JP2011145361A - Signature generating device, signature verifying device, relink key generating device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent, even when a relink key is abused, the anonymity of a signer corresponding to the relink key from being lost. <P>SOLUTION: The result of applying a non-degenerate bilinear map e to a pair of an element hE*G<SB>1</SB>and a generator g<SB>2</SB>E*G<SB>2</SB>by using a set of hE*G<SB>1</SB>determined to the information containing a message m, a relink key r=h<SP>x(i)</SP>E*G<SB>1</SB>, and a public key y(n)E*G<SB>2</SB>(nE*L), is defined as e<SB>1</SB>. An element a(i)=e<SB>1</SB><SP>t</SP>E*G<SB>T</SB>of a cyclic group G<SB>T</SB>when t is an arbitrary integer is generated, and the result of applying the non-degenerate bilinear map e to a pair of an element z(j)E*G<SB>1</SB>and the generator g<SB>2</SB>E*G<SB>2</SB>is defined as e<SB>2</SB>. The result of applying e to the element hE*G<SB>1</SB>and a public key y(j)E*G<SB>2</SB>is defined as e<SB>3</SB>. Then, a(j)=e<SB>2</SB>×e<SB>3</SB><SP>c(j)</SP>E*G<SB>T</SB>is generated and, by using an integer w determined to the information containing a set a<SB>L</SB>composed of an element a(i)E*G<SB>T</SB>and an element a(j)E*G<SB>T</SB>, and the sum Σc(j) of integers c(j), c(i)=w-Σc(j) is generated, z(i)=h<SP>t</SP>×r<SP>-c(i)</SP>E*G<SB>1</SB>is generated, and a signature σ=(c<SB>L</SB>, z<SB>L</SB>) is generated. Here, E* is a set symbol meaning "belong to". <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an application technology of information security technology, and more particularly to an anonymous signature method for generating a signature anonymously.

  There are a group signature method, a ring signature method, and the like as an anonymous signature method capable of ensuring the anonymity of the signer. In these methods, an anonymous signature group consisting of one or more members is formed, and an anonymous signature is generated. The signature verifier can verify whether the anonymous signature was generated by any member of the anonymous signature group, but cannot know which member is the signer.

  Non-Patent Document 1 discloses a method capable of changing (relinking) members of an anonymous signature group after an anonymous signature is generated. In the method of Non-Patent Document 1, the members of the anonymous signature group can be changed using a key called a relink key, and thereby the strength of the anonymity of the signer can be changed. In other words, the person who acquired the relink key can strengthen the anonymity of the signer by increasing the number of members of the anonymous signature group, and can reduce the number of members of the signer by reducing the number of members of the anonymous signature group. Anonymity can be weakened.

Hoshino Literature, Kotaro Suzuki, Tetaro Kobayashi, “Flexible Ring Signature”, The Institute of Electronics, Information and Communication Engineers, The 2009 Symposium on Cryptography and Information Security Otsu, Japan, Jan. 20-23, 2009.

  However, in the method of Non-Patent Document 1, one relink key corresponds to one public key of a member who is a true signer. In other words, the third party who acquired the relink key can use the relink key to reduce the strength of the signer's anonymity for all anonymous signatures whose members corresponding to the relink key are signers. Can change. Therefore, when the relink key is abused, there is a problem that the anonymity of the signer is lost for all anonymous signatures whose members corresponding to the relink key are signers.

  The present invention has been made in view of such points, and even when a relink key is misused, it is possible to suppress loss of anonymity of a signer corresponding to the relink key. The aim is to provide possible technology.

  In the present invention, in order to solve the above-described problem, a relink key is generated for each message to be signed.

In the first aspect of the present invention, G ₁ , G ₂ , and G _T are cyclic groups, e is a non-degenerate bilinear map that maps the original set of cyclic groups G ₁ and G _{2 to} the elements of the cyclic group G _T , Let g ₂ ∈G _{2 be} the generator of the cyclic group G ₂ , L be a set of information corresponding to members of the anonymous signature group, n be each element of the set L, and any element of the set L be i∈ L, each element of set L excluding i is j∈L (j ≠ i), x (n) (n∈L) is an integer secret key corresponding to element n∈L, and cyclic group G ₂ Let y (n) = g ₂ ^{x (n)} ∈ G ₂ (n∈L) be a public key corresponding to element n∈L.

In the signature generation of the first aspect, the element hεG ₁ of the cyclic group G ₁ determined for the information including the message m and the relink key r = h ^x that is the element of the cyclic group G ₁ corresponding to the message m. ⁽ⁱ⁾ and ∈G _1, using a set of public key _{y (n) ∈G 2 (n∈L} ), non-degenerate bilinear map to the set of original H∈G ₁ and a generator g ₂ ∈G ₂ Generate e ( ^t ) = e ₁ ^t ∈G _T of cyclic group G _T , where e ₁ is the result of acting on e and t is an arbitrary integer, and any element of cyclic group G ₁ Let e ₂ be the result of applying the nondegenerate bilinear map e to the pair of z (j) ∈G ₁ (j∈L (j ≠ i)) and generator g ₂ ∈G _2, and let the element h∈G ₁ And the public key y (j) ∈G ₂ (j∈L (j ≠ i)) and the non-degenerate bilinear map e as e ₃ and c (j) (j∈L (j ≠ i )) Is an arbitrary integer, the element a (j) = e ₂・ e ₃ ^{c (j)} ∈G _T (j∈L (j ≠ i)) of the cyclic group G _T is generated, and the element a (i) the ∈G _T and the original a (j) ∈G _T integer determined relative to (j∈L (j ≠ i)) from become set information including a _L w Using the sum Σc (j) of integer c (j) (j∈L (j ≠ i)), generate integer c (i) = w−Σc (j) (j∈L (j ≠ i)) Element h∈G ₁ , relink key r∈G ₁ , integer t and integer c (i), and element z (i) = h ^t・ r ^{-c (i)} ∈ G ₁ of cyclic group G ₁ And a set c _L consisting of an integer c (j) (j∈L (j ≠ i)) and an integer c (i) and an element z (j) ∈G ₁ (j∈L (j ≠ i) ) And the set z _L consisting of the element z (i) ∈G ₁ , the signature σ = (c _L , z _L ) is output.

The signature verification of the first embodiment, the public key y (n) ∈G ₂ a set of (n∈L), the integer c (n) consists of (n∈L) set c _L and the cyclic group G ₁ of the original z ( Using the signature σ = (c _L , z _L ) containing the set z _L consisting of n) ∈G ₁ (n∈L) and the message m, generate the element z (n) ∈G ₁ (n∈L) original g ₂ ∈G ₂ and set to the result of the action of non-degenerate bilinear mapping e of the e _4, based H∈G ₁ and the public key y of the cyclic group G ₁ defined for the information including the message m ( element a (n) = e ₄・ e ₅ ^{c of} cyclic group G _T , where e ₅ is the result of applying the non-degenerate bilinear map e to the pair with n) ∈ G ₂ (n∈L) ⁽ⁿ⁾ ∈ G _T (n∈L) is generated, and an integer w determined for information including the set a _L consisting of elements a (n) (n∈L) and an integer c (n) (n∈L ) And the sum Σc (n) (n∈L) are matched.

In the second aspect of the present invention, G is a cyclic group, g∈G is a generator of the cyclic group G, L is a set of information corresponding to members of the anonymous signature group, and n is an element of the set L. , Any element of set L is i∈L, each element of set L excluding i is j∈L (j ≠ i), and x (n) (n∈L) corresponds to element n∈L And y (n) = g ^{x (n)} ∈ G (n∈L) is a public key corresponding to each element n∈L.

In the signature generation of the second aspect, t is an arbitrary integer, T is an element T of the cyclic group G = G ^t ∈G, c is an integer determined for information including the element T and the message m, z = t + x (i) · c, using a relink key r = (T, z) corresponding to the message m, an integer c, and a set of public keys y (n) ∈G (n∈L), Generate an element T (i) = g ^{t (i)} ∈ G of a cyclic group G where t (i) is an arbitrary integer, and c (j) (j∈L (j ≠ i)) an integer, z (j) (j∈L ( j ≠ i)) in the case where the set to any integer, the original T of the cyclic group ^{G (j) = g z (} j) (T · y (j) c) ^{c (j)} ∈ G, and for the information including the set T _L and the element T consisting of the element T (i) ∈G and the element T (j) (j∈L (j ≠ i)) ∈G And an integer c (j) (j∈L (j ≠ i)) sum Σc (j), and an integer c (i) = w′−Σc (j) (j∈L ( j ≠ i)) to generate an integer z (i) = t (i) -z ・ c (i), and the element T∈G and the integer c (j) (j∈L (j ≠ i) ) i from an integer c (a i) and the set c _L consisting integer z (j) (j∈L (j ≠ i)) and the integer z (i) ∈G And a set z _L, signature sigma = outputs a _{(T, c L, z L} ).

In the signature generation second aspect, the signature comprising a set z _L of cyclic groups of the original T∈G and integer c (n) (n∈L) set c _L and integer z of (n) (n∈L) σ = (T, c _L , z _L ), a set of public keys y (n) ∈G (n∈L), a message m, and an integer c determined for information including the element T and the message m To generate the element T (n) = g ^{z (n)} (T ・ y (n) ^c ) ^{c (n)} ∈ G (n∈L) of the cyclic group G, and the element T (n) ∈G Whether or not the integer w ′ determined for the information including the set T _L and the element T of (n∈L) and the sum Σc (n) of the integer c (n) (n∈L) match. judge.

  In the present invention, a relink key is generated for each message to be signed. Therefore, even if the relink key is abused, the range in which the anonymity of the signer may be lost can be limited to the range of the anonymous signature for the message. Thereby, even if it is a case where a relink key is abused, it can suppress that the anonymity of the signer corresponding to the relink key is lost.

The block diagram for demonstrating the whole structure of the anonymous signature system of 1st Embodiment. The figure for demonstrating the function structure of the relink key generation apparatus of 1st Embodiment. The figure for demonstrating the function structure of the signature production | generation apparatus of 1st Embodiment. The figure for demonstrating the function structure of the signature verification apparatus of 1st Embodiment. The flowchart for demonstrating the relink key production | generation process of 1st Embodiment. The flowchart for demonstrating the signature production | generation process of 1st Embodiment. The flowchart for demonstrating the signature verification process of 1st Embodiment. The block diagram for demonstrating the whole structure of the anonymous signature system of 2nd Embodiment. The figure for demonstrating the function structure of the relink key generation apparatus of 2nd Embodiment. The figure for demonstrating the function structure of the signature production | generation apparatus of 2nd Embodiment. The figure for demonstrating the function structure of the signature verification apparatus of 2nd Embodiment. The flowchart for demonstrating the relink key production | generation process of 2nd Embodiment. The flowchart for demonstrating the signature production | generation process of 2nd Embodiment. The flowchart for demonstrating the signature verification process of 2nd Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Definition of symbols and terms]
First, symbols and terms used in the embodiment are defined.

E: E is an elliptic curve defined on a finite field F T of order _T. A binary operation called elliptic addition can be defined for any two points on the elliptic curve E, and a unary operation called elliptic inverse can be defined for any one point on the elliptic curve E. In addition, it is well known that a group can be defined for this elliptic addition, and an operation called elliptic scalar multiplication can be defined using elliptic addition. Also, various algorithms for efficiently executing these operations on a computer are well known (for example, Reference 1 “Ian F. Braque, Gadiel Selossi, Nigel P. Smart = Author,“ Ellipse ”). "Curve cryptography", publication = Pearson Education, ISBN4-89471-431-0 "etc.).

α∈β: α is an element of β.
α∈ _U β: Indicates that α is randomly selected from β.
α ← β: Indicates that β is substituted for α.
p: p is a large prime number.

G, G ₁ , G ₂ : G, G ₁ , G ₂ , G _T are cyclic groups. For example, G, G ₁ , G ₂ , and G _T are prime order cyclic groups of order p. The cyclic groups G, G ₁ and G ₂ may be the same as each other, or at least some of them may be different from each other. Any cyclic group G, G ₁ , G ₂ , G _T may be used. Examples of the cyclic groups G, G ₁ , G ₂ , and G _T are groups formed by rational points on the elliptic curve E and multiplicative groups on a finite field. Note that ε · ηεG means that an operation defined by the cyclic group G is performed on the elements ε and η of the cyclic group G. Ε ^ν ∈ G ( ^ν ∈ Z) means that the operation defined in the cyclic group G is performed ν times on the element ε of the cyclic group G (ε · ε ... ε · ε∈G). To do. For example, if the cyclic group G is a group of rational points on the elliptic curve E, the operation defined by the cyclic group G is elliptic addition, and if the cyclic group G is a multiplicative group of finite fields, The operation defined in group G is a remainder multiplication. The same applies to the other cyclic groups G ₁ , G ₂ , and G _T.

g: g is a generator of the cyclic group G.
g ₂ : g ₂ is a generator of the cyclic group G ₂ .
Z _p : Z _p is a module (Z / pZ) of a residue class by _p . At the time of mounting, for example, a module consisting of a representative element of Z _p is used. An example of a representative element is a set of integers between 0 and p-1.
e: e is a non-degenerate bilinear map that maps the original set of cyclic groups G ₁ and G _{2 to} the elements of cyclic group G _T. The non-degenerate bilinear map e is, for example,
e: G ₁ × G ₂ → G _T (1)
The operation may be performed as
e: G ₂ × G ₁ → G _T (2)
The calculation may be performed as follows.

The non-degenerate bilinear map e that is operated as Equation (1) satisfies the following properties.
[Bilinearity] For all Γ ₁ ∈G ₁ , Γ ₂ ∈G ₂ and ν, κ∈Z _p , the following relation is satisfied.
e (ν ・ Γ ₁ , κ ・ Γ ₂ ) = e (Γ ₁ , Γ ₂ ) ^{ν ・ κ} … (3)
Non degenerative] All gamma ₁ ∈G _1, not a function View daylight gamma ₂ ∈G ₂ to unity of the cyclic group G _T.
[Computability] There is an algorithm for efficiently calculating e (Γ ₁ , Γ ₂ ) for every Γ ₁ ∈G ₁ and Γ ₂ ∈G ₂ .

The non-degenerate bilinear map e that is operated as Equation (2) satisfies the following properties.
[Bilinearity] For all Γ ₂ ∈G ₂ , Γ ₁ ∈G ₁ and ν, κ∈Z _p , the following relation is satisfied.
e (ν ・ Γ ₂ , κ ・ Γ ₁ ) = e (Γ ₂ , Γ ₁ ) ^{ν ・ κ} … (4)
Non degenerative] All gamma ₁ ∈G _1, not a function View daylight gamma ₂ ∈G ₂ to unity of the cyclic group G _T.
[Computability] There is an algorithm for efficiently calculating e (Γ ₁ , Γ ₂ ) for every Γ ₁ ∈G ₁ and Γ ₂ ∈G ₂ .

Further, when G ₁ = G ₂ , all the operations of the non-degenerate bilinear map e may be performed by only one of the equations (1) or (2), or some of the non-degenerate bilinear maps e The calculation may be performed by Expression (1), and the remaining non-degenerate bilinear map e may be calculated by Expression (2). Furthermore, for G ₁ = G ₂ , for all Γ ₁ ∈G ₁ and Γ ₂ ∈G ₂
e (Γ ₁ , Γ ₂ ) = e (Γ ₂ , Γ ₁ )… (5)
A non-degenerate bilinear map e (non-degenerate symmetric bilinear map) satisfying
e (Γ ₁ , Γ ₂ ) = e (Γ ₂ , Γ ₁ ) ^-1 … (6)
A non-degenerate bilinear map e (non-degenerate antisymmetric bilinear map) satisfying may be used.

Also, regardless of whether G ₁ = G ₂ or not, if the operation of all non-degenerate bilinear maps e is performed in one of the equations (1) or (2), the non-degenerate bilinear map e As the above, one satisfying the formula (5) may be used, or one satisfying the formula (6) may be used.

Specific examples of non-degenerate bilinear maps e include Weil pairing and Tate pairing (reference document 2 “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS, ISBN0-7923-9368-6, pp. 61-81 ”) and Reference 3“ IEEE P1636.3 ^TM / D1 Draft Standard for Identity-based Public-key Cryptography Using Pairings ”, [URL: http://grouper.ieee.org/groups /1363/IBC/material/P1363.3-D1-200805.pdf], pp.24-25, April 2008 ”e (A ₁ , φ (A ₂ )) (non-degenerate antisymmetric bilinear mapping Example).

H: H is a function that can be regarded as a random function that moves a bit string {0,1} ^* of arbitrary bit length to the element of cyclic group G ₁ (pseudo random function)
H: {0,1} ^* → G ₁ … (7)
It is. Such a pseudo random function H can be easily configured using a known hash function such as SHA-1.

H ', H'':H' and H '' are pseudo-random functions that move a bit string {0,1} ^* of arbitrary bit length to the element of Z _p
H ': {0,1} ^* → Z _p … (8)
H '': {0,1} ^* → Z _p … (9)
It is. Such pseudo random functions H ′ and H ″ can be easily configured using a known hash function such as SHA-1. Moreover, the pseudo random functions H, H ′, H ″ are independent of each other.

L: L is a set of information corresponding to members of the anonymous signature group. For example, it is a set of indexes that identify each member of the anonymous signature group.
n, i, j: n is each element of the set L (∀n∈L). i is any element of the set L (i∈L), and is information corresponding to a member who is a true signer. J is each element of the set L excluding i (j∈L (j ≠ i)).
x (n): x (n) ∈Z _p (n∈L) is a secret key corresponding to each element n∈L.
y (n): y (n) = g ₂ ^{x (n)} ∈ G ₂ (n∈L) is a public key corresponding to each element n∈L.

[First Embodiment]
First, a first embodiment of the present invention will be described.

<Overall configuration>
FIG. 1 is a block diagram for explaining the overall configuration of the anonymous signature system 1 of the first embodiment.

  As illustrated in FIG. 1, the anonymous signature system 1 includes a key generation device 11 and I (I is an integer of 1 or more) relink key generation devices 12-i (i∈ {1,..., I }), A signature generation device 13, and a signature verification device 14, which are configured to be communicable through a network. Note that the number of devices is not limited to that illustrated in FIG. 1, and there may be two or more key generation devices 11, signature generation devices 13, and signature verification devices 14. Further, a configuration in which the functions of a plurality of devices illustrated in FIG. 1 are provided in one device may be used, or a configuration in which the configuration of one device illustrated in FIG. 1 is distributed to a plurality of devices. Also good.

<Relink key generation device 12-i>
FIG. 2 is a diagram for explaining a functional configuration of the relink key generation device 12-i according to the first embodiment.
As illustrated in FIG. 2, the relink key generation device 12-i according to the present embodiment includes a storage unit 121-i, a control unit 122-i, a cyclic group calculation unit 123-i, and a relink key generation unit 124. -I, input part 125-i, and output part 126-i.

  The relink key generation device 12-i has a predetermined program read into a known computer or a dedicated computer including, for example, a central processing unit (CPU), a random-access memory (RAM), a magnetic recording device, and a communication device. It is composed by being executed. For example, the storage unit 121-i is a storage area configured by, for example, a RAM, a magnetic recording device, or a combination thereof. The control unit 122-i, the cyclic group calculation unit 123-i, and the relink key generation unit 124-i are, for example, processing units configured by reading a predetermined program into the CPU. The input unit 125-i is an input interface, an input port, a communication device, or a combination of at least a part thereof. The output unit 126-i is an output interface, an output port, a communication device, or a combination of at least a part thereof. Further, the relink key generation device 12-i executes each process under the control of the control unit 122-i.

<Signature generation device 13>
FIG. 3 is a diagram for explaining a functional configuration of the signature generation apparatus 13 according to the first embodiment.
As illustrated in FIG. 3, the signature generation device 13 of this embodiment includes a storage unit 131, a control unit 132 a, an arbitrary value output unit 132 c, cyclic group calculation units 132 b, 132 d to 132 g, 132 i, and difference information generation A unit 132h, an input unit 133, and an output unit 134.

  The signature generation device 13 is configured, for example, by reading and executing a predetermined program on a known computer or a dedicated computer including a CPU, a RAM, a magnetic recording device, a communication device, and the like. For example, the storage unit 131 is a storage area configured by, for example, a RAM, a magnetic recording device, or a combination thereof. The control unit 132a, the arbitrary value output unit 132c, the cyclic group calculation units 132b, 132d to 132g, 132i, and the difference information generation unit 132h are, for example, processing units configured by reading a predetermined program into the CPU. The input unit 133 is a combination of an input interface, an input port, a communication device, and at least a part thereof. The output unit 134 is a combination of an output interface, an output port, a communication device, and at least a part thereof. In addition, the signature generation device 13 executes each process under the control of the control unit 132a.

<Signature Verification Device 14>
FIG. 4 is a diagram for explaining a functional configuration of the signature verification apparatus 14 according to the first embodiment.
As illustrated in FIG. 4, the signature verification apparatus 14 according to the present exemplary embodiment includes a storage unit 141, a control unit 142, cyclic group calculation units 143 and 144, a determination unit 145, and an input unit 146.

  The signature verification device 14 is configured by, for example, reading and executing a predetermined program on a known computer or a dedicated computer including a CPU, a RAM, a magnetic recording device, a communication device, and the like. For example, the storage unit 141 is a storage area configured by, for example, a RAM, a magnetic recording device, or a combination thereof. The control unit 142, the cyclic group calculation units 143 and 144, and the determination unit 145 are, for example, processing units configured by reading a predetermined program into the CPU. The input unit 133 is a combination of an input interface, an input port, a communication device, and at least a part thereof. In addition, the signature verification apparatus 14 executes each process under the control of the control unit 132a.

<Pre-processing>
The security parameter k is determined in the anonymous signature system 1, and the system parameter ρ = (p, G ₁ , G ₂ , G _T , e, g ₂ , H, H ′) corresponding to the security parameter k
Is determined. Note that when G ₁ = G ₂ , the system parameter ρ in which _one of G ₁ and G ₂ is omitted may be used. The system parameter ρ is distributed to all devices constituting the anonymous signature system 1, and the same system parameter ρ is used in each device.
In addition, the storage unit 121-i of each relink key generation device 12-i (FIG. 2) stores information i corresponding to members of the anonymous signature group corresponding to the relink key generation device 12-i. The

<Key generation process>
The key generation device 11 has a secret key corresponding to each relink key generation device 12-i (iε {1, ..., I}).
x (i) ∈ _U Z _p … (10)
And public key
y (i) ← g ₂ ^{x (i)} ∈G _G2 … (11)
And are generated.
The secret key x (i) is distributed to the corresponding relink key generation device 12-i. The secret key x (i) is secret information, and is securely stored in the storage unit 121-i of the corresponding relink key generation device 12-i (FIG. 2). On the other hand, the public key y (i) is public information and is distributed to the signature generation device 13 and the signature verification device 14 as necessary.

<Relink key generation process>
FIG. 5 is a flowchart for explaining the relink key generation processing of the first embodiment.
In the relink key generation processing according to the present embodiment, first, any member (true signer) of the anonymous signature group receives an input unit 125-i of any relink key generation device 12-i (FIG. 2). The message to be signed m∈ {0,1} ^* is input. The message m input to the input unit 125-i is stored in the storage unit 121-i (step S111).

Next, message m is read into cyclic group calculation unit 123-i, and cyclic group calculation unit 123-i generates element hεG ₁ of cyclic group G ₁ determined for information including message m. In this embodiment, the cyclic group calculation unit 123-i applies a pseudo random function H to the message m.
h = H (m) ∈G ₁ (12)
Is generated and stored in the storage unit 121-i (step S112).

Then, re-link key generation unit 124-i based on h is read in, relinking key is the cyclic group G ₁ of the original corresponding to the message m
r = h ^{x (i)} ∈ G ₁ (13)
Is generated and stored in the storage unit 121-i (step S113).

Next, relink key ^{r = h x (i) ∈G} 1 and the message m and the information i is sent to the output unit 126-i. Output unit 126-i outputs the relink keys R∈G ₁ and the message m and the information i (step S114). The output relink key rεG ₁ , message m, and information i are transmitted to the signature generation device 13 via a network, for example.

<Signature generation processing>
FIG. 6 is a flowchart for explaining the signature generation processing according to the first embodiment.
In the signature generation process, first, the relink key r = h ^{x (i)} εG ₁ , the message m, and the information i sent from any of the relink key generation devices 12-i are converted into the signature generation device 13 (FIG. 3) is input (received) to the input unit 133 and stored in the storage unit 131. Also, a set L of members of the selected anonymous signature group and a set of public keys y (n) corresponding to ∀n∈L
y _L = {y (n)} _n∈L … (14)
Are input to the input unit 133 and stored in the storage unit 131. The set L is selected and input by the user of the signature generation device 13, for example. Also, the set y _L of public keys y (n) is transmitted from the key generation device 11 described above via a network.

Next, the control unit 132a determines that the information i and the set L stored in the storage unit 131 are
i∈L… (15)
It is determined whether or not the condition is satisfied (step S122). When it is determined that iεL is not satisfied, the control unit 132a rejects the signature generation process (step S123) and ends the process. On the other hand, if it is determined that iεL is satisfied, then the message m is read into the cyclic group calculation unit 132b, and the cyclic group calculation unit 132b determines the element of the cyclic group G ₁ determined for the information including the message m. Generate h∈G ₁ . In the present embodiment, the cyclic group calculation unit 132b generates an element of the cyclic group G ₁ in which a pseudo random function H is applied to the message m.
h = H (m) ∈G ₁ (16)
Is stored in the storage unit 131 (step S124).

Next, the arbitrary value output unit 132c receives the arbitrary value.
t∈ _U Z _p … (17)
Is stored in the storage unit 131 (step S125).

Next, the element h and the arbitrary value t are input to the cyclic group calculation unit 132d. The cyclic group operation unit 132d sets e _{1 as} the result of applying the non-degenerate bilinear mapping e to the set of the element h∈G ₁ and the generator g ₂ ∈G _2, and t is an arbitrary integer. the original of the cyclic group G _T
a (i) = e ₁ ^t ∈G _T … (18)
Is generated and stored in the storage unit 131. In the case of this embodiment, the cyclic group calculation unit 132d
a (i) ← e (h, g ₂ ) ^t ∈G _T … (19)
Calculated by generating the original a (i) of the cyclic group G _T in (step S126).

Also, the arbitrary value output unit 132e corresponds to each arbitrary value j∈L (j ≠ i) of the set L excluding i.
c (j) ∈ _U Z _p … (20)
Is stored in the storage unit 131 (step S127).

In addition, the arbitrary value output unit 132f has an arbitrary element corresponding to each element j∈L (j ≠ i) of the set L excluding i.
z (j) ∈ _U G ₁ (21)
Is stored in the storage unit 131 (step S128).

Next, an arbitrary value c (j), an arbitrary element z (j), and a public key y (() corresponding to each element j∈L (j ≠ i) of the set L excluding i are sent to the cyclic group calculation unit 132g. j) and the element h of the cyclic group G ₁ are read. The cyclic group computing unit 132g applies a non-degenerate bilinear map to a set of an arbitrary element z (j) ∈G ₁ (j∈L (j ≠ i)) of the cyclic group G ₁ and a generator g ₂ ∈G _2. The result of applying e to e ₂ and the result of applying the nondegenerate bilinear map e to the element h∈G ₁ and the public key y (j) ∈G ₂ (j∈L (j ≠ i)) in case of a e ₃ to the original cyclic group G _T
a (j) = e ₂・ e ₃ ^{c (j)} ∈G _T … (22)
Is generated for j∈L (j ≠ i) and stored in the storage unit 131. In the case of this embodiment, the cyclic group calculation unit 132g
a (j) ← e (z (j), g ₂ ) ・ e (h, y (j)) ^{c (j)} ∈G _T … (23)
Calculated by the original a (j) of the cyclic group G _T generated for j∈L (j ≠ i) in (step S129).

Next, the difference information generation unit 132h receives the set L, the message m, the set y _{L of} the public key y (n), the element a (i) ∈G _T, and the element a (j) ∈G _T (j∈ A set a _L composed of L (j ≠ i)) and an arbitrary value c (j) (j∈L (j ≠ i)) are read. Difference information generating unit 132h corresponds to a value w determined for the information containing the set a _L
c (i) = w-Σc (j) (24)
Is generated for j∈L (j ≠ i) and stored in the storage unit 131. In this embodiment, a pseudo random function H ′ is applied to the bit combination values of the system parameter ρ, the set L, the message m, the set y _L, and the set a _L.
H '(ρ, L, m, y _L , a _L )… (25)
C (i) is generated with w as w. Note that Σc (j) means the sum of c (j) corresponding to the element j of the set L excluding i (step S130).

Next, an element h, an arbitrary value t, a relink key r, and c (i) of the cyclic group G ₁ are input to the cyclic group calculation unit 132 i. The cyclic group calculation unit 132i uses these to generate the element of the cyclic group G ₁
z (i) = h ^t・ r ^{-c (i)} ∈ G ₁ (26)
Is stored in the storage unit 131 (step S131).

Next, the output unit 134 includes a set c _L composed of an integer c (j) (j∈L (j ≠ i)) and an integer c (i), and an element z (j) ∈G ₁ (j∈L ( A set z _L composed of j ≠ i)) and an element z (i) εG ₁ , a message m, and a set L are input. The output unit 134 generates a signature including the set c _L and the set z _L
σ = (c _L , z _L )… (27)
And message m and set L are output (step S132). The output signature σ, message m, and set L are transmitted to the signature verification device 14 via a network, for example.

<Signature verification processing>
FIG. 7 is a flowchart for explaining the signature verification processing according to the first embodiment.
First, the signature σ, the message m, and the set L are input to the input unit 146 of the signature verification apparatus 14 (FIG. 4) and stored in the storage unit 141. Also, the set y _{L of} public keys y (n) delivered from the key generation device 11 is input to the input unit 146 and stored in the storage unit 141 (step S141).

The message m is read into the cyclic group calculation unit 143, and the cyclic group calculation unit 143 generates an element hεG ₁ of the cyclic group G ₁ determined for information including the message m. In this embodiment, the cyclic group calculation unit 143 uses the pseudo random function H to act on the message m, and the element of the cyclic group G ₁
h = H (m) ∈G ₁ (28)
Is stored in the storage unit 141 (step S142).

Next, an arbitrary value c (n), an arbitrary element z (n) and a public key y (n) corresponding to each element nεL of the set L, and the cyclic group G ₁ The original h is read. Incidentally, the set arbitrary values c (n) is the signature _{σ = (c L, z L} ) is an element of the set c _L included in, any of the original z (n) is the signature sigma = where (c _L, z _L) contains z is an element of _L. The cyclic group computing unit 144 sets e _{4 as} the result of applying the non-degenerate bilinear map e to the set of the element z (n) ∈G ₁ (n∈L) and the generator g ₂ ∈G _2, and the message m the result of the action of non-degenerate bilinear mapping e in the set of original H∈G ₁ cyclic group G ₁ which is determined with respect to information and the public key _{y (n) ∈G 2 (n∈L} ) including e ₅ in case of the original cyclic group G _T
a (n) = e ₄・ e ₅ ^{c (n)} ∈G _T … (29)
Is generated for each n∈L and stored in the storage unit 141. In this embodiment, the cyclic group calculation unit 144 is
a (n) ← e (z (n), g ₂ ) ・ e (h, y (n)) ^{c (n)} ∈G _T … (30)
Calculated by, for generating the original a (n) of the cyclic group G _T corresponding to each n∈L of (step S143).

Next, the determination unit 145 sends the set L, the message m, the set y _{L of} the public key y (n), the set a _L of the element a (n) ∈G _T , and the arbitrary value c (n) (n ∈L) is read. Determination unit 145, based on a (n) and an integer w determined for the information containing the set a _L consisting of (n∈L), the sum of the integer c (n) (n∈L) Σc (n) (n∈ L) and whether or not coincide with each other. In this embodiment, a pseudo random function H ′ is applied to the bit combination values of the system parameter ρ, the set L, the message m, the set y _L, and the set a _L.
H '(ρ, L, m, y _L , a _L )… (31)
And w
H '(ρ, L, m, y _L , a _L ) = Σc (n) (32)
It is determined whether or not the condition is satisfied (step S144). Here, when it is determined that the determination unit 145 matches, the determination unit 145 outputs information indicating that the signature is acceptable (step S145). When the determination unit 145 determines that they do not match, the determination unit 145 Is output as a failure (step S146).

Note that the properties of the non-degenerate bilinear map (formulas (3)-(6)) and the relationship between the secret key x (n) and the public key y (n) = g ₂ ^{x (n)} ∈G ₂ (formula (10) (11)), c (i) Determination of (equation (24) (25)), and the original ^{z (i) = h t ·} r -c (i) Determination of ∈G ₁ (formula ( From (26)), it can be seen that the expression (32) is satisfied when the signature σ is correct. On the other hand, if the signature is not correct, it is unlikely that equation (32) is satisfied. Therefore, the determination as described above is possible.

<Features of First Embodiment>
As described above, in this embodiment, the relink key generation device 12-i generates the element hεG ₁ of the cyclic group G ₁ determined for the information including the message m, and is the element of the cyclic group G _1. Relink key r = h ^{x (i)} ∈ G ₁ is generated. The relink key r corresponds to each message m. Therefore, even if the relink key r is misused, the range in which the anonymity of the signer may be lost (i is known) can be limited to the range of the signature σ for the message m. Thereby, even if the relink key r is abused, it is possible to suppress the loss of the anonymity of the signer corresponding to the relink key r.

Further, in this embodiment, since the pseudo random function value of the information including the message m is the element hεG ₁ (step S112 and the like), high safety can be ensured. In this embodiment, only m is used as information including this message m. However, a combination of m and other information may be used as information including the message m, and a pseudo random function value of a combination of m and other information may be used as the element hεG ₁ . The “other information” in this case is preferably information that does not correspond to the element i∈L. This is from the viewpoint of safety. In other words, it is desirable that the result of applying a pseudo random function value to the message m or information consisting of information not corresponding to the element iεL and the message m is the element h.

Further, in this embodiment, the formula (25) is exemplified as w determined for “information including the set a _L ”. However, this does not limit the present invention, and the following w may be used instead of w in the formula (25). However, Add is additional information.
w = H '(a _L )… (33)
w = H '(L, y _L , a _L )… (34)
w = H '(L, m, y _L , a _L )… (35)
w = H '(m, a _L )… (36)
w = H '(a _L , Add)… (37)
w = H '(ρ, L, m, y _L , a _L , Add)… (38)

Thus, the present embodiment "information containing the set a _L" may be information including only set a _L, further, set L and the public key y of the (n) ∈G ₂ (n∈L) Information including the set y _L may be used, or information including the message m may be used. Various other modifications are possible.

In addition, the value described as an element of Z _p in this embodiment may be an integer. That is, from the viewpoint of safety and efficiency, these values are preferably _elements of Z _p , but a configuration in which this value is selected from general integers is also possible. In that case, from the viewpoint of safety, it is desirable that these values are 0 or more and p or less, or p + k or more.

The signature σ = (c _L , z _L ) may include a value other than the set c _L and the set z _L.
In this embodiment, an example in which information is exchanged between apparatuses via a network has been described. However, the present invention is not limited to this. For example, information may be exchanged between apparatuses via a portable recording medium.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.

<Overall configuration>
FIG. 8 is a block diagram for explaining the overall configuration of the anonymous signature system 2 of the second embodiment.
As illustrated in FIG. 8, the anonymous signature system 2 includes a key generation device 11 and I (I is an integer of 1 or more) relink key generation devices 22-i (i∈ {1,..., I }), A signature generation device 23, and a signature verification device 24, which are configured to be communicable through a network. The configuration of the key generation device 11 is the same as that in the first embodiment. Further, the number of devices is not limited to that illustrated in FIG. 8, and there may be two or more key generation devices 11, signature generation devices 23, and signature verification devices 24. Further, a configuration in which the functions of a plurality of devices illustrated in FIG. 8 are provided in one device may be used, or a configuration in which the configuration of one device illustrated in FIG. 8 is distributed to a plurality of devices. Also good.

<Relink key generation device 22-i>
FIG. 9 is a diagram for explaining a functional configuration of the relink key generation device 22-i according to the second embodiment.
As illustrated in FIG. 9, the relink key generation device 22-i according to the present embodiment includes a storage unit 221-i, a control unit 222-i, an arbitrary value output unit 223-i, and a cyclic group calculation unit 224-. i, a function calculation unit 225-i, a calculation unit 226-i, a relink key generation unit 227-i, an input unit 228-i, and an output unit 229-i.

  As in the first embodiment, the relink key generation device 22-i is executed by reading a predetermined program into a known computer or a dedicated computer including a CPU, a RAM, a magnetic recording device, a communication device, and the like, for example. Consists of. In addition, the relink key generation device 22-i executes each process under the control of the control unit 222-i.

<Signature generation device 23>
FIG. 10 is a diagram for explaining a functional configuration of the signature generation device 23 according to the second embodiment.
As illustrated in FIG. 10, the signature generation device 23 according to the present embodiment includes a storage unit 231, a control unit 232a, a separation unit 232b, a function calculation unit 232c, an arbitrary value output unit 232d, and a cyclic group calculation unit 232e. ˜232g, a difference information generation unit 232h, a calculation unit 232i, an input unit 233, and an output unit 234. As in the first embodiment, the signature generation device 23 is configured by, for example, reading and executing a predetermined program on a known computer or a dedicated computer including a CPU, a RAM, a magnetic recording device, a communication device, and the like. The In addition, the signature generation device 13 executes each process under the control of the control unit 132a.

<Signature Verification Device 24>
FIG. 11 is a diagram for explaining a functional configuration of the signature verification apparatus 24 according to the second embodiment.
As illustrated in FIG. 11, the signature verification apparatus 24 of the present embodiment includes a storage unit 241, a control unit 242, a separation unit 243, a function calculation unit 244, a cyclic group calculation unit 245, a determination unit 246, And an input unit 247.

  As in the first embodiment, the signature verification device 24 is configured by, for example, reading and executing a predetermined program on a known computer or a dedicated computer including a CPU, a RAM, a magnetic recording device, a communication device, and the like. The

<Pre-processing>
The security parameter k is defined in the anonymous signature system 2, and the system parameter ρ '= (p, G, g, H', H '') corresponding to the security parameter k
Is determined. The system parameter ρ ′ is distributed to all devices constituting the anonymous signature system 2, and the same system parameter ρ ′ is used in each device.
Further, the storage unit 221-i of each relink key generation device 22-i (FIG. 9) stores information i corresponding to members of the anonymous signature group corresponding to the relink key generation device 22-i. The

<Key generation process>
The same as in the first embodiment.

<Relink key generation process>
FIG. 12 is a flowchart for explaining relink key generation processing according to the second embodiment.

In the relink key generation process of this embodiment, first, any member (true signer) of the anonymous signature group receives an input unit 228-i of any relink key generation device 22-i (FIG. 9). The message to be signed m∈ {0,1} ^* is input. The message m input to the input unit 228-i is stored in the storage unit 221-i (step S211).

Next, the arbitrary value output unit 223-i
t∈ _U Z _p … (39)
Is stored in the storage unit 221-i (step S212).

Next, an arbitrary value t is input to the cyclic group calculation unit 224-i. The cyclic group computation unit 224-i
T = g ^t ∈G (40)
Is stored in the storage unit 221-i (step S213).

Next, the element T of the cyclic group G and the message m are input to the function calculation unit 225-i. The function calculation unit 225-i generates a value c determined for information including the element T and the message m, and stores the generated value c in the storage unit 221-i. In this embodiment, the function calculation unit 225-i
c ← H '' (T, m) ∈Z _p … (41)
The value c is generated by the calculation of (Step S214). Note that (T, m) is a bit combination value of T and m.

Next, the arbitrary value t, the secret key x (i), and the value c stored in the storage unit 221-i are read into the calculation unit 226-i. The calculation unit 226-i
z = t + x (i) · c∈Z _p … (42)
Is generated and stored in the storage unit 221-i (step S215).

Next, the elements TεG and z are read into the relink key r = (T, z). The relink key r = (T, z) is the relink key that contains them
r = (T, z) ∈G × Z _p … (43)
Is generated and stored in the storage unit 221-i (step S216).

  Next, the relink key r, the message m, and the information i are input to the output unit 229-i. The output unit 229-i outputs the relink key r, the message m, and the information i (Step S217). These are transmitted to the signature generation apparatus 23 via a network, for example.

<Signature generation processing>
FIG. 13 is a flowchart for explaining a signature generation process according to the second embodiment.
In the signature generation process, first, the relink key r, the message m, and the information i sent from any of the relink key generation devices 22-i are input to the input unit 233 of the signature generation device 23 (FIG. 10) ( Received) and stored in the storage unit 231. Also, a set L of members of the selected anonymous signature group and a set of public keys y (n) corresponding to ∀n∈L
y _L = {y (n)} _n∈L … (44)
Are input to the input unit 233 and stored in the storage unit 231. The set L is selected and input by the user of the signature generation device 23, for example. Also, the set y _L of public keys y (n) is transmitted from the key generation device 11 described above via a network.

Next, the control unit 132a determines that the information i and the set L stored in the storage unit 131 are
i∈L… (45)
It is determined whether or not the condition is satisfied (step S222). When it is determined that iεL is not satisfied, the control unit 232a rejects the signature generation process (step S223) and ends the process. On the other hand, when it is determined that iεL is satisfied, the relink key r is read into the separation unit 232b. The separation unit 232b decomposes the relink key r,
(T, z) ← r∈G × Z _p … (46)
Is generated (step S224).

Next, the element TεG and the message m are read into the function calculation unit 232c. The function calculation unit 232c generates a value c determined for information including the element T and the message m, and stores the generated value c in the storage unit 231. In this embodiment, the function calculation unit 232c
c = H '' (T, m) ∈Z _p (47)
Is generated (step S225).

Next, the arbitrary value output unit 232d
t (i) ∈ _U Z _p … (48)
Is output for iεL and stored in the storage unit 231 (step S226).

Next, the arbitrary value t (i) is read into the cyclic group calculation unit 232e. The cyclic group computation unit 232e is an element of the cyclic group G.
T (i) = g ^{t (i)} ∈G… (49)
Is generated and stored in the storage unit 231 (step S227).

Also, the arbitrary value output unit 232f receives an arbitrary value
c (j) ∈ _U Z _p … (50)
z (j) ∈ _U Z _p … (51)
Is output for j∈L (j ≠ i) and stored in the storage unit 231 (step S228).

Next, arbitrary values c (j), z (j), element T, and public key y (j) (j∈L (j ≠ i)) are input to the cyclic group calculation unit 232g. The cyclic group calculation unit 232g is a component of the cyclic group G.
T (j) = g ^{z (j)}・ (T ・ y (j) ^c ) ^{c (j)} ∈G… (52)
Is generated for j∈L (j ≠ i) and stored in the storage unit 231 (step S229).

Next, the difference information generation unit 232h sends the set T _L composed of the element T (i) ∈G and the element T (j) (j∈L (j ≠ i)) ∈G, the element T, the message m, , A set y _{L of} public keys y (n) and an arbitrary value c (j) are input. The difference information generation unit 232h is a value determined for information including the set T _L and the element T including the element T (i) ∈G and the element T (j) (j∈L (j ≠ i)) ∈G. Using w ′ and the sum Σc (j) of arbitrary values c (j) (j∈L (j ≠ i))
c (i) = w'-Σc (j) (j∈L (j ≠ i))… (53)
Is generated and stored in the storage unit 231. In this embodiment, the result of applying a pseudo random function H ′ to the bit combination values of the element T, the set T _L , the message m, and the set y _L
H '(T, T _L , m, y _L )… (54)
Is set to w ′ to generate a value c (i) (step S230).

Next, an arbitrary value t (i), a value z, and a value c (i) are input to the calculation unit 232i. The calculation unit 232i
z (i) = t (i) -z ・ c (i) ∈Z _p … (55)
Is generated and stored in the storage unit 231 (step S231).

Next, the element T∈G, a set c _L consisting of integer c (j) (j∈L (j ≠ i)) and integer c (i), and an arbitrary number z (j) (j∈L (j ≠ i)) and a set σ = (T, c _L , z _L ) including a set z _L composed of a number z (i) ∈G, a message m, and a set L are output from the output unit 234. (Step S232). These are transmitted to the signature verification apparatus 24 via a network, for example.

<Signature verification processing>
FIG. 14 is a flowchart for explaining a signature verification process according to the second embodiment.
First, the signature σ, the message m, and the set L are input to the input unit 247 of the signature verification device 24 (FIG. 11) and stored in the storage unit 241. Further, the set y _{L of} public keys y (n) delivered from the key generation device 11 is input to the input unit 247 and stored in the storage unit 241 (step S241).

Next, the signature σ is read into the separation unit 243. The separation unit 243 separates the signature σ,
(T, c _L , z _L ) ← σ… (56)
Are stored in the storage unit 241 (step S242).

Next, the element T and the message m are read into the function calculation unit 244. The function calculation unit 244 generates a value c determined for information including the element T and the message m, and stores the value c in the storage unit 241 (step S243). In the case of this embodiment, the function calculation unit 244 is
c ← H '' (T, m) ∈Z _p … (57)
The value c is generated by the calculation of (Step S243).

Next, the cyclic group computing unit 245 discloses z (n) that is an element of the set z _L , c (n) that is an element of the set c _L , c, T, and an element that is an element of the set y _L Key y (n) is input. The cyclic group calculation unit 245 uses these to generate the elements of the cyclic group G
T (n) = g ^{z (n)} (T ・ y (n) ^c ) ^{c (n)} ∈G… (58)
Is generated for each n∈L and stored in the storage unit 241 (step S244).

Next, the determination unit 246 sends the set T _L of the element T (n) ∈G (n∈L), the element T, the message m, the set y _{L of} the public key y (n), and the set c _L The element c (n) is read. The determination unit 246 determines the sum Σc of the value w ′ determined for the information including the set T _L and the element T of the element T (n) ∈G (n∈L) and the value c (n) (n∈L). It is determined whether or not (n) matches. In this embodiment, the result of applying a pseudo random function H ′ to the bit combination values of the element T, the set T _L , the message m, and the set y _L
H '(T, T _L , m, y _L )… (59)
Is w ',
H '(T, T _L , m, y _L ) = Σc (n)… (60)
It is determined whether or not the condition is satisfied (step S245). If it is determined that the determination unit 246 matches, the determination unit 246 outputs information indicating that the signature is acceptable (step S246). If the determination unit 246 determines that they do not match, the determination unit 246 Is output as a failure (step S247).

It should be noted that the relationship between the secret key x (n) and the public key y (n) = g ₂ ^{x (n)} ∈ G ₂ (formulas (10) and (11)) and how to obtain T (i) 49)), how to obtain the element T (formula (40)), and how to obtain z (i) (formula (55), it can be seen that the formula (60) is satisfied when the signature σ is correct. If the signature is not correct, it is unlikely that the expression (60) is satisfied, and thus the above-described determination is possible.

<Features of Second Embodiment>
As described above, in the present embodiment, the arbitrary value t is generated, the element T = g ^t ∈ G of the cyclic group G is generated, and the integer c determined for the information including the element T and the message m is generated, z = t + x (i) · c is generated, and the relink key r = (T, z) including the current element T∈G and the integer z is generated. This relink key r = (T, z) corresponds to each message m. Therefore, even if the relink key r is misused, the range in which the anonymity of the signer may be lost (i is known) can be limited to the range of the signature σ for the message m. Thereby, even if the relink key r is abused, it is possible to suppress the loss of the anonymity of the signer corresponding to the relink key r.

In the present embodiment, since the pseudo random function value of the information including the element T and the message m is set to the value c (step S225, etc.), high safety can be ensured. In this embodiment, the bit combination value (T, m) of T and m is used as information including the original T and the message m. However, a combination of T, m, and other information is used as information including the element T and the message m, and a pseudo random function value of a combination of T, m, and other information is also set as the element h∈G ₁ Good. The “other information” in this case is preferably information that does not correspond to the element i∈L. This is from the viewpoint of safety. That is, let c be the result of applying a pseudo random function value to information consisting of element T and message m, or information not corresponding to element i∈L and information consisting of element T and message m. It is desirable.

In this embodiment, the value w ′ (step S230 and the like) determined for “information including the set T _L and the element T” is exemplified by the equation (54). However, this does not limit the present invention, and the following w ′ may be used instead of w ′ in the formula (54). However, Add is additional information.
w = H '(T, T _L )… (61)
w = H '(T, T _L , y _L )… (62)
w = H '(T, T _L , m)… (63)
w = H '(T, T _L , Add)… (64)
w = H '(T, T _L , m, y _L , Add)… (65)

As described above, the “information including the set T _L and the element T” in this embodiment may be information including only the set T _L and the element T, and further, the public key y (n) ∈G ( The information may include information including a set y _{L of} nεL), or may include information including a message m. Various other modifications are possible.

  Similarly, “information including the source T and the message m” (step S225, etc.), information including only the source T and the message m may be included, and other information may be included. Also good.

In addition, the value described as an element of Z _p in this embodiment may be an integer. That is, from the viewpoint of safety and efficiency, these values are preferably _elements of Z _p , but a configuration in which this value is selected from general integers is also possible. In that case, from the viewpoint of safety, it is desirable that these values are 0 or more and p or less, or p + k or more.

The signature σ = (T, c _L , z _L ) may include a value other than T, the set c _L, and the set z _L.
In this embodiment, an example in which information is exchanged between apparatuses via a network has been described. However, the present invention is not limited to this. For example, information may be exchanged between apparatuses via a portable recording medium.

[Other variations]
The present invention is not limited to the above-described embodiment. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording medium and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In the above-described embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

1, 2 Anonymous signature system 12-i, 22-i Relink key generation device 13, 23 Signature generation device 14, 24 Signature verification device

Claims (17)

G ₁ , G ₂ , G _T are cyclic groups, e is a non-degenerate bilinear map that maps the original set of cyclic groups G ₁ , G ₂ to the cyclic group G _T , and g ₂ ∈G ₂ is a cyclic group G _{2 is} a generator, L is a set of information corresponding to members of the anonymous signature group, n is an element of the set L, any element of the set L is i∈L, and i is excluded wherein each element of set L and j∈L (j ≠ i), x (n) and (n∈L) a private key integer corresponding to each of the element N∈L, original y cyclic group G ₂ ( n) = g ₂ ^{x (n)} ∈ G ₂ (n∈L) is a public key corresponding to the element n∈L,
The original H∈G ₁ cyclic group G ₁ that is determined with respect to information including a message m, and relinking key ^{r = h x (i) ∈G} 1 which is a cyclic group G ₁ of the original corresponding to the message m A storage unit for storing the set of public keys y (n) ∈G ₂ (n∈L),
In the case where the result of the allowed to act the nondegenerate bilinear mapping e in the set of original H∈G ₁ and the origin g ₂ ∈G ₂ and e _1, and a t an arbitrary integer, the cyclic group G _T A first cyclic group operation unit for generating an element a (i) = e ₁ ^t ∈G _T
Result of applying the non-degenerate bilinear map e to a set of an arbitrary element z (j) ∈G ₁ (j∈L (j ≠ i)) of the cyclic group G ₁ and the generator g ₂ ∈G ₂ E ₂ and e ₃ is the result of applying the non-degenerate bilinear map e to the element h∈G ₁ and the public key y (j) ∈G ₂ (j∈L (j ≠ i)), c (j) (j∈L (j ≠ i)) in the case where an arbitrary integer, based on a (j) of the cyclic group _{G T = e 2 · e 3} c (j) ∈G T (j∈L a second cyclic group operation unit for generating (j ≠ i)),
An integer w determined for information including the set a _L composed of the element a (i) ∈G _T and the element a (j) ∈G _T (j∈L (j ≠ i)), and the integer c ( j) Difference information generation that generates integer c (i) = w-Σc (j) (j∈L (j ≠ i)) using summation Σc (j) of (j∈L (j ≠ i)) And
Using the element h∈G ₁ , the relink key r∈G ₁ , the integer t and the integer c (i), the element z (i) = h ^t · r ^{−c (i) of the} cyclic group G ₁ A third cyclic group operation unit for generating ∈G ₁ ;
A set c _L composed of the integer c (j) (j∈L (j ≠ i)) and the integer c (i), and the element z (j) ∈G ₁ (j∈L (j ≠ i)) And an output unit that outputs a signature σ = (c _L , z _L ), and a set z _L consisting of the element z (i) ∈G ₁
A signature generation device. The signature generation device according to claim 1,
The element hεG ₁ is a pseudo random function value of information including the message m.
A signature generation apparatus characterized by the above. The signature generation device according to claim 1 or 2,
The information including the message m is the message m, or information including the information not corresponding to the element i ∈ L and the message m.
A signature generation apparatus characterized by the above. The signature generation device according to any one of claims 1 to 3,
The information including the set a _L is information including the set L and the set of the public key y (n) ∈G ₂ (n∈L).
A signature generation apparatus characterized by the above. The signature generation device according to any one of claims 1 to 4,
The information including the set a _L is information including the message m.
A signature generation apparatus characterized by the above. G ₁ , G ₂ , G _T are cyclic groups, e is a non-degenerate bilinear map that maps the original set of cyclic groups G ₁ , G ₂ to the cyclic group G _T , and g ₂ ∈G ₂ is a cyclic group G _{2 is} a generator, L is a set of information corresponding to members of the anonymous signature group, n is an element of the set L, and y (n) ∈G ₂ (n∈L) is the element n In the case of each corresponding public key,
The public key y (n) ∈G ₂ a set of (n∈L), the integer c (n) consists of (n∈L) set c _L and the cyclic group G ₁ of the original z (n) ∈G ₁ (n A storage unit for storing a signature σ = (c _L , z _L ) including a set z _L consisting of ∈L) and a message m;
Information including the message m, where e ₄ is the result of applying the non-degenerate bilinear map e to the set of the element z (n) ∈G ₁ (n∈L) and the generator g ₂ ∈G ₂ and e ₅ origional H∈G ₁ cyclic group G ₁ and the public key _{y (n) ∈G 2 (n∈L} ) results the allowed to act nondegenerate bilinear mapping e to the set of the determined relative in the case where the cyclic group arithmetic unit for generating the original _{a (n) = e 4 ·} e 5 c (n) ∈G T of the cyclic group G _T (n∈L),
An integer w determined for information including the set a _L composed of the elements a (n) (n∈L), and a sum Σc (n) (n∈L) of the integers c (n) (n∈L) and , And a determination unit for determining whether or not match,
A signature verification apparatus. L is a set of information corresponding to members of the anonymous signature group, n is each element of the set L, any element of the set L is i∈L, and x (n) (n∈L) is In the case of an integer secret key corresponding to the element i ∈ L,
A cyclic group computing unit that generates an element h∈G ₁ of a cyclic group G ₁ determined for information including the message m;
And relinked key generation unit for generating a re-link key ^{r = h x (i) ∈G} 1 which is a corresponding cyclic group G ₁ of the original in the message m,
An output unit for outputting the relink key r = h ^{x (i)} ∈ G ₁ ;
A relink key generation device having: G is a cyclic group, g∈G is a generator of cyclic group G, L is a set of information corresponding to members of the anonymous signature group, n is an element of the set L, and any of the sets L I∈L, j∈L (j ≠ i) for each element of the set L excluding i, and x (n) (n∈L) is an integer secret corresponding to the element n∈L. A key, y (n) = g ^{x (n)} ∈ G ⁽ⁿ ∈ L) is a public key corresponding to the element ⁿ ∈ L, t is an arbitrary integer, and T is an element T of the cyclic group G = In the case where g ^t ∈ G, c is an integer determined for information including the element T and the message m, and z = t + x (i) · c,
A storage unit for storing a relink key r = (T, z) corresponding to the message m, the integer c, and a set of the public keys y (n) εG (nεL);
a first cyclic group operation unit for generating an element T (i) = gt ⁽ⁱ⁾ ∈ G of a cyclic group G when t (i) is an arbitrary integer;
c (j) (j∈L (j ≠ i)) is an arbitrary integer and z (j) (j∈L (j ≠ i)) is an arbitrary integer. j) = g ^{z (j)} · (T · y (j) ^c ) ^{c (j)} ∈ G generating a second cyclic group operation unit;
An integer w ′ determined for information including a set T _L composed of the element T (i) ∈G and the element T (j) (j∈L (j ≠ i)) ∈G and the element T; Using the sum Σc (j) of the integer c (j) (j∈L (j ≠ i)), the integer c (i) = w′−Σc (j) (j∈L (j ≠ i)) A difference information generation unit to generate;
An arithmetic unit for generating an integer z (i) = t (i) −z · c (i);
A set c _L composed of the element T∈G, the integer c (j) (j∈L (j ≠ i)) and the integer c (i), and the integer z (j) (j∈L (j ≠ i)) and an output unit that outputs a signature σ = (T, c _L , z _L ), including the set z _L consisting of the integer z (i) ∈ G;
A signature generation device. The signature generation device according to claim 8, comprising:
The integer c is a pseudo random function value of information including the element T and the message m.
A signature generation apparatus characterized by the above. The signature generation device according to claim 8 or 9, wherein
The information including the element T and the message m is information including the element T and the message m, or information including information not corresponding to the element iεL and the element T and the message m. ,
A signature generation apparatus characterized by the above. The signature generation device according to any one of claims 8 to 10,
The information including the set T _L and the element T is information including a set of the public key y (n) ∈G (n∈L).
A signature generation apparatus characterized by the above. The signature generation device according to any one of claims 8 to 11,
The information including the set T _L and the element T is information including the message m.
A signature generation apparatus characterized by the above. G is a cyclic group, g∈G is a generator of the cyclic group G, L is a set of information corresponding to members of the anonymous signature group, n is an element of the set L, and y (n) ∈G In the case where (n∈L) is a public key corresponding to the element n∈L,
A signature σ = (T, c _L , z) that includes a cyclic group element T∈G, a set c _L of integers c (n) (n∈L), and a set z _{L of} integers z (n) (n∈L) _L ), a set of the public keys y (n) εG (nεL), and a storage unit that stores the message m,
An arithmetic unit that generates an integer c determined for information including the element T and the message m;
A cyclic group operation unit for generating an element T (n) = g ^{z (n)} (Ty (n) ^c ) ^{c (n)} ∈ G (n∈L) of the cyclic group G;
An integer w ′ determined for information including the set T _L of the element T (n) ∈G (n∈L) and the element T, and the sum Σc (n of the integer c (n) (n∈L) ) And whether or not match,
A signature verification apparatus. G is a cyclic group, g∈G is a generator of cyclic group G, L is a set of information corresponding to members of the anonymous signature group, n is an element of the set L, and any of the sets L Where i∈L and x (i) (i∈L) is an integer secret key corresponding to the element i∈L,
An arbitrary value output unit that outputs an arbitrary integer t;
A cyclic group operation unit for generating an element T = g ^t ∈G of the cyclic group G;
A first calculation unit that generates an integer c determined for information including the element T and the message m;
A second arithmetic unit for generating an integer z = t + x (i) · c;
A relink key generation unit for generating a relink key r = (T, z) including the element T∈G and the integer z;
A relink key generation device having:   A program for causing a computer to function as the signature generation device according to any one of claims 1 to 5 and 8 to 12.   A program for causing a computer to function as the signature verification apparatus according to claim 6 or 13.   A program for causing a computer to function as the relink key generation device according to claim 7 or 14.

Images