the first bit position of d ′. To do.

Here, when r ′ of the signature σ ′ input to the signature verification apparatus is r1 (r = r1 | m2 _clr ) generated by the above-described attack method, r ′ = r1 ≠ r, which is high. The probability is d ′ = Π ′ (+) r ′ ≠ d. In this case, (d ′ second bit position value m _rec ′) = (d second bit position value m _rec ) and (d ′ first bit position value h ′) = (first d At least one of the bit position values h) is always not established. As a result, the hash value H ₁ (α ′) ∈ {0, 1} ^{L of the} value α ′ determined depending on the value m _rec '∈ {0, 1} ^M ′ of the second bit position of d ′, and d The value h′∈ {0, 1} ^L in the first bit position of “′” does not match, and an illegal signature generated by the above-described attack method can be detected with high probability.

[Fourth Invention]
In the fourth aspect of the present invention, in order to solve the above-described problem, the signature generation apparatus generates a signature as follows.
First, an integer secret key x is stored in the first storage unit of the signature generation apparatus, and an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M is stored in the second storage unit, and N bits The clear message m _clr ε {0, 1} ^N of (N ≧ 1) is stored in the third storage unit. Further, the R in the case where the arbitrary value generation unit of the signature generation apparatus generates an integer arbitrary value k, and the group calculation unit sets G as the cyclic group of order q and g as the generation source of the cyclic group G. = G ^k εG is calculated, and the calculation result R is output. Next, the first hash operation unit of the signature generation apparatus has a hash function H ₀ : {0, 1} ^* → {0, whose output bit length is L + M bits (L is a positive integer shared with the signature verification apparatus). 1} ^{L + M} is applied to a value β determined depending on the operation result R, and an L + M bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the operation result, is output. Further, the second hash calculator of the signature generation device determines the hash function H ₁ : {0,1} ^* → {0,1} ^L whose output bit length is L bits depending on the clear message m _clr Acting on α, an L-bit hash value h = H ₁ (α) ε {0, 1} ^L , which is the calculation result, is output. Next, the bit combination unit of the signature generation device places the hash value hε {0,1} ^L in the first bit position and places the recovery message m _rec ε {0,1} ^M in the second bit position. L + M bit combination value d = h | m _rec ε {0, 1} ^{L + M} is calculated, and the bit combination value d is output. Then, the exclusive OR operation unit of the signature generation apparatus calculates an exclusive OR r = Π (+) dε {0, 1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive logic The sum value r is output, and the third hash calculator calculates the hash function H ₃ : {0,1} ^* → Z whose output value is an integer depending on the exclusive OR value r and the clear message m _clr A hash value t = H ₃ (γ) εZ, which is the calculation result, is output on the fixed value γ. Then, the integer calculation unit of the signature generation apparatus calculates s = kt · xεZ and outputs the calculation result s, and the signature output unit outputs the signature σ = (r, s) and the clear message m _clr. Is output.

The signature verification apparatus according to the fourth aspect of the present invention verifies the signature generated in this way as follows.
First, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g is the signature verification apparatus. In the first storage unit. Also, the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ are input to the signature input unit of the signature verification apparatus and stored in the second storage unit. Further, the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ is stored in the third storage unit. Next, the first hash calculator of the signature verification apparatus outputs a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value, r ′ included in the signature σ ′, and a clear message m _clr ′. The hash value t ′ = H ₃ (γ ′) εZ, which is the result of the calculation, is output. Further, the group calculation unit calculates R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the calculation result R ′. Then, the second hash calculation unit has a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M ′} having an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device). Is applied to the value β ′ determined depending on the operation result R ′, and the L + M′-bit hash value β ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} , which is the operation result, is output, The exclusive OR operation unit of the signature verification apparatus obtains an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. Calculate and output the exclusive OR value d ′. Further, the third hash calculator of the signature verification apparatus determines the hash function H ₁ : {0,1} ^* → {0,1} ^L having an output bit length of L bits depending on the clear message m _clr ′. An L-bit hash value H ₁ (α ′) ∈ {0, 1} ^L , which is the operation result, is output on the value α ′. Then, the comparison unit of the signature verification apparatus compares the L-bit value h′∈ {0, 1} ^L at the first bit position of the exclusive OR value d ′ with the hash value H ₁ (α ′). , H ′ = H ₁ (α ′) is output on the condition that the verification is successful.

As described above, in the fourth aspect of the present invention, the signature generation apparatus calculates the hash value h = H ₁ (α) ∈ {0, 1} ^L of the value α determined depending on the clear message m _clr , and the hash The bit combination value d = h | m _rec ε {0, 1} ^{L + M} is calculated by placing the value h in the first bit position and the recovery message m _rec in the second bit position, and depending on the operation result R The hash value ま る = H ₀ (β) ε {0,1} ^{L + M} of the fixed value β is calculated, and r = Π (+) dε {0,1} ^{L + M} is calculated. Also, in the signature verification apparatus, d ′ = Π ′ (+) r ′ is calculated, and the hash value H ₁ (α ′) ∈ {0, 1} ^{L of the} value α ′ determined depending on the clear message m _clr ′. And the value h′∈ {0, 1} ^L of the first bit position of d ′ are compared, and if they match, the signature verification is passed.

Here, when the clear message m _clr ′ input to the signature verification apparatus is m1 _clr (m1 _clr = m2 _clr | m _clr ) generated by the above-described attack method, α ′ ≠ α, which is always a hash value H ₁ (α ′) ≠ hash value H ₁ (α) = h. Therefore, even if the value h ′ of the first bit position of d ′ is h, H ₁ (α ′) ≠ h ′, and it is possible to detect an illegal signature generated by the above attack method with a high probability. it can.
The first and second inventions may be applied to the third and fourth inventions. That is, in the third and fourth present inventions, at least one of the value β and the value γ is further determined depending on the bit length M of the recovery message m _rec , and at least the value β ′ and the value γ ′. One value may be a value determined depending on the bit length M ′ of the recovery message m _rec ′ extracted by the signature verification apparatus. In the third and fourth present inventions, at least one of the value β and the value γ is further determined depending on the bit length N of the clear message m _clr , and at least the value β ′ and the value γ ′. One value may be a value determined depending on the bit length N ′ of the clear message m _clr ′ input to the signature verification apparatus. As a result, an illegal signature generated by the above attack method can be detected with a higher probability.

As described above, according to the present invention, it is possible to detect an attack in which an attacker who has obtained the signature σ = (s, r) and the clear message m _clr forges a signature for another message.

The best mode for carrying out the present invention will be described below with reference to the drawings.
[First Embodiment]
First, the first embodiment will be described. The first embodiment is an embodiment according to the first present invention.
<Overall configuration>
FIG. 1 is a conceptual diagram showing the overall configuration of the signature system 1 of the first embodiment.
As shown in FIG. 1, the signature system 1 of this embodiment includes a signature generation device 10 that generates a signature, a signature verification device 20 that performs signature verification, and a public key server device 30 that publishes the effect key of the signature generation device 10. And are connected to each other through the network 40 so that they can communicate with each other. The signature generation device 10, the signature verification device 20, and the public key server device 30 are each configured by reading a predetermined program into a known computer.

<Configuration of Signature Generation Device 10>
Next, the configuration of the signature generation apparatus 10 will be described.
[Hardware configuration]
FIG. 2 is a block diagram illustrating a hardware configuration of the signature generation device 10 according to the first embodiment.
As illustrated in FIG. 2, the signature generation apparatus 10 of this example includes a CPU (Central Processing Unit) 11, an input unit 12, an output unit 13, an auxiliary storage device 14, a ROM (Read Only Memory) 15, a RAM (Random Access). Memory) 16, bus 17, and communication unit 18.
The CPU 11 in this example includes a control unit 11a, a calculation unit 11b, and a register 11c, and executes various calculation processes according to various programs read into the register 11c. The input unit 12 in this example is an input port for inputting data, a keyboard, a mouse, and the like, and the output unit 13 is an output port for outputting data, a data storage device to an external recording medium, a printing device, and a display. Etc. The auxiliary storage device 14 is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, or the like, and has a program area 14a storing various programs and a data area 14b storing various data. The RAM 16 is, for example, an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory) or the like, and has a program area 16a in which the above program is written and a data area 16b in which various data are written. The communication unit 18 is a network card or the like. The bus 17 in this example connects the CPU 11, the input unit 12, the output unit 13, the auxiliary storage device 14, the ROM 15, the RAM 16, and the communication unit 18 so that data can be exchanged.

[Cooperation between hardware and programs]
The CPU 11 (FIG. 2) writes the program stored in the program area 14 a of the auxiliary storage device 14 in the program area 16 a of the RAM 16 according to the read OS (Operating System) program. Similarly, the CPU 11 writes various data stored in the data area 14 b of the auxiliary storage device 14 in the data area 16 b of the RAM 16. The address on the RAM 16 where the program and data are written is stored in the register 11c of the CPU 11. The control unit 11a of the CPU 11 sequentially reads these addresses stored in the register 11c, reads a program and data from the area on the RAM 16 indicated by the read address, and causes the calculation unit 11b to sequentially execute the operation indicated by the program. The calculation result is stored in the register 11c. Each program may be described as a single program sequence, or at least some of the programs may be stored in the library as separate modules.

FIG. 3 is a block diagram illustrating a functional configuration of the signature generation device 10 according to the first embodiment configured by reading a program into the CPU 11. The arrows in FIG. 3 indicate the flow of data, but the flow of data input to and output from the temporary memory 10t and the control unit 10s is omitted.
As shown in FIG. 3, the signature generation apparatus 10 according to the present exemplary embodiment includes a storage unit 10a, a secret key generation unit 10b, a public key generation unit 10c, an input unit 10d, a message division unit 10e, and an arbitrary value generation unit. 10f, group operation unit 10g, hash operation units 10h and 10p, bit combination unit 10m, exclusive OR operation unit 10n, integer operation unit 10q, communication unit 10r, control unit 10s, and temporary memory 10t.
FIG. 4 is a diagram showing details of the functional configuration of the hash calculation unit 10h. As shown in FIG. 4, the hash calculation unit 10h includes a hash number calculation unit 10ha, a partial hash calculation unit 10hb, a bit combination unit 10hc, and a bit deletion unit 10hd.

Note that the storage unit 10a and the temporary memory 10t correspond to, for example, the register 11c, the auxiliary storage device 14, the RAM 16, or a storage area obtained by combining these, as illustrated in FIG. Further, the secret key generation unit 10b, the public key generation unit 10c, the message division unit 10e, the arbitrary value generation unit 10f, the group calculation unit 10g, the hash calculation units 10h and 10p, and the bit combination unit 10m are exclusive. The logical OR operation unit 10n, the integer operation unit 10q, and the control unit 10s are configured by reading a program for realizing each processing into the CPU 11. The input unit 10d is an input unit 12 that is driven under the control of the CPU 11 into which a predetermined program has been read. The communication unit 10r is a communication unit that is driven under the control of the CPU 11 into which a predetermined program has been read. 18. In addition, the signature generation device 10 executes each process under the control of the control unit 10s. Further, unless otherwise specified, each data in the calculation process is read from and written to the temporary memory 10t.
Further, the above program may be a program that can realize the function alone, or the program may read out another library (not described) to realize each function. That is, at least a part of each program corresponds to a program for causing a computer to execute the function of the signature generation apparatus 10.

<Configuration of Signature Verification Device 20>
Next, the configuration of the signature verification apparatus 20 will be described.
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
The signature verification apparatus 20 is also configured by reading a predetermined program into a computer as shown in FIG. FIG. 5 is a block diagram illustrating a functional configuration of the signature verification apparatus 20 according to the first embodiment configured as described above. Note that the arrows in FIG. 5 indicate the flow of data, but the flow of data input to and output from the temporary memory 20p and the control unit 20n is omitted.
As shown in FIG. 5, the signature verification apparatus 20 of this embodiment includes a storage unit 20a, a communication unit 20b, a bit length extraction unit 20c, hash calculation units 20d and 20f, a group calculation unit 20e, an exclusive logic It has a sum operation unit 20g, a bit extraction unit 20h, a comparison unit 20i, an output unit 20m, a control unit 20n, and a temporary memory 20p.

The storage unit 20a and the temporary memory 20p correspond to, for example, a register included in the computer, an auxiliary storage device, a RAM, or a storage area obtained by combining these. The bit length extraction unit 20c, the hash calculation units 20d and 20f, the group calculation unit 20e, the exclusive OR calculation unit 20g, the bit extraction unit 20h, the comparison unit 20i, and the control unit 20n are respectively The program for realizing this processing is configured to be read by the CPU. The output unit 20m and the communication unit 20b are driven under the control of the CPU loaded with a predetermined program. In addition, the signature verification apparatus 20 executes each process under the control of the control unit 20n. Further, unless otherwise specified, each data in the calculation process is read and written to the temporary memory 20p one by one.
Further, the above program may be a program that can realize the function alone, or the program may read out another library (not described) to realize each function. That is, at least a part of each program corresponds to a program for causing a computer to execute the function of the signature verification apparatus 20.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
First, a cyclic group G that is difficult to find a discrete logarithm problem of order q used in the signature system 1 and its generation source gεG are determined. As such a cyclic group G, for example, a group formed by rational points on an elliptic curve or a multiplicative group of a finite field can be used. The order q is preferably a prime number from the viewpoint of safety. In addition, the bit length parameter LεZ _{> 0} (an integer greater than ₀ ) and the shared value hε {0,1} ^L used in the signature system 1 are determined.
Further, a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M} whose output bit length is determined to be L + M bits according to the bit length M of a recovery message m _rec described later is determined. A method for calculating such a hash function will be described later.

Also, hash function H ₁ for outputting an L-bit hash value for the input value: {0, 1} ^* → {0, 1} ^L, and Z _q (q is modulo for the input value Hash function H ₃ : {0, 1} ^* → Z _q that outputs an element of a complete residue system) is determined. The hash function H ₁ can be configured in the same manner as the hash function H _0, and the hash function H ₃ can be configured by performing a remainder operation modulo q on a hash value such as SHA-1.
Information specifying the cyclic group G and the hash functions H ₀ , H ₁ , and H ₃ determined as described above is written in each program constituting the signature generation device 10 and the signature verification device 20, for example, to generate a signature. It is assumed that the device 10 and the signature verification device 20 can perform operations on the determined cyclic group G and operations of the hash functions H ₀ , H ₁ , and H ₃ . The bit length parameter LεZ _{> 0} , the shared value hε {0,1} ^L , the order q, and the generation source gεG are stored in the storage unit 10a of the signature generation device 10 and the storage unit 20a of the signature verification device 20, respectively. Stored in

[Key generation process]
Next, a key generation process performed by the signature generation apparatus 10 will be described.
First, the secret key generator 10b of the signature generating apparatus 10 generates an arbitrary secret key x∈Z _q. The secret key x may be generated by mapping a pseudo-random number to _Zq or based on a value arbitrarily determined by the signature generator. The generated secret key x is securely stored in the storage unit 10a of the signature generation device 10. That is, a device external to the signature generation device 10 cannot acquire the secret key x from the storage unit 10a.

Next, the public key generation unit 10c of the signature generation apparatus 10 reads the secret key x and the generation group gεG of the cyclic group G from the storage unit 10a, and performs an operation defined by the cyclic group G.
y = g ^x ∈G (3)
To generate a public key yεG corresponding to the secret key x and store it in the storage unit 10a. For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (3) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is an elliptic scalar multiplication (ellipse x times) (x · gεE), and the public key y is a point on the elliptic curve E. Also, for example, when the cyclic group G is a finite field multiplicative group, the right side of the equation (3) means g ^x mod p (where p = 2q + 1), and the public key y is a scalar value and Become. The generated public key y is transmitted from the communication unit 10r to the public key server device 30 through the network 40, and the public key server device 30 publishes the transmitted public key y together with, for example, a public key certificate. The public key y and the like are publicly stored in the storage unit of the public key server device 30 and any device that can be connected to the network 40 is stored in the storage unit of the public key server device 30. This means that the public key y and the like can be acquired. The signature verification device 20 receives the public key y from the public key server device 30 through the communication unit 20b and stores it in the storage unit 20a.

[Signature generation processing]
Next, a signature generation process according to the first embodiment will be described.
FIG. 6 is a flowchart for explaining the signature generation processing according to the first embodiment. Hereinafter, the signature generation processing of this embodiment will be described with reference to FIG.
First, the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 are input to the input unit 10d of the signature generation apparatus 10 (FIG. 3) (step S11). These pieces of input information are stored in the storage unit 10a.

Next, the message dividing unit 10e reads the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 from the storage unit 10a. The message dividing unit 10e uses these pieces of information,
The message mε {0,1} ^{N + M is changed} into a recovery message m _rec ε {0,1} ^M having a bit length ^M and a clear message m _clr ε {0,1} ^N having a bit length N (N ≧ 0). Divide (step S12). For example, the upper M bits of the message mε {0,1} ^{N + M} are the recovery message m _rec ε {0,1} ^M , and the lower N bits are the clear message m _clr ε {0,1} ^N. The division method is not limited to this, and which bit of the message mε {0,1} ^{N + M} is the recovery message m _rec and which bit is the clear message m _clr
It can be arbitrarily set. The bit length M recovery message m _rec ε {0, 1} ^M and the bit length N clear message m _clr ε {0, 1} ^N are stored in the storage unit 10a.

Next, the arbitrary value generation unit 10f generates an arbitrary value kεZ _q , and stores the generated arbitrary value k in the storage unit 10a (step S13). The generation of arbitrary value k is performed, for example, by mapping a pseudo random number to Z _q.
Next, the group calculation unit 10g reads the generation source gεG and the arbitrary value kεZ _q from the storage unit 10a,
R = g ^k ∈G (4)
And the calculation result RεG is output to the storage unit 10a and stored (step S14). For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (4) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is an elliptic scalar multiplication (ellipse k times) (k · gεE), and the operation result R is a point on the elliptic curve E. For example, when the cyclic group G is a multiplicative group of a finite field, the right side of the equation (4) means an operation of g ^k mod p, and the operation result R is a scalar value.

Next, the hash calculation unit 10h reads the calculation result RεG, the bit length M of the recovery message m _rec , and the bit length parameter L from the storage unit 10a. The hash calculation unit 10h _generates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M} , in which the output bit length is determined as L + M bits according to the bit length M of the recovery message m _rec , the calculation result R and the bit L + M-bit hash value さ せ = H ₀ (β) ∈ {0,1} ^{L + M} (5) acting on a value β determined depending on the length M
Is output and stored in the storage unit 10a (step S15). In the first embodiment, β is a value γ = (R, M) that depends only on the calculation result R and the bit length M. In addition, although there is no limitation on the β configuration method of the present embodiment, the β configuration method is the same as the β ′ configuration method in the signature verification apparatus 20 described later. Examples of the configuration of β in this embodiment include the following.

If the cyclic group G is a group of rational points on the elliptic curve E:
[Β-1] A value (for example, the x-coordinate or y-coordinate of the point R, or the x-coordinate and y-coordinate of the point R) that can uniquely or exclusively specify the calculation result R that is a point on the elliptic curve E Bit combined value) is the upper bit, and M is the lower bit and the combined value is β.
[Β-2] A value obtained by uniquely or limitedly specifying the calculation result R that is a point on the elliptic curve E is a lower bit, and a value obtained by combining M with an upper bit is β.
[Β-3] In accordance with a predetermined rule, a value obtained by uniquely arranging or combining each bit of M with a value that can uniquely specify the calculation result R that is a point on the elliptic curve E and β is β And
If the cyclic group G is a multiplicative group of finite fields:
[Β-4] A value obtained by combining the operation result R which is a scalar value as the upper bits and M as the lower bits is β.
[Β-5] A value obtained by combining the operation result R which is a scalar value as the lower bits and M as the upper bits is β.
[Β-6] According to a predetermined rule, a value obtained by discretely arranging and combining the bits of the operation results R and M, which are scalar values, is β.

[Example of processing in step S15]
FIG. 7 is a flowchart for explaining an example of the process of step S15.

First, the bit length M and the bit length parameter L of the recovery message are read into the hash calculation number calculation unit 10ha. The hash calculation number calculation unit 10ha
e _max = rounddown {(L + M) / length (H)}… (5-1)
E _max
Is stored in the temporary memory 10t (step S15a). Note that rounddown {*} means an operation for rounding down the decimal part of *, length (*) means the bit length of *, and H means a known hash function. Specific examples of the hash function H include SHA-1 (bit length 160 bits) and MD5 (bit length 128 bits). For example, if L + M = 500 and the hash function H is SHA-1 [length (H) = 160], e _max = 3.

Next, the control unit 10s substitutes 0 for the variable e, and stores the variable e in the temporary memory 10t (step S15b).
Next, the partial hash calculation unit 10hb reads the variable e from the temporary memory 10t, reads β = R from the storage unit 10a, and the hash value
H (e, β)… (5-2)
Is calculated and stored in the temporary memory 10t (step S15c). For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the expression (5-2) uniquely or exclusively specifies the calculation result R that is a point on the elliptic curve E. This means an operation that causes the hash function H to act on the bit combination value of the variable e and a possible value (for example, the x coordinate or y coordinate of the point R or the bit combination value of the x coordinate and the y coordinate of the point R). Further, for example, when the cyclic group G is a finite field multiplicative group, the expression (5-2) is an operation for applying the hash function H ₀ to the bit combination value of the operation result R that is a scalar value and the variable e. Means.

Next, the control unit 10s reads e _max and the variable e from the temporary memory 10t,
e = e _max … (5-3)
It is determined whether or not the condition is satisfied (step S15d). If the expression (5-3) is not satisfied, the control unit 10s sets e + 1 as a new e, stores the new e in the temporary memory 10t (step S15e), and then returns the process to step S15c. On the other hand, if the expression (5-3) is satisfied, the control unit 10s gives an instruction to the bit combination unit 10hc, and the bit combination unit 10hc receives each hash value H (0, R), H (1 from the temporary memory 10t. , R), H (2, R), ..., H (e _max , R), and their bit combination values
HC (R) = H (0, R) | ・ ・ ・ | H (e _max , R)… (5-4)
Is calculated and stored in the temporary memory 10t (step S15f).
Next, the bit deletion unit 10hd reads the bit combination value HC (R), the bit length M of the recovery message, and the bit length parameter L from the temporary memory 10t,
Π = H ₀ (R) = delete {length (HC (R))-length (L + M), HC (R)}… (5-5)
Is calculated and output to the storage unit 10a (step S15g). Delete {δ, ε} means a process of deleting δ bits from the head by δ bits. That is, Expression (5-5) means an operation in which Π = H ₀ (R) is obtained by deleting the first bit of HC (R) and setting the total bit length to L + M.

In addition, the processing method of step S15 is not limited to this. For example, instead of using e, a method of extending the bit length of the hash value by a hash chain may be used. In this case, HC (R) in formula (5-4) is, for example,
HC (R) = H (R) | H (H (R)) | H (H (H (R))) |… | H (H (H… (R)…))
(End of description of [Example of processing in step S15]).
After step S15, the bit combining unit 10m reads the shared value hε {0, 1} ^L and the recovery message m _rec from the storage unit 10a (step S16). The bit combination unit 10m arranges the shared value hε {0,1} ^L in the first bit position and the bit combination value of L + M bits in which the recovery message m _rec ε {0,1} ^M is arranged in the second bit position.
d = h | m _rec ∈ {0,1} ^{L + M} … (6)
And the bit combination value d is output to the storage unit 10a and stored (step S17). Note that there is no particular limitation as to which bit position the “first bit position” and the “second bit position” are set. However, between the signature generation apparatus 10 and the signature verification apparatus 20, the reference for which bit position should be the “first bit position” and “second bit position” must be the same. FIG. 9 shows a setting example of “first bit position” and “second bit position”.

The example of FIG. 9A is an example in which consecutive upper L bits are “first bit positions” and consecutive lower M bits are “second bit positions”. The example of FIG. 9B is an example in which consecutive upper M bits are “second bit positions” and consecutive lower L bits are “first bit positions”. The example of FIG. 9C is an example in the case of L ≧ M, where the positions of the odd-numbered bits (M bits in total) from the higher order are “second bit positions” and the other bit positions are “first”. This is an example of “1 bit position”.
Next, the exclusive OR operation unit 10n reads the hash value Π and the bit combination value d from the storage unit 10a. The exclusive OR operation unit 10n obtains the exclusive OR of the hash value Π and the bit combination value d.
r = Π (+) d∈ {0,1} ^{L + M} (7)
((+) Is an exclusive OR operator), and the exclusive OR value r is output to the storage unit 10a and stored (step S18).

Next, the hash operation unit 10p reads the exclusive OR value r, the clear message m _clr, and the bit length M from the storage unit 10a. The hash calculator 10p depends on the hash function H ₃ : {0, 1} ^* → Z _q that outputs an integer for the input value, depending on the exclusive OR value r, the clear message m _clr, and the bit length M. The hash value that is the result of the operation
t = H ₃ (γ) ∈Z _q (8)
Is output and stored in the storage unit 10a (step S19). In the first embodiment, γ is a value γ = (r, m _clr , M) that depends only on the exclusive OR value r, the clear message m _clr, and the bit length M. The γ configuration method of the present embodiment is not limited, but the γ configuration method is the same as the γ ′ configuration method in the signature verification apparatus 20 described later. Examples of the configuration of γ include the following.

[Γ−1] The value of 2L + M + N bits obtained by combining the most significant L + M bit as r, the subsequent N bit as m _clr, and the subsequent L bit as M is γ.
[Γ-2] The value of 2L + M + N bits obtained by combining the most significant L bit as M, the subsequent L + M bit as r, and the subsequent N bit as m _clr is γ.
[Γ-3] Let γ be a combination of M, r, and m _clr bits discretely (for example, discretely arranging M in even-numbered bits) according to a predetermined rule.
Next, the integer arithmetic unit 10q reads the arbitrary value k, the hash value t, and the secret keys x and q from the storage unit 10a. The integer arithmetic unit 10q is
s = kt · x∈Z _q (9)
And the calculation result s is output and stored in the storage unit 10a (step S20).
Next, the exclusive OR value r, the operation result s, and the clear message m _clr are read into the communication unit 10r, and the communication unit 10r transmits the signature σ = (r, s) and the clear message m _clr to the network 40. To the signature verification apparatus 20 (step S21).

[Signature verification]
Next, the signature verification process according to the first embodiment will be described.
FIG. 8 is a flowchart for explaining the signature verification processing according to the first embodiment. Hereinafter, the signature verification processing of this embodiment will be described with reference to FIG.
First, the communication unit 20b of the signature verification apparatus 20 (FIG. 5) receives the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ (corresponding to “accept input”) and stores them. Store in the unit 20a (step S41). If the signature and the rear message are legitimate, σ ′ = (r ′, s ′) = σ = (r, s) and m _clr ′ = m _clr. The target signature is expressed as σ ′ = (r ′, s ′), and the verification target clear message is expressed as m _clr ′.

Next, the bit length extraction unit 20c reads the bit length parameter L and r ′ of the signature σ ′ = (r ′, s ′) from the storage unit 20a. The bit length extraction unit 20c
M '= length (r')-L (10)
Thus, the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ is calculated and stored in the storage unit 20a (step S42).
Next, the hash calculator 20d reads r ′, a clear message, m _clr ′, q, and a bit length M ′ from the storage unit 20a. The hash calculator 20d sets the same hash function H ₃ : {0,1} ^* → Z _q as the signature generation apparatus 10 to a value γ ′ determined depending on r ′, m _clr ′, and the bit length M ′. Hash value that is the result of the operation
t '= H ₃ (γ')… (11)
Is output and stored in the storage unit 20a (step S43). Note that the configuration method of γ ′ is the same as the configuration method of γ in the signature generation apparatus 10 described above (same when r = r ′ and m _clr = m _clr ′).

Next, the group calculation unit 20e reads the generation source gεG, the public key yεG of the signature generation device 10, the s ′ of the signature σ ′, and the hash value t ′ from the storage unit 20a,
R '= g ^s' · y ^t' ∈ G (12)
The calculation result R ′ is output to the storage unit 20a and stored (step S44). For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (12) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is multiplied by the elliptic scalar (ellipse s ′ times), the public key y = (y ₁ , y ₂ ) is multiplied by the ellipse scalar (ellipse t ′ times), and the result of ellipse addition (s ′ · g + t ′) Y means E), and the calculation result R ′ is a point on the elliptic curve E. For example, when the cyclic group G is a multiplicative group of a finite field, the right side of the equation (12) means an operation of g ^{s ′} · y ^{t ′} mod p, and the operation result R ′ is a scalar value. .

Next, the hash calculation unit 20f reads the calculation result R′εG, the bit length M ′ of the recovery message m _rec ′, and the bit length parameter L from the storage unit 20a. Hash calculator 20f the operation result of the same hash function H ₀ and the signature generating apparatus 10 R 'and the bit length M''to act on, L + M is a result of the operation' value β determined in dependence on the bits of the hash value Π '= H ₀ (β') ∈ {0,1} ^{L + M '} … (13)
Is output and stored in the storage unit 20a (step S45). Incidentally, beta 'configuration method is the same as the configuration method of the beta of the signature generating apparatus 10 described above, also, H 0 _(β') calculation of the H ₀ in the case of the signature generating apparatus 10 _(beta ') (Same when β = β ′, M = M ′).

Next, the exclusive OR operation unit 20g reads the hash value Π ′ and r ′ included in the signature σ ′ from the storage unit 20a, and performs the exclusive OR operation on them.
d '= Π' (+) r'∈ {0,1} ^{L + M '} (14)
And the exclusive OR value d ′ is output and stored in the storage unit 20a (step S46).
Next, the bit extraction unit 20h reads the exclusive OR value d ′ and the bit length M ′ of the recovery message m _rec ′ from the storage unit 20a. The bit extraction unit 20h outputs the L-bit value h′ε {0, 1} ^L at the first bit position of the exclusive OR value d ′ and the M ′ bit at the second bit position of the exclusive-OR value d ′. Value m _rec '∈ {0, 1} ^{M ′} is extracted and stored in the storage unit 20a (step S47). The “first bit position” and the “second bit position” are the same as the “first bit position” and the “second bit position” in the processing of the signature generation apparatus 10 (when d = d ′, the same). ).

Next, the comparison unit 20i reads the shared value hε {0, 1} ^L and the value h ′ from the storage unit 20a (step S48),
h '= h… (15)
It is determined whether or not the condition is satisfied (step S49).
Here, when Expression (15) is not satisfied, the comparison unit 20i outputs 0 (verification failure) to the storage unit 20a and stores it, and the output unit 20m receives 0 (verification failure) sent from the storage unit 20a. Output (step S50). On the other hand, when the expression (15) is satisfied, the comparison unit 20i outputs 1 (verification success) to the storage unit 20a and stores it, and the output unit 20m outputs 1 (verification success) sent from the storage unit 20a. (Step S51), and further, a recovery message m _rec 'is output (Step S52).

[Second Embodiment]
Next, a second embodiment will be described. The second embodiment is an embodiment according to the second aspect of the present invention. Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.
<Overall configuration>
The second embodiment is the same as the first embodiment except that the signature generation apparatus 10 becomes the signature generation apparatus 110 and the signature verification apparatus 20 becomes the signature verification apparatus 120.
<Configuration of Signature Generation Device 110>
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
As in the first embodiment, the signature generation apparatus 110 according to the present embodiment is configured by reading a predetermined program into a computer as shown in FIG.
FIG. 10 is a block diagram illustrating a functional configuration of the signature generation apparatus 110 according to the second embodiment configured by reading a program into the CPU. The arrows in FIG. 10 indicate the flow of data, but the flow of data input to and output from the temporary memory 10t and the control unit 10s is omitted. In FIG. 10, the same reference numerals as those in FIG.

  As illustrated in FIG. 10, the signature generation device 110 according to the present exemplary embodiment includes a storage unit 10a, a secret key generation unit 10b, a public key generation unit 10c, an input unit 10d, a message division unit 110e, and an arbitrary value generation unit. 10f, group operation unit 10g, hash operation units 110h and 110p, bit combination unit 10m, exclusive OR operation unit 10n, integer operation unit 10q, communication unit 10r, control unit 10s, and temporary memory 10t. The message dividing unit 110e and the hash calculation units 110h and 110p are configured by reading a program for realizing each processing into the CPU.

<Configuration of Signature Verification Apparatus 120>
Next, the configuration of the signature verification apparatus 120 will be described.
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
The signature verification apparatus 120 is also configured by reading a predetermined program into a computer as shown in FIG. FIG. 11 is a block diagram illustrating a functional configuration of the signature verification apparatus 120 according to the second embodiment configured as described above. Note that the arrows in FIG. 11 indicate the flow of data, but the flow of data input to and output from the temporary memory 20p and the control unit 20n is omitted. Also, in FIG. 11, the same reference numerals as those in FIG.
As shown in FIG. 11, the signature verification apparatus 120 of this embodiment includes a storage unit 20a, a communication unit 20b, a bit length extraction unit 120c, hash calculation units 120d and 120f, a group calculation unit 20e, an exclusive logic It has a sum operation unit 20g, a bit extraction unit 20h, a comparison unit 20i, an output unit 20m, a control unit 20n, and a temporary memory 20p. The bit length extraction unit 120c and the hash calculation units 120d and 120f are configured by reading a program for realizing each processing into the CPU.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
This is the same as in the first embodiment.
[Key generation process]
This is the same as in the first embodiment.
[Signature generation processing]
Next, a signature generation process according to the first embodiment will be described.
FIG. 12 is a flowchart for explaining a signature generation process according to the second embodiment. Hereinafter, the signature generation processing of this embodiment will be described with reference to FIG.
First, the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 are input to the input unit 10d of the signature generation apparatus 110 (FIG. 10) (step S111). These pieces of input information are stored in the storage unit 10a.

Next, the message dividing unit 110e reads the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 from the storage unit 10a. The message dividing unit 110e uses these pieces of information,
The message mε {0,1} ^{N + M is changed} to a recovery message m _rec ε {0,1} ^M having a bit length ^M and a clear message m _clr ε {0,1} ^N having a bit length N (N ≧ 0). divided, further extracts the clear message _{m clr} ∈ ^{0,1} bit length of ^N N (step S112). The bit division method is the same as that in the first embodiment. The bit length M recovery message m _rec ε {0,1} ^M , the bit length N clear message m _clr ε {0,1} ^N, and the clear message m _clr ε {0,1}. the bit length N of the ^N, are stored in the respective storage unit 10a.
Then, as in the first embodiment, any value generator 10f generates an arbitrary value k ∈ Z _q, and stores the generated arbitrary value k in the storage unit 10a (step S113). The group calculation unit 10g reads the generator gεG and the arbitrary value kεZ _q from the storage unit 10a, calculates R according to the equation (4), and outputs the calculation result RεG to the storage unit 10a. Store (step S114).

Next, the hash calculator 110h reads the calculation result RεG, the bit length M of the recovery message m _rec , the bit length N of the clear message m _clr , and the bit length parameter L from the storage unit 10a. The hash calculation unit 110h _generates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M} , in which the output bit length is determined as L + M bits according to the bit length M of the recovery message m _rec , the calculation result R and the bit L + M-bit hash value さ せ = H ₀ (β) ∈ {0,1} ^{L + M} (16) acting on a value β determined depending on the length N
Is output and stored in the storage unit 10a (step S115). In the second embodiment, β is a value γ = (R, N) that depends only on the calculation result R and the bit length N. In addition, although there is no limitation on the β configuration method of this embodiment, the β configuration method is the same as the β ′ configuration method in the signature verification apparatus 120 described later. Examples of the configuration of β in this embodiment include the following.
If the cyclic group G is a group of rational points on the elliptic curve E:
[Β-1] A value (for example, the x-coordinate or y-coordinate of the point R, or the x-coordinate and y-coordinate of the point R) that can uniquely or exclusively specify the calculation result R that is a point on the elliptic curve E (Bit combination value) is an upper bit, and a value obtained by combining N as a lower bit is β.
[Β-2] A value obtained by uniquely or limitedly specifying the calculation result R that is a point on the elliptic curve E is a lower bit, and a value obtained by combining N as an upper bit is β.
[Β-3] In accordance with a predetermined rule, a value obtained by discretely arranging and combining each bit of N and a value that can uniquely specify the calculation result R that is a point on the elliptic curve E and β And
If the cyclic group G is a multiplicative group of finite fields:
[Β-4] A value obtained by combining the operation result R, which is a scalar value, with the upper bit and N with the lower bit is β.
[Β-5] A value obtained by combining the operation result R, which is a scalar value, with the lower bit and N with the upper bit is β.
[Β-6] According to a predetermined rule, a value obtained by discretely arranging and combining the bits of the operation results R and N, which are scalar values, is β.

After step S115, the same processing as steps S16 to S18 of the first embodiment is performed (steps S116 to S118). Thereafter, the hash calculation unit 110p reads the exclusive OR value r, the clear message m _clr, and the bit length N from the storage unit 10a. The hash calculator 110p depends on the hash function H ₃ : {0, 1} ^* → Z _q that outputs an integer for the input value, depending on the exclusive OR value r, the clear message m _clr, and the bit length N. The hash value that is the result of the operation
t = H ₃ (γ) ∈Z _q (17)
Is output and stored in the storage unit 10a (step S119). In the second embodiment, γ is a value γ = (r, m _clr , N) that depends only on the exclusive OR value r, the clear message m _clr, and the bit length N. The γ configuration method of the present embodiment is not limited, but the γ configuration method is the same as the γ ′ configuration method in the signature verification apparatus 120 described later. Examples of the configuration of γ in this embodiment include the following.
[Γ-1] The value of 2L + M + N bits obtained by combining the most significant L + M bit as r, the subsequent N bit as m _clr, and the subsequent L bit as N is γ.
[Γ-2] Let the most significant L bit be N, the subsequent L + M bit be r, and the subsequent N bit be m _clr and the value of 2L + M + N bits be γ.
[Γ-3] According to a predetermined rule, γ is a combination of N, r, and m _clr bits discretely (for example, discretely arranging N in even-numbered bits).
Next, as in the first embodiment, the integer operation unit 10q calculates s according to the equation (9) (step S120), and the communication unit 10r sends the exclusive OR value r, the operation result s, and the clear message m _clr. And the communication unit 10r transmits the signature σ = (r, s) and the clear message m _clr to the signature verification apparatus 120 via the network 40 (step S121).

[Signature verification]
Next, a signature verification process according to the second embodiment will be described.

FIG. 13 is a flowchart for explaining a signature verification process according to the second embodiment. Hereinafter, the signature verification processing of this embodiment will be described with reference to FIG.
First, the communication unit 20b of the signature verification apparatus 120 (FIG. 11) receives the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ (corresponding to “accept input”) and stores them. Stored in the unit 20a (step S141). If the signature and the rear message are legitimate, σ ′ = (r ′, s ′) = σ = (r, s) and m _clr ′ = m _clr. The target signature is expressed as σ ′ = (r ′, s ′), and the verification target clear message is expressed as m _clr ′.
Next, the bit length extraction unit 120c reads the bit length parameter L, r ′ of the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ from the storage unit 20a, and follows equation (10). The bit length M ′ of the recovery message m _rec ′ is calculated, and further the clear message is changed to the bit length of m _clr ′.
N '= | m _clr ' |… (18)
Are stored in the storage unit 20a (step S142).

Next, the hash calculator 120d reads r ′, a clear message, m _clr ′, q, and a bit length N ′ from the storage unit 20a. The hash calculator 120d sets the same hash function H ₃ : {0,1} ^* → Z _q as the signature generation apparatus 110 to a value γ ′ that is determined depending on r ′, m _clr ′, and the bit length N ′. Hash value that is the result of the operation
t '= H ₃ (γ')… (19)
Is output and stored in the storage unit 20a (step S143). Note that the configuration method of γ ′ is the same as the configuration method of γ in the signature generation apparatus 110 described above (same when r = r ′ and m _clr = m _clr ′).
Next, the group calculation unit 20e reads the generation source gεG, the public key yεG of the signature generation device 10, the s ′ of the signature σ ′, and the hash value t ′ from the storage unit 20a, and the first embodiment Similarly to the above, the calculation of Expression (12) is performed, and the calculation result R ′ is output and stored in the storage unit 20a (step S144).

Next, the hash calculation unit 120f reads the calculation result R′εG, the bit length M ′ of the recovery message m _rec ′, the clear message, the bit length N ′ of the m _clr ′, and the bit length parameter L from the storage unit 20a. The hash calculator 120f operates the same hash function H _{0 as} that of the signature generation device 110 on the value β ′ determined depending on the calculation result R ′ and the bit length M ′, and the L + M′-bit hash value that is the calculation result Π '= H ₀ (β') ∈ {0,1} ^{L + M '} … (20)
Is output and stored in the storage unit 20a (step S145). Incidentally, beta 'configuration method is the same as the configuration method of the beta of the signature generating apparatus 110 described above, also, H 0 _(β') calculation of the H ₀ in the case of the signature generating apparatus 110 _(beta ') (Same when β = β ′, M = M ′).
Thereafter, the same processing as steps S46 to S52 of the first embodiment is executed (146 to S152), and signature verification is performed.

[Third Embodiment]
Next, a third embodiment will be described. The third embodiment is an embodiment according to the third aspect of the present invention. Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.
<Overall configuration>
The second embodiment is the same as the first embodiment except that the signature generation apparatus 10 becomes the signature generation apparatus 210 and the signature verification apparatus 20 becomes the signature verification apparatus 220.

<Configuration of Signature Generation Device 210>
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
Similar to the first embodiment, the signature generation apparatus 210 of the present embodiment is configured by reading a predetermined program into a computer as shown in FIG.
FIG. 14 is a block diagram illustrating the functional configuration of the signature generation apparatus 210 according to the third embodiment configured by reading a program into the CPU. The arrows in FIG. 14 indicate the flow of data, but the flow of data input to and output from the temporary memory 10t and the control unit 10s is omitted.

  As shown in FIG. 14, the signature generation apparatus 210 according to the present exemplary embodiment includes a storage unit 10a, a secret key generation unit 10b, a public key generation unit 10c, an input unit 10d, a message division unit 10e, and an arbitrary value generation unit. 10f, group operation unit 10g, hash operation units 210h, 210i, 210p, bit combination unit 10m, exclusive OR operation unit 10n, integer operation unit 10q, communication unit 10r, control unit 10s, And a temporary memory 10t. The functional configuration of the hash calculation unit 210h is the same as the functional configuration of the hash calculation unit 10h described above. The hash calculators 210h, 210i, and 210p are configured by reading a program for realizing each processing into the CPU. Further, the above program may be a program that can realize the function alone, or the program may read out another library (not described) to realize each function. That is, at least a part of each program corresponds to a program for causing a computer to execute the function of the signature generation apparatus 210.

<Configuration of Signature Verification Device 220>
Next, the configuration of the signature verification apparatus 220 will be described.
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
The signature verification apparatus 220 is also configured by reading a predetermined program into a computer as shown in FIG. FIG. 15 is a block diagram illustrating a functional configuration of the signature verification apparatus 220 according to the third embodiment configured as described above. The arrows in FIG. 15 indicate the flow of data, but the flow of data input to and output from the temporary memory 20p and the control unit 20n is omitted.
As shown in FIG. 15, the signature verification apparatus 220 according to the present embodiment includes a storage unit 20a, a communication unit 20b, a bit length extraction unit 20c, hash calculation units 220d, 220f, and 220k, and a group calculation unit 20e. A logical OR operation unit 20g, a bit extraction unit 20h, a comparison unit 220i, an output unit 20m, a control unit 20n, and a temporary memory 20p.

  The hash calculation units 220d, 220f, and 220k are configured by reading a program for realizing each processing into the CPU. Further, the above program may be a program that can realize the function alone, or the program may read out another library (not described) to realize each function. That is, at least a part of each program corresponds to a program for causing a computer to execute the function of the signature verification apparatus 220.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
First, a cyclic group G that is difficult to find a discrete logarithm problem of order q used in the signature system 1 and its generation source gεG are determined. As such a cyclic group G, for example, a group formed by rational points on an elliptic curve or a multiplicative group of a finite field can be used. Although the order q is desirably a prime number from the viewpoint of safety, q may not be a prime number if prime factorization of q is difficult. The bit length parameter LεZ _{> 0} (an integer greater than ₀ ) used in the signature system 1 is determined.
Further, a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M} whose output bit length is determined to be L + M bits according to the bit length M of a recovery message m _rec described later is determined. A method for calculating such a hash function will be described later.
Also, hash function H ₁ for outputting an L-bit hash value for the input value: {0, 1} ^* → {0, 1} ^L, and Z _q (q is modulo for the input value Hash function H ₃ : {0, 1} ^* → Z _q that outputs an element of a complete residue system) is determined. The hash function H ₁ can be configured in the same manner as the hash function H _0, and the hash function H ₃ can be configured by performing a remainder operation modulo q on a hash value such as SHA-1.

Information specifying the cyclic group G and the hash functions H ₀ , H ₁ , and H ₃ determined as described above is written in each program constituting the signature generation device 210 and the signature verification device 220, for example, to generate a signature. It is assumed that the device 210 and the signature verification device 220 can perform operations on the determined cyclic group G and operations of the hash functions H ₀ , H ₁ , and H ₃ . Further, the bit length parameter LεZ _{> 0} , the order q, and the generation source gεG are stored in the storage unit 10 a of the signature generation device 210 and the storage unit 20 a of the signature verification device 220.

[Key generation process]
Next, a key generation process performed by the signature generation apparatus 210 will be described.
First, the secret key generator 10b of the signature generating apparatus 210 generates an arbitrary secret key x∈Z _q. The secret key x may be generated by mapping a pseudo-random number to _Zq or based on a value arbitrarily determined by the signature generator. The generated secret key x is securely stored in the storage unit 10a of the signature generation device 210. That is, a device external to the signature generation device 210 cannot acquire the secret key x from the storage unit 10a.
Next, the public key generation unit 10c of the signature generation apparatus 210 reads the secret key x and the generation source gεG of the cyclic group G from the storage unit 10a, and performs an operation defined by the cyclic group G.
y = g ^x ∈G… (21)
To generate a public key yεG corresponding to the secret key x and store it in the storage unit 10a. For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (21) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is an elliptic scalar multiplication (ellipse x times) (x · gεE), and the public key y is a point on the elliptic curve E. Also, for example, when the cyclic group G is a finite field multiplicative group, the right side of the equation (21) means g ^x mod p (where p = 2q + 1), and the public key y is a scalar value and Become. The generated public key y is transmitted from the communication unit 10r to the public key server device 30 through the network 40, and the public key server device 30 publishes the transmitted public key y together with, for example, a public key certificate. The public key y and the like are publicly stored in the storage unit of the public key server device 30 and any device that can be connected to the network 40 is stored in the storage unit of the public key server device 30. This means that the public key y and the like can be acquired. The signature verification apparatus 220 receives such a public key y from the public key server apparatus 30 through the communication unit 20b and stores it in the storage unit 20a.

[Signature generation processing]
Next, a signature generation process according to the third embodiment will be described.
FIG. 16 is a flowchart for explaining a signature generation process according to the third embodiment. Hereinafter, the signature generation processing of this embodiment will be described with reference to FIG.
First, the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 are input to the input unit 10d of the signature generation apparatus 210 (FIG. 14) (step S211). These pieces of input information are stored in the storage unit 10a.
Next, the message dividing unit 10e reads the message mε {0, 1} ^{N + M} and the recovery message bit length M ≧ 1 from the storage unit 10a. The message dividing unit 10e uses these pieces of information,
The message mε {0,1} ^{N + M is changed} into a recovery message m _rec ε {0,1} ^M having a bit length ^M and a clear message m _clr ε {0,1} ^N having a bit length N (N ≧ 0). Divide (step S212). For example, the upper M bits of the message mε {0,1} ^{N + M} are the recovery message m _rec ε {0,1} ^M , and the lower N bits are the clear message m _clr ε {0,1} ^N. Note that the division method is not limited to this, and which bit of the message mε {0, 1} ^{N + M} is the recovery message m _rec and which bit is the clear message m _clr can be arbitrarily set. The bit length M recovery message m _rec ε {0, 1} ^M and the bit length N clear message m _clr ε {0, 1} ^N are stored in the storage unit 10a.

Next, the arbitrary value generation unit 10f generates an arbitrary value kεZ _q , and stores the generated arbitrary value k in the storage unit 10a (step S213). The generation of arbitrary value k is performed, for example, by mapping a pseudo random number to Z _q.
Next, the group calculation unit 10g reads the generation source gεG and the arbitrary value kεZ _q from the storage unit 10a,
R = g ^k ∈G… (22)
And the calculation result RεG is output and stored in the storage unit 10a (step S214). For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (22) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is an elliptic scalar multiplication (ellipse k times) (k · gεE), and the operation result R is a point on the elliptic curve E. For example, when the cyclic group G is a multiplicative group of a finite field, the right side of the equation (22) means an operation of g ^k mod p, and the operation result R is a scalar value.
Next, the hash calculation unit 210h reads the calculation result RεG, the bit length M of the recovery message, and the bit length parameter L from the storage unit 10a. The hash calculation unit 210h depends on the calculation result R for the hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M in} which the output bit length is determined as L + M bits according to the bit length M of the recovery message m _rec. L + M-bit hash value Π = H ₀ (β) ∈ {0,1} ^{L + M} (23) that acts on the value β determined in this way (β = R in this embodiment)
Is output and stored in the storage unit 10a (step S215). Note that, for example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (23) uniquely or limitedly specifies the calculation result R that is a point on the elliptic curve E. This means an operation for applying the hash function H ₀ to a possible value (for example, the x-coordinate or y-coordinate of the point R or the bit combination value of the x-coordinate and the y-coordinate of the point R). For example, when the cyclic group G is a multiplicative group of a finite field, the right side of the equation (23) means an operation in which the hash function H ₀ is applied to the operation result R that is a scalar value. The specific processing method of the calculation that operates the hash function H ₀ is the same as that in FIG. 7 of the first embodiment, for example.

After step S215, the hash calculator 210i reads the recovery message m _rec and the bit length parameter L from the storage unit 10a. The hash calculation unit 210i determines a hash function H ₁ : {0, 1} ^* → {0, 1} ^L that outputs an L-bit hash value for the input value, depending on the recovery message m _rec. (In this embodiment, α = m _rec ), and an L-bit hash value that is the result of the operation
h = H ₁ (α) ∈ {0,1} ^L … (24)
Is output and stored in the storage unit 10a (step S216).
Next, the bit combining unit 10m reads the hash value hε {0, 1} ^L and the recovery message m _rec from the storage unit 10a. The bit combining unit 10m arranges the hash value hε {0,1} ^L at the first bit position and the bit combination value of L + M bits in which the recovery message m _rec ε {0,1} ^M is arranged at the second bit position.
d = h | m _rec ∈ {0,1} ^{L + M} … (25)
And the bit combination value d is output to the storage unit 10a and stored (step S217). Note that there is no particular limitation as to which bit position the “first bit position” and the “second bit position” are set. However, between the signature generation device 210 and the signature verification device 220, it is necessary to have the same reference as to which bit position the “first bit position” and the “second bit position” are set. An example of setting “first bit position” and “second bit position” is as shown in FIG. 9, for example.

Next, the exclusive OR operation unit 10n reads the hash value Π and the bit combination value d from the storage unit 10a. The exclusive OR operation unit 10n obtains the exclusive OR of the hash value Π and the bit combination value d.
r = Π (+) d∈ {0,1} ^{L + M} … (26)
((+) Is an exclusive OR operator), and the exclusive OR value r is output to the storage unit 10a and stored (step S218).
Next, the hash operation unit 210p reads the exclusive OR value r and the clear message m _clr from the storage unit 10a. The hash calculation unit 210p determines the hash function H ₃ that outputs an integer for the input value: {0, 1} ^* → Z _q depending on the exclusive OR value r and the clear message m _clr. The hash value that is the result of the operation
t = H ₃ (γ) ∈Z _q (27)
Is output and stored in the storage unit 10a (step S219). In the third embodiment, γ is a value γ = (r, m _clr ) that depends only on the exclusive OR value r and the clear message m _clr . The γ configuration method of the present embodiment is not limited, but the γ configuration method is the same as the γ ′ configuration method in the signature verification apparatus 220 described later. Examples of the configuration of γ include the following.
The value of L + M + N bits obtained by combining [γ−1] r with the upper L + M bits and m _clr with the lower N bits is γ.
[Γ-2] The value of L + M + N bits obtained by combining r as the lower L + M bits and m _clr as the upper N bits is γ.
[Γ−3] Let m _{clr be an} odd-numbered bit (N bits in total) from the higher order, and let the value of L + M + N bits obtained by combining r as the other L + M bits be γ.
Next, the integer arithmetic unit 10q reads the arbitrary value k, the hash value t, and the secret keys x and q from the storage unit 10a. The integer arithmetic unit 10q is
s = kt ・ x∈Z _q (28)
And the calculation result s is output and stored in the storage unit 10a (step S220).
Next, the exclusive OR value r, the operation result s, and the clear message m _clr are read into the communication unit 10r, and the communication unit 10r transmits the signature σ = (r, s) and the clear message m _clr to the network 40. To the signature verification apparatus 220 (step S221).

[Signature verification]
Next, a signature verification process according to the third embodiment will be described.
FIG. 17 is a flowchart for explaining the signature verification processing according to the third embodiment. Hereinafter, the signature verification processing of this embodiment will be described with reference to FIG.
First, the communication unit 20b of the signature verification apparatus 220 (FIG. 15) receives the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ (corresponding to “accept input”) and stores them. Stored in the unit 20a (step S241). If the signature and the rear message are legitimate, σ ′ = (r ′, s ′) = σ = (r, s) and m _clr ′ = m _clr. The target signature is expressed as σ ′ = (r ′, s ′), and the verification target clear message is expressed as m _clr ′.
Next, the bit length extraction unit 20c reads the bit length parameter L and r ′ of the signature σ ′ = (r ′, s ′) from the storage unit 20a. The bit length extraction unit 20c
M '= length (r')-L (29)
Thus, the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ is calculated and stored in the storage unit 20a (step S242).

Next, the hash calculation unit 220d reads r ′ and a clear message from the storage unit 20a and m _clr ′ and q. The hash calculation unit 220d operates the same hash function H ₃ : {0, 1} ^* → Z _q as the signature generation apparatus 210 on a value γ ′ determined depending on r ′ and m _clr ′, and _performs the calculation. The resulting hash value
t '= H ₃ (γ')… (30)
Is output and stored in the storage unit 20a (step S243). Note that the configuration method of γ ′ is the same as the configuration method of γ in the signature generation apparatus 210 described above (same when r = r ′ and m _clr = m _clr ′).
Next, the group calculation unit 20e reads the generation source gεG, the public key yεG of the signature generation device 210, the s ′ of the signature σ ′, and the hash value t ′ from the storage unit 20a,
R '= g ^s' · y ^t' ∈G (31)
The calculation result R ′ is output to the storage unit 20a and stored (step S244). For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, the right side of the equation (31) is a generator g = (g ₁ , g ₂ ) that is a point on the elliptic curve E. Is multiplied by the elliptic scalar (ellipse s ′ times), the public key y = (y ₁ , y ₂ ) is multiplied by the ellipse scalar (ellipse t ′ times), and the result of ellipse addition (s ′ · g + t ′) Y means E), and the calculation result R ′ is a point on the elliptic curve E. Further, for example, when the cyclic group G is a finite field multiplicative group, the right side of the equation (31) means the calculation of g ^{s ′} · y ^{t ′} mod p, and the calculation result R ′ is a scalar value. .

Next, the hash calculator 220f reads the calculation result R′εG, the bit length M ′ of the recovery message m _rec ′, and the bit length parameter L from the storage unit 20a. The hash calculation unit 220f operates the same hash function H _{0 as} that of the signature generation device 210 on a value β ′ (in this example, β ′ = R ′) determined depending on the calculation result R ′, and L + M ′ that is the calculation result Hash value of bit Π '= H ₀ (β') ∈ {0,1} ^{L + M '} … (32)
Is output and stored in the storage unit 20a (step S245). Note that the calculation of H ₀ (β ′) is the same as the calculation of H ₀ (β) in the case of the signature generation device 210 (same when β = β ′ and M = M ′).
Next, the exclusive OR operation unit 20g reads the hash value Π ′ and r ′ included in the signature σ ′ from the storage unit 20a, and performs the exclusive OR operation on them.
d '= Π' (+) r'∈ {0,1} ^{L + M '} (33)
And the exclusive OR value d ′ is output and stored in the storage unit 20a (step S246).

Next, the bit extraction unit 20h reads the exclusive OR value d ′ and the bit length M ′ of the recovery message m _rec ′ from the storage unit 20a. The bit extraction unit 20h outputs the L-bit value h′ε {0, 1} ^L at the first bit position of the exclusive OR value d ′ and the M ′ bit at the second bit position of the exclusive-OR value d ′. Value m _rec '∈ {0, 1} ^{M ′} is extracted and stored in the storage unit 20a (step S247). Note that the “first bit position” and the “second bit position” are the same as the “first bit position” and the “second bit position” in the processing of the signature generation apparatus 210 (d = d ′). ).
Next, the hash calculator 220k reads the recovery message m _rec ′ from the storage unit 20a. The hash calculator 220k operates the same hash function H ₁ : {0, 1} ^* → {0, 1} ^L as the signature generation device 210 on a value α ′ determined depending on the recovery message m _rec ′, L-bit hash value that is the result of the operation
H ₁ (α ') ∈ {0,1} ^L … (34)
Is output and stored in the storage unit 20a (step S248). Note that the configuration method of α ′ is the same as the configuration method of α in the signature generation apparatus 210 described above (same when m _rec = m _rec ′).

Next, the comparison unit 20i reads the hash value H ₁ (α ′) and the value h ′ from the storage unit 20a,
h '= H ₁ (α')… (35)
It is determined whether or not the condition is satisfied (step S249).
Here, when the expression (35) is not satisfied, the comparison unit 20i outputs 0 (verification failure) to the storage unit 20a and stores it, and the output unit 20m receives 0 (verification failure) sent from the storage unit 20a. Output (step S250). On the other hand, when Expression (35) is satisfied, the comparison unit 20i outputs 1 (verification success) to the storage unit 20a and stores it, and the output unit 20m outputs 1 (verification success) sent from the storage unit 20a. (Step S251), and further, a recovery message m _rec 'is output (Step S252).

[Fourth Embodiment]
Next, a fourth embodiment will be described. The fourth embodiment is an embodiment according to the fourth aspect of the present invention.
In the third embodiment, the value determined depending on the recovery message m _rec is α, and the value determined depending on the recovery message m _rec ′ is α ′. In the fourth embodiment, a value determined depending on the clear message m _clr is α, and a value determined depending on the clear message m _clr ′ is α ′. Below, it demonstrates centering on difference with 1st, 3rd embodiment.
<Overall configuration>
The second embodiment is the same as the first embodiment except that the signature generation apparatus 10 is the signature generation apparatus 310 and the signature verification apparatus 20 is the signature verification apparatus 320.

<Configuration of Signature Generating Device 310>
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
Similar to the first embodiment, the signature generation apparatus 310 according to this embodiment is configured by reading a predetermined program into a computer as shown in FIG.
FIG. 18 is a block diagram illustrating a functional configuration of the signature generation apparatus 310 according to the fourth embodiment configured by reading a program into the CPU.
As shown in FIG. 18, the signature generation apparatus 310 according to the present embodiment includes a storage unit 10a, a secret key generation unit 10b, a public key generation unit 10c, an input unit 10d, a message division unit 10e, and an arbitrary value generation unit. 10f, group operation unit 10g, hash operation units 210h, 310i, 210p, bit combination unit 10m, exclusive OR operation unit 10n, integer operation unit 10q, communication unit 10r, control unit 10s, And a temporary memory 10t. The hash calculator 310i is configured by reading a program for realizing the processing into the CPU.

<Configuration of Signature Verification Device 320>
Next, the configuration of the signature verification apparatus 320 will be described.
[Hardware configuration]
This is the same as the hardware configuration of the signature generation apparatus 10 shown in FIG.
[Cooperation between hardware and programs]
The signature verification apparatus 320 is also configured by reading a predetermined program into a computer as shown in FIG. FIG. 19 is a block diagram illustrating a functional configuration of the signature verification apparatus 320 according to the fourth embodiment configured as described above.
As shown in FIG. 19, the signature verification apparatus 320 according to the present embodiment includes a storage unit 20a, a communication unit 20b, a bit length extraction unit 20c, hash calculation units 220d, 220f, and 320k, and a group calculation unit 20e. A logical OR operation unit 20g, a bit extraction unit 20h, a comparison unit 220i, an output unit 20m, a control unit 20n, and a temporary memory 20p. The hash calculation unit 320k is configured by reading a program for realizing the processing into the CPU.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
The same as in the third embodiment.
[Key generation process]
The same as in the third embodiment.
[Signature generation processing]
Next, a signature generation process according to the fourth embodiment will be described.
FIG. 20 is a flowchart for explaining a signature generation process according to the fourth embodiment. Hereinafter, the signature generation processing of this embodiment will be described with reference to FIG.
First, the signature generation apparatus 310 (FIG. 18) performs the same processing as steps S211 to S215 of the third embodiment (steps S311 to S315).
After step S315, the hash calculator 310i reads the clear message m _clr and the bit length parameter L from the storage unit 10a. The hash calculation unit 310i determines a hash function H ₁ : {0, 1} ^* → {0, 1} ^L that outputs an L-bit hash value for the input value, depending on the clear message m _clr. (In this embodiment, α = m _clr ), and an L-bit hash value that is the result of the operation
h = H ₁ (α) ∈ {0,1} ^L … (36)
Is output and stored in the storage unit 10a (step S316).
Thereafter, the signature generation apparatus 310 performs the same processing as steps S217 to S221 of the third embodiment (steps S317 to S321).

[Signature verification]
Next, a signature verification process according to the fourth embodiment will be described.
FIG. 21 is a flowchart for explaining a signature verification process according to the fourth embodiment. Hereinafter, the signature verification processing of this embodiment will be described with reference to FIG.
First, the signature verification apparatus 320 (FIG. 19) performs the same processing as steps S241 to S247 of the third embodiment (steps S341 to S347).
Thereafter, the hash calculation unit 320k reads the clear message m _clr ′ from the storage unit 20a. The hash calculation unit 320k operates the same hash function H ₁ : {0, 1} ^* → {0, 1} ^L as the signature generation device 310 on the value α ′ determined depending on the clear message m _clr ′, L-bit hash value that is the result of the operation
H ₁ (α ') ∈ {0,1} ^L … (37)
Is output and stored in the storage unit 20a (step S448). Note that the configuration method of α ′ is the same as the configuration method of α in the signature generation apparatus 310 described above (same when m _rec = m _rec ').
Thereafter, the signature verification apparatus 320 performs the same process as steps S249 to S252 of the third embodiment to perform signature verification (steps S349 to S352).

[Modification]
In addition, this invention is not limited to each above-mentioned embodiment. The modification of each embodiment is shown below.
In the first embodiment, β is a value (R, M) determined depending on R and M, β ′ is a value (R ′, M ′) determined depending on R ′ and M ′, and γ _{Is a} value determined depending on r, m _clr and M (r, m _clr , M), and γ ′ is a value determined depending on r ′, m _clr ′ and M ′ (r ′, m _clr ′). , M ′). However, as a modification of the first embodiment, only one of β and γ (one of β ′ and γ ′) may be determined depending on M (M ′).
In the second embodiment, β is a value (R, N) determined depending on R and N, and β ′ is a value (R ′, N ′) determined depending on R ′ and N ′. , determined depending the gamma to the r and _{m clr} and N values _{(r, m clr,} N) and to a value determined depending on 'the r' gamma and _{m clr} 'and N' and (r ', m _clr ′, N ′). However, as a modification of the second embodiment, only one of β and γ (one of β ′ and γ ′) may be determined depending on N (N ′).

Further, as a modification of the first and second embodiments, β and β ′ may be values determined depending on additional common information, and γ and γ ′ are further dependent on additional common information. It may be a fixed value. The “additional information” includes a recovery message bit length, a clear message, a bit length of the clear message, a public key y, a parameter for specifying the group G, or a bit combination of at least a part thereof. A value etc. can be illustrated. Thereby, signature verification accuracy can be further improved. In particular, when a parameter for specifying the group G is used as additional information, an illegal group (for example, the discrete logarithm problem is easy and the operation result in the group operation unit is an operation in the regular cyclic group G). It is possible to prevent an illegal signature generated using the same group as the result from passing the verification.
In the third embodiment, α = m _rec and α ′ = m _rec ′. However, α may be a value that depends only on Π and m _rec (Π, m _rec ), and α ′ may be a value that depends only on Π ′ and m _rec ′ (Π ′, m _rec ′). In addition, α may be a value depending on m _rec and “additional information”, and α ′ may be a value depending on m _rec ′ and “additional information”.
In the fourth embodiment, α = m _clr and α ′ = m _clr ′. However, α may be a value that depends only on Π and m _clr (Π, m _clr ), and α ′ may be a value that depends only on Π ′ and m _clr ′ (Π ′, m _clr ′). In addition, α may be a value depending on m _clr and “additional information”, and α ′ may be a value depending on m _clr ′ and “additional information”.

In the third and fourth embodiments, β = R and β ′ = R ′. However, β is information (R, M) that depends only on R and the bit length M of the recovery message m _rec , and β ′ is information that depends only on R ′ and the bit length M ′ of the recovery message m _rec ′ ( R ′, M ′). Also, β is information (R, N) that depends only on R and the bit length N of the clear message m _clr , and β ′ is information that depends only on R ′ and the bit length N ′ of the clear message m _clr ′ ( R ′, N ′). In addition, β may be a value depending on R and “additional information”, and β ′ may be a value depending on R ′ and “additional information”.
In the third and fourth embodiments, γ is a value (r, m _clr ) that depends only on r and m _clr, and γ ′ is a value that depends only on r ′ and m _clr ′ ( r ′, m _clr ′). However, it determined depending the gamma on r and _{m clr,} M and only the value _{(r, m clr,} M) and determined depending 'the r' gamma only and _{m clr} 'and M' value (r ', M _clr ', M '). It determined depending the gamma on r and _{m clr} N and only the value to _{(r, m clr,} N) and determined depending 'the r' gamma only in the _{m clr} 'and N' value (r ', m _clr ', N'). _{Alternatively} , γ may be a value determined depending on r, m _clr, and “additional information”, and γ ′ may be a value determined depending on r ′, m _clr ′, and “additional information”.

In each embodiment, the signature generation apparatuses 10 to 310 perform key generation, but another apparatus may perform key generation. In each embodiment, the public key server device 30 discloses the public key y, but the signature generation devices 10 to 310 may transmit the public key y to the signature verification devices 20 to 320. Further, Z _{q (the} complete residue system modulo q) may be configured to be replaced with Z (integer) in each treatment.
In the third and fourth embodiments, the signature verification apparatuses 220 and 320 calculate the bit length of the recovery message from the bit length of r ′ included in the signature σ ′ and the bit length parameter L. , 310 may transmit the bit length of the recovery message to the signature verification devices 220, 320.
In each of the above embodiments, the recovery message bit length M is variable, and the recovery message bit length M is input to the input unit 10d of the signature generation apparatuses 10-310. However, the recovery message bit length M may be fixed. In this case, the bit length M may be shared between the signature generation devices 10 to 310 and the signature verification devices 20 to 320.
Further, the hash function means a function for calculating a value representing the data for a certain data. In the present invention, not only SHA-1 and MD5, but also a hash function obtained by assigning a common key to a common key encryption function such as DES or Camellia can be used.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually as required by the processing capability of the apparatus that executes the process, or otherwise. Needless to say, changes can be made without departing from the scope of the present invention.
Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.
The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program according to this embodiment includes information provided for processing by an electronic computer and equivalent to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).
In each embodiment, this apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention is applicable to various uses using an electronic signature.

FIG. 1 is a conceptual diagram showing the overall configuration of the signature system of the first embodiment. FIG. 2 is a block diagram illustrating a hardware configuration of the signature generation apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a functional configuration of the signature generation apparatus according to the first embodiment. FIG. 4 is a diagram illustrating details of a functional configuration of the hash calculation unit according to the first embodiment. FIG. 5 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the first embodiment. FIG. 6 is a flowchart for explaining the signature generation processing according to the first embodiment. FIG. 7 is a flowchart for explaining an example of the process of step S15. FIG. 8 is a flowchart for explaining the signature verification processing according to the first embodiment. FIGS. 9A, 9B, and 9C are diagrams showing setting examples of “first bit position” and “second bit position”. FIG. 10 is a block diagram illustrating a functional configuration of the signature generation device 1 according to the second embodiment. FIG. 11 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the second embodiment. FIG. 12 is a flowchart for explaining a signature generation process according to the second embodiment. FIG. 13 is a flowchart for explaining the signature verification processing of the second embodiment. FIG. 14 is a block diagram illustrating a functional configuration of the signature generation apparatus according to the third embodiment. FIG. 15 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the third embodiment. FIG. 16 is a flowchart for explaining a signature generation process according to the third embodiment. FIG. 17 is a flowchart for explaining the signature verification processing according to the third embodiment. FIG. 18 is a block diagram illustrating a functional configuration of the signature generation apparatus according to the fourth embodiment. FIG. 19 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the fourth embodiment. FIG. 20 is a flowchart for explaining a signature generation process according to the fourth embodiment. FIG. 21 is a flowchart for explaining a signature verification process according to the fourth embodiment.

Explanation of symbols

1 Signature System 10-310 Signature Generation Device 20-320 Signature Verification Device

Claims (22)

A signature generation device for generating a signature,
A first storage unit for storing an integer secret key x;
A second storage unit for storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M ;
A third storage for storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N ;
An arbitrary value generator for generating an arbitrary value k of an integer;
A group operation unit that calculates R = g ^k ∈G when the cyclic group of order q is G and the generation source of the cyclic group G is g, and outputs the operation result R;
A hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) is determined depending on the calculation result R. A first hash operation unit that operates on the value β and outputs an L + M-bit hash value β = H ₀ (β) ∈ {0, 1} ^{L + M} as a result of the operation;
L + M-bit bit combination value in which the shared value hε {0,1} ^L with the signature verification device is arranged in the first bit position and the recovery message m _rec ε {0,1} ^M is arranged in the second bit position d = h | m _rec ε {0, 1} ^{L + M} is calculated, and a bit combination unit that outputs the bit combination value d;
The exclusive OR of the hash value Π and the bit combination value d = Π (+) dε {0,1} ^{L + M} is calculated ((+) is the exclusive OR operator), and the exclusive logic An exclusive OR operation unit for outputting a sum value r;
An output value is an integer hash function H ₃ : {0, 1} ^* → Z is applied to a value γ determined depending on the exclusive OR value r and the clear message m _clr, and is an operation result thereof. A third hash calculator that outputs a hash value t = H ₃ (γ) εZ;
an integer calculation unit that calculates s = kt−x∈Z and outputs the calculation result s;
A signature output unit that outputs the signature σ = (r, s) and the clear message m _clr ;
At least one of the value β and the value γ is
Furthermore, the value is determined depending on the bit length M of the recovery message m _rec .
A signature generation apparatus characterized by the above. A signature generation device for generating a signature,
A first storage unit for storing an integer secret key x;
A second storage unit for storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M ;
A third storage for storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N ;
An arbitrary value generator for generating an arbitrary value k of an integer;
A group operation unit that calculates R = g ^k ∈G when the cyclic group of order q is G and the generation source of the cyclic group G is g, and outputs the operation result R;
A hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) is determined depending on the calculation result R. A first hash operation unit that operates on the value β and outputs an L + M-bit hash value β = H ₀ (β) ∈ {0, 1} ^{L + M} as a result of the operation;
L + M-bit bit combination value in which the shared value hε {0,1} ^L with the signature verification device is arranged in the first bit position and the recovery message m _rec ε {0,1} ^M is arranged in the second bit position d = h | m _rec ε {0, 1} ^{L + M} is calculated, and a bit combination unit that outputs the bit combination value d;
The exclusive OR of the hash value Π and the bit combination value d = Π (+) dε {0,1} ^{L + M} is calculated ((+) is the exclusive OR operator), and the exclusive logic An exclusive OR operation unit for outputting a sum value r;
An output value is an integer hash function H ₃ : {0, 1} ^* → Z is applied to a value γ determined depending on the exclusive OR value r and the clear message m _clr, and is an operation result thereof. A third hash calculator that outputs a hash value t = H ₃ (γ) εZ;
an integer calculation unit that calculates s = kt−x∈Z and outputs the calculation result s;
A signature output unit that outputs the signature σ = (r, s) and the clear message m _clr ;
At least one of the value β and the value γ is
Further, the value is determined depending on the bit length N of the clear message m _clr .
A signature generation apparatus characterized by the above. A signature generation device for generating a signature,
A first storage unit for storing an integer secret key x;
A second storage unit for storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M ;
A third storage for storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N ;
An arbitrary value generator for generating an arbitrary value k of an integer;
A group operation unit that calculates R = g ^k ∈G when the cyclic group of order q is G and the generation source of the cyclic group G is g, and outputs the operation result R;
A hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) is determined depending on the calculation result R. A first hash operation unit that operates on the value β and outputs an L + M-bit hash value β = H ₀ (β) ∈ {0, 1} ^{L + M} as a result of the operation;
A hash function H ₁ having an output bit length of L bits: {0,1} ^* → {0,1} ^L is applied to a value α determined depending on the recovery message m _rec, and L bits as a result of the operation A second hash calculator that outputs a hash value h = H ₁ (α) ∈ {0, 1} ^L ,
The hash value hε {0,1} ^L is arranged at the first bit position, and the recovery message m _rec ε {0,1} ^M is arranged at the second bit position. m _rec ∈ {0, 1} ^{L + M} is calculated, and a bit combination unit that outputs the bit combination value d;
The exclusive OR of the hash value Π and the bit combination value d = Π (+) dε {0,1} ^{L + M} is calculated ((+) is the exclusive OR operator), and the exclusive logic An exclusive OR operation unit for outputting a sum value r;
An output value is an integer hash function H ₃ : {0, 1} ^* → Z is applied to a value γ determined depending on the exclusive OR value r and the clear message m _clr, and is an operation result thereof. A third hash calculator that outputs a hash value t = H ₃ (γ) εZ;
an integer calculation unit that calculates s = kt−x∈Z and outputs the calculation result s;
A signature output unit that outputs the signature σ = (r, s) and the clear message m _clr ;
A signature generation apparatus comprising: A signature generation device for generating a signature,
A first storage unit for storing an integer secret key x;
A second storage unit for storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M ;
A third storage for storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N ;
An arbitrary value generator for generating an arbitrary value k of an integer;
A group operation unit that calculates R = g ^k ∈G when the cyclic group of order q is G and the generation source of the cyclic group G is g, and outputs the operation result R;
A hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) is determined depending on the calculation result R. A first hash operation unit that operates on the value β and outputs an L + M-bit hash value β = H ₀ (β) ∈ {0, 1} ^{L + M} as a result of the operation;
A hash function H ₁ having an output bit length of L bits: {0, 1} ^* → {0, 1} ^L is applied to a value α determined depending on the clear message m _clr , and the L bit as a result of the operation A second hash calculator that outputs a hash value h = H ₁ (α) ∈ {0, 1} ^L ,
The hash value hε {0,1} ^L is arranged at the first bit position, and the recovery message m _rec ε {0,1} ^M is arranged at the second bit position. m _rec ∈ {0, 1} ^{L + M} is calculated, and a bit combination unit that outputs the bit combination value d;
Exclusive OR operation unit that calculates exclusive OR r = Π (+) dε {0, 1} ^{L + M} of the hash value Π and the bit combination value d and outputs the exclusive OR value r When,
An output value is an integer hash function H ₃ : {0, 1} ^* → Z is applied to a value γ determined depending on the exclusive OR value r and the clear message m _clr, and is an operation result thereof. A third hash calculator that outputs a hash value t = H ₃ (γ) εZ;
an integer calculation unit that calculates s = kt−x∈Z and outputs the calculation result s;
A signature output unit that outputs the signature σ = (r, s) and the clear message m _clr ;
A signature generation apparatus comprising: The signature generation device according to claim 3 or 4,
At least one of the value β and the value γ is
Furthermore, the value is determined depending on the bit length M of the recovery message m _rec .
A signature generation apparatus characterized by the above. The signature generation device according to claim 3 or 4,
At least one of the value β and the value γ is
Further, the value is determined depending on the bit length N of the clear message m _clr .
A signature generation apparatus characterized by the above. A signature verification device for verifying a signature,
A first memory for storing the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g And
A signature input unit that receives input of the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A second storage unit for storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
The bit length of the recovery message m _rec 'corresponding to the signature σ' is obtained by subtracting the value M 'obtained by subtracting the value L (L is a positive integer shared with the signature generation device) from the bit length of r' of the signature σ '. A bit length extraction unit that extracts M ′;
A third storage unit for storing the bit length M ′;
A hash function H ₃ that outputs an integer hash value: {0, 1} ^* → Z is applied to a value γ ′ determined depending on r ′ of the signature σ ′ and the clear message m _clr ′, A first hash calculation unit that outputs a hash value t ′ = H ₃ (γ ′) εZ that is the calculation result;
A group operation unit that performs an operation of R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the operation result R ′;
A hash function H ₀ having an output bit length of L + M ′ bits: {0, 1} ^* → {0, 1} ^{L + M ′} is applied to a value β ′ determined depending on the calculation result R ′, and the calculation result is A second hash calculator that outputs a certain L + M′-bit hash value '′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} ;
The exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} ′ between the hash value Π ′ and r ′ of the signature σ ′ is calculated, and the exclusive OR value d is calculated. An exclusive OR operation unit that outputs',
The shared value hε {0,1} ^L with the signature generation device is compared with the L-bit value h′ε {0,1} ^L at the first bit position of the exclusive OR value d ′, and h A comparator that outputs information indicating that the verification is successful on the condition that '= h;
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length M ′ of the recovery message m _rec ′.
A signature verification apparatus. A signature verification device for verifying a signature,
A first memory for storing the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g And
A signature input unit that receives input of the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A second storage unit for storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A third storage unit for storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′;
A fourth storage unit for storing the bit length N ′ of the clear message m _clr ′;
A hash function H ₃ that outputs an integer hash value: {0, 1} ^* → Z is applied to a value γ ′ determined depending on r ′ of the signature σ ′ and the clear message m _clr ′, A first hash calculation unit that outputs a hash value t ′ = H ₃ (γ ′) εZ that is the calculation result;
A group operation unit that performs an operation of R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the operation result R ′;
A hash function H _{0 having} an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device): {0, 1} ^* → {0, 1} ^{L + M ′} depends on the operation result R ′ A second hash operation unit that acts on the value β ′ determined in this way and outputs a hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} of the L + M ′ bit that is the operation result;
The exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} ′ between the hash value Π ′ and r ′ of the signature σ ′ is calculated, and the exclusive OR value d is calculated. An exclusive OR operation unit that outputs',
The shared value hε {0,1} ^L with the signature generation device is compared with the L-bit value h′ε {0,1} ^L at the first bit position of the exclusive OR value d ′, and h A comparator that outputs information indicating that the verification is successful on the condition that '= h;
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length N ′ of the clear message m _clr ′.
A signature verification apparatus. A signature verification device for verifying a signature,
A first memory for storing the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g And
A signature input unit that receives input of the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A second storage unit for storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A third storage unit for storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′;
A hash function H ₃ that outputs an integer hash value: {0, 1} ^* → Z is applied to a value γ ′ determined depending on r ′ of the signature σ ′ and the clear message m _clr ′, A first hash calculation unit that outputs a hash value t ′ = H ₃ (γ ′) εZ that is the calculation result;
A group operation unit that performs an operation of R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the operation result R ′;
A hash function H _{0 having} an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device): {0, 1} ^* → {0, 1} ^{L + M ′} depends on the operation result R ′ A second hash operation unit that acts on the value β ′ determined in this way and outputs a hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} of the L + M ′ bit that is the operation result;
The exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} ′ between the hash value Π ′ and r ′ of the signature σ ′ is calculated, and the exclusive OR value d is calculated. An exclusive OR operation unit that outputs',
A hash function H ₁ having an output bit length of L bits: {0, 1} ^* → {0, 1} ^L is converted into a value m _rec ' _∈ε of the M ′ bit at the second bit position of the exclusive OR value d ′. {0, 1} A third hash operation unit that operates on a value α ′ determined depending on ^{M ′} , and outputs an L-bit hash value H ₁ (α ′) ∈ {0, 1} ^L as a result of the operation When,
The L-value h′ε {0,1} ^L at the first bit position of the exclusive OR value d ′ is compared with the hash value H ₁ (α ′), and h ′ = H ₁ (α ') On the condition that the verification is successful, a comparison unit that outputs information indicating that the verification is successful,
A signature verification apparatus comprising: A signature verification device for verifying a signature,
A first memory for storing the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus when the cyclic group of order q is G and the generation source of the cyclic group G is g And
A signature input unit that receives input of the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A second storage unit for storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′;
A third storage unit for storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′;
A hash function H ₃ that outputs an integer hash value: {0, 1} ^* → Z is applied to a value γ ′ determined depending on r ′ of the signature σ ′ and the clear message m _clr ′, A first hash calculation unit that outputs a hash value t ′ = H ₃ (γ ′) εZ that is the calculation result;
A group operation unit that performs an operation of R ′ = g ^{s ′} · y ^{t ′} ∈G and outputs the operation result R ′;
A hash function H _{0 having} an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device): {0, 1} ^* → {0, 1} ^{L + M ′} depends on the operation result R ′ A second hash operation unit that acts on the value β ′ determined in this way and outputs a hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} of the L + M ′ bit that is the operation result;
The exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M} ′ between the hash value Π ′ and r ′ of the signature σ ′ is calculated, and the exclusive OR value d is calculated. An exclusive OR operation unit that outputs',
Hash function H ₁ having an output bit length of L bits: {0,1} ^* → {0,1} ^L is applied to a value α ′ determined depending on the clear message m _clr ′, and is a result of the calculation. A third hash calculator that outputs an L-bit hash value H ₁ (α ′) ∈ {0, 1} ^L ;
The L-value h′ε {0,1} ^L at the first bit position of the exclusive OR value d ′ is compared with the hash value H ₁ (α ′), and h ′ = H ₁ (α ') On the condition that the verification is successful, a comparison unit that outputs information indicating that the verification is successful,
A signature verification apparatus comprising: The signature verification device according to claim 9 or 10,
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length M ′ of the recovery message m _rec ′.
A signature verification apparatus. The signature verification device according to claim 9 or 10,
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length N ′ of the clear message m _clr ′.
A signature verification apparatus. A signature generation method for generating a signature,
Storing an integer secret key x in the first storage unit;
Storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M in the second storage unit;
Storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N in the third storage unit;
An arbitrary value generation unit generating an integer arbitrary value k;
A group calculation unit calculating R = g ^k ∈G when the cyclic group of order q is G, and the generation source of the cyclic group G is g, and outputting the calculation result R;
The first hash calculation unit calculates the hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) Acting on a value β determined depending on the result R, and outputting an L + M-bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the calculation result;
The bit combining unit arranges the shared value hε {0,1} ^L with the signature verification device in the first bit position, and L + M arranges the recovery message m _rec ε {0,1} ^M in the second bit position. Calculating a bit combination value d = h | m _rec ∈ {0, 1} ^{L + M} of the bits and outputting the bit combination value d;
The exclusive OR operation unit calculates an exclusive OR r = Π (+) dε {0,1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive OR value r is calculated. An output step;
The third hash calculator operates the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer on the value γ determined depending on the exclusive OR value r and the clear message m _clr. And outputting a hash value t = H ₃ (γ) εZ as a result of the calculation;
An integer calculation unit calculating s = kt−x∈Z and outputting the calculation result s;
A signature output unit outputting the signature σ = (r, s) and the clear message m _clr ;
At least one of the value β and the value γ is
Furthermore, the value is determined depending on the bit length M of the recovery message m _rec .
A signature generation method characterized by the above. A signature generation method for generating a signature,
Storing an integer secret key x in the first storage unit;
Storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M in the second storage unit;
Storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N in the third storage unit;
An arbitrary value generation unit generating an integer arbitrary value k;
A group calculation unit calculating R = g ^k ∈G when the cyclic group of order q is G, and the generation source of the cyclic group G is g, and outputting the calculation result R;
The first hash calculation unit calculates the hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) Acting on a value β determined depending on the result R, and outputting an L + M-bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the calculation result;
The bit combining unit arranges the shared value hε {0,1} ^L with the signature verification device in the first bit position, and L + M arranges the recovery message m _rec ε {0,1} ^M in the second bit position. Calculating a bit combination value d = h | m _rec ∈ {0, 1} ^{L + M} of the bits and outputting the bit combination value d;
The exclusive OR operation unit calculates an exclusive OR r = Π (+) dε {0,1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive OR value r is calculated. An output step;
The third hash calculator operates the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer on the value γ determined depending on the exclusive OR value r and the clear message m _clr. And outputting a hash value t = H ₃ (γ) εZ as a result of the calculation;
An integer calculation unit calculating s = kt−x∈Z and outputting the calculation result s;
A signature output unit outputting the signature σ = (r, s) and the clear message m _clr ;
At least one of the value β and the value γ is
Further, the value is determined depending on the bit length N of the clear message m _clr .
A signature generation method characterized by the above. A signature generation method for generating a signature,
Storing an integer secret key x in the first storage unit;
Storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M in the second storage unit;
Storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N in the third storage unit;
An arbitrary value generation unit generating an integer arbitrary value k;
A group calculation unit calculating R = g ^k ∈G when the cyclic group of order q is G, and the generation source of the cyclic group G is g, and outputting the calculation result R;
The first hash calculation unit calculates the hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) Acting on a value β determined depending on the result R, and outputting an L + M-bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the calculation result;
The second hash calculator applies a hash function H ₁ : {0,1} ^* → {0,1} ^L having an output bit length of L bits to a value α determined depending on the recovery message m _rec ; Outputting an L-bit hash value h = H ₁ (α) ε {0, 1} ^L as a result of the operation;
A bit combining unit arranges the hash value hε {0,1} ^L in the first bit position and the bit combination of L + M bits in which the recovery message m _rec ε {0,1} ^M is arranged in the second bit position. Calculating a value d = h | m _rec ∈ {0, 1} ^{L + M} and outputting the bit combination value d;
The exclusive OR operation unit calculates an exclusive OR r = Π (+) dε {0,1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive OR value r is calculated. An output step;
The third hash calculator operates the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer on the value γ determined depending on the exclusive OR value r and the clear message m _clr. And outputting a hash value t = H ₃ (γ) εZ as a result of the calculation;
An integer calculation unit calculating s = kt−x∈Z and outputting the calculation result s;
A signature output unit outputting the signature σ = (r, s) and the clear message m _clr ;
A signature generation method characterized by comprising: A signature generation method for generating a signature,
Storing an integer secret key x in the first storage unit;
Storing an M-bit (M ≧ 1) recovery message m _rec ε {0,1} ^M in the second storage unit;
Storing N-bit (N ≧ 1) clear message m _clr ε {0, 1} ^N in the third storage unit;
An arbitrary value generation unit generating an integer arbitrary value k;
A group calculation unit calculating R = g ^k ∈G when the cyclic group of order q is G, and the generation source of the cyclic group G is g, and outputting the calculation result R;
The first hash calculation unit calculates the hash function H ₀ : {0,1} ^* → {0,1} ^{L + M} having an output bit length of L + M bits (L is a positive integer shared with the signature verification apparatus) Acting on a value β determined depending on the result R, and outputting an L + M-bit hash value Π = H ₀ (β) ε {0,1} ^{L + M} , which is the calculation result;
The second hash calculator applies a hash function H ₁ : {0,1} ^* → {0,1} ^L having an output bit length of L bits to a value α determined depending on the clear message m _clr , Outputting an L-bit hash value h = H ₁ (α) ε {0, 1} ^L as a result of the operation;
A bit combining unit arranges the hash value hε {0,1} ^L in the first bit position and the bit combination of L + M bits in which the recovery message m _rec ε {0,1} ^M is arranged in the second bit position. Calculating a value d = h | m _rec ∈ {0, 1} ^{L + M} and outputting the bit combination value d;
The exclusive OR operation unit calculates an exclusive OR r = Π (+) dε {0,1} ^{L + M} between the hash value Π and the bit combination value d, and the exclusive OR value r is calculated. An output step;
The third hash calculator operates the hash function H ₃ : {0, 1} ^* → Z whose output value is an integer on the value γ determined depending on the exclusive OR value r and the clear message m _clr. And outputting a hash value t = H ₃ (γ) εZ as a result of the calculation;
An integer calculation unit calculating s = kt−x∈Z and outputting the calculation result s;
A signature output unit outputting the signature σ = (r, s) and the clear message m _clr ;
A signature generation method characterized by comprising: A signature verification method for verifying a signature,
When the cyclic group of order q is G and the generation source of the cyclic group G is g, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus is stored in the first storage unit. Storing, and
A step of inputting the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ into the signature input unit;
Storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ in a second storage unit;
The recovery message corresponding to the signature σ ′ is obtained by subtracting the value M ′ obtained by subtracting the value L (L is a positive integer shared with the signature generation device) from the bit length of r ′ of the signature σ ′. extracting m _rec 'as a bit length M';
Storing the bit length M ′ in a third storage unit;
The first hash calculator determines a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value depending on r ′ included in the signature σ ′ and the clear message m _clr ′. Acting on the value γ ′ and outputting a hash value t ′ = H ₃ (γ ′) εZ as a result of the operation;
A group operation unit performing an operation of R ′ = g ^{s ′} · y ^{t ′} εG and outputting the operation result R ′;
The second hash calculation unit changes the hash function H ₀ having an output bit length of L + M ′ bits: {0, 1} ^* → {0, 1} ^{L + M ′} to a value β ′ determined depending on the calculation result R ′. Outputting a hash value Π ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} of the L + M ′ bits that is the operation result;
The exclusive OR operation unit calculates an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. Outputting the exclusive OR value d ′;
The comparison unit obtains the shared value hε {0, 1} ^L with the signature generation device and the L-bit value h′ε {0, 1} ^L at the first bit position of the exclusive OR value d ′. A step of outputting information indicating that the verification is successful on the condition that h ′ = h.
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length M ′ of the recovery message m _rec ′.
And a signature verification method. A signature verification method for verifying a signature,
When the cyclic group of order q is G and the generation source of the cyclic group G is g, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus is stored in the first storage unit. Storing, and
A step of inputting the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ into the signature input unit;
Storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ in a second storage unit;
Storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ in the third storage unit;
Storing the bit length N ′ of the clear message m _clr ′ in a fourth storage unit;
The first hash calculator determines a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value depending on r ′ included in the signature σ ′ and the clear message m _clr ′. Acting on the value γ ′ and outputting a hash value t ′ = H ₃ (γ ′) εZ as a result of the operation;
A group operation unit performing an operation of R ′ = g ^{s ′} · y ^{t ′} εG and outputting the operation result R ′;
The second hash calculator calculates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M ′} having an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device), A step of acting on a value β ′ determined depending on the operation result R ′, and outputting an ^{L +} M′-bit hash value β ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} as the operation result; ,
The exclusive OR operation unit calculates an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. Outputting the exclusive OR value d ′;
The comparison unit obtains the shared value hε {0, 1} ^L with the signature generation device and the L-bit value h′ε {0, 1} ^L at the first bit position of the exclusive OR value d ′. A step of outputting information indicating that the verification is successful on the condition that h ′ = h.
At least one of the value β ′ and the value γ ′ is
Furthermore, the value is determined depending on the bit length N ′ of the clear message m _clr ′.
And a signature verification method. A signature verification method for verifying a signature,
When the cyclic group of order q is G and the generation source of the cyclic group G is g, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus is stored in the first storage unit. Storing, and
A step of inputting the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ into the signature input unit;
Storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ in a second storage unit;
Storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ in the third storage unit;
The first hash calculator determines a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value depending on r ′ included in the signature σ ′ and the clear message m _clr ′. Acting on the value γ ′ and outputting a hash value t ′ = H ₃ (γ ′) εZ as a result of the operation;
A group operation unit performing an operation of R ′ = g ^{s ′} · y ^{t ′} εG and outputting the operation result R ′;
The second hash calculator calculates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M ′} having an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device), A step of acting on a value β ′ determined depending on the operation result R ′, and outputting an ^{L +} M′-bit hash value β ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} as the operation result; ,
The exclusive OR operation unit calculates an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. Outputting the exclusive OR value d ′;
The third hash calculator calculates a hash function H ₁ with an output bit length of L bits: {0, 1} ^* → {0, 1} ^L , M ′ at the second bit position of the exclusive OR value d ′. The bit value m _rec '∈ {0,1} is applied to a value α ′ determined depending on ^{M ′} , and an L-bit hash value H ₁ (α ′) ∈ {0,1} ^L as a result of the operation is set to Output step;
The comparison unit compares the L-bit value h′∈ {0, 1} ^L at the first bit position of the exclusive OR value d ′ with the hash value H ₁ (α ′), and h ′ = A step of outputting information indicating that the verification is successful on the condition that H ₁ (α ′);
A signature verification method comprising: A signature verification method for verifying a signature,
When the cyclic group of order q is G and the generation source of the cyclic group G is g, the public key y = g ^x ∈G corresponding to the secret key x∈Z of the signature generation apparatus is stored in the first storage unit. Storing, and
A step of inputting the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ into the signature input unit;
Storing the signature σ ′ = (r ′, s ′) and the clear message m _clr ′ in a second storage unit;
Storing the bit length M ′ of the recovery message m _rec ′ corresponding to the signature σ ′ in the third storage unit;
The first hash calculator determines a hash function H ₃ : {0, 1} ^* → Z that outputs an integer hash value depending on r ′ included in the signature σ ′ and the clear message m _clr ′. Acting on the value γ ′ and outputting a hash value t ′ = H ₃ (γ ′) εZ as a result of the operation;
A group operation unit performing an operation of R ′ = g ^{s ′} · y ^{t ′} εG and outputting the operation result R ′;
The second hash calculator calculates a hash function H ₀ : {0, 1} ^* → {0, 1} ^{L + M ′} having an output bit length of L + M ′ bits (L is a positive integer shared with the signature generation device), A step of acting on a value β ′ determined depending on the operation result R ′, and outputting an ^{L +} M′-bit hash value β ′ = H ₀ (β ′) ∈ {0, 1} ^{L + M ′} as the operation result; ,
The exclusive OR operation unit calculates an exclusive OR d ′ = Π ′ (+) r′∈ {0, 1} ^{L + M ′} between the hash value Π ′ and r ′ included in the signature σ ′. Outputting the exclusive OR value d ′;
The third hash operation unit operates the hash function H ₁ with an output bit length of L bits: {0, 1} ^* → {0, 1} ^L on the value α ′ determined depending on the clear message m _clr ′. And outputting an L-bit hash value H ₁ (α ′) ∈ {0, 1} ^L as the operation result;
The comparison unit compares the L-bit value h′∈ {0, 1} ^L at the first bit position of the exclusive OR value d ′ with the hash value H ₁ (α ′), and h ′ = A step of outputting information indicating that the verification is successful on the condition that H ₁ (α ′);
A signature verification method comprising:   The program for functioning a computer as a signature production | generation apparatus in any one of Claim 1 to 6.   The program for functioning a computer as a signature verification apparatus in any one of Claims 7-12.

Images