JP2011145591A - Commitment system, master device, transmitter, receiver, commitment method, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a stubborn commitment scheme which is non-interactive, capable of reusing common reference information, and of attaining security, on the basis of standard assumption such as RSA assumption or computational DH assumption. <P>SOLUTION: The commitment system is constituted of a transmitter, a receiver and a master device. In the commitment system, a signature system is used wherein the constitution of multi-trapdoor commitments is unforgeable in existence with respect to weak chosen message attacks. A master public key PK corresponds to a verification key of the signature system, a master trapdoor corresponds to a signature key of the signature system, an individual public key corresponds to the message of the signature system, and a trapdoor of the individual public key corresponds to the signature of the signature system, respectively. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a commitment system, a master device, a transmission device, a reception device, a commitment method, a program, and a recording medium that realize a robust commitment in which non-interactive and common reference information can be reused.

  Non-Patent Documents 1, 2 and 3 are representative non-interactive and common commitment information reusable and robust commitment methods. Non-Patent Document 1 is based on a strong assumption that safety is a strong RSA assumption. Non-Patent Document 2 is based on a strong assumption that safety is a strong RSA assumption or a DSA assumption. Non-Patent Document 3 is based on the strong assumption that safety is a strong RSA or q-strong DH assumption.

I. Damgard and J. Groth, “Non-interactive and reusable non-malleable commitment schemes,” In STOC, pp.426-437, ACM, 2003. P.D.MacKenzie and K. Yang, “On Simulation-Sound Trapdoor Commitments,” In EUROCRYPT, volume 3027 of Lecture Notes in Computer Science, pp.382-400, Springer, 2004. R. Gennaro, “Multi-trapdoor Commitments and Their Applications to Proofs of Knowledge Secure Under Concurrent Man-in-the-Middle Attacks,” In CRYPTO, volume 3152 of Lecture Notes in Computer Science, pp. 220-236, Springer, 2004 .

  However, since all of the conventional techniques achieve safety based on strong assumptions, the assumptions are not standard, and there is a problem that reliability of safety is low.

  It is an object of the present invention to provide a robust commitment scheme in which non-interactive and common reference information can be reused and security can be achieved based on standard assumptions, RSA assumptions or computational DH assumptions.

The commitment system of the present invention includes a transmission device, a reception device, and a master device. The master device includes a common reference information generation unit that generates common reference information crs including at least the master public key PK and the hash function H, and transmits the common reference information crs to the transmission device and the reception device. The transmission apparatus includes a transmission input unit, a random number generation unit, a one-time signature key generation unit, a commitment element generation unit, a one-time signature generation unit, a commitment transmission unit, and a decommission transmission unit. The transmission input unit receives the common reference information crs and the document m. The random number generation unit generates a random number r. The one-time signature key generation unit generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature. The commitment element generation unit uses H (vk ₀ ) as the individual public key pk of the multi-trap door commitment, and uses the master public key PK, the individual public key pk, the document m, and the random number r to commit the document m. Element C and decommitment element D are obtained. The one-time signature generation unit generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ . The commitment transmission unit transmits a commitment com including the commitment element C and the signature verification key vk ₀ to the receiving device. The decommitment transmission unit transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the receiving device. The receiving apparatus includes a reception input unit, a one-time signature verification unit, and a commitment verification unit. The reception input unit includes common reference information crs, a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′, a decommissioning element D ′, a document m ′, and a decommitment dec including a one-time signature σ ₀ ′. Receive. The one-time signature verification unit verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′. The commitment verification unit verifies the validity of the commitment element C ′ and the decommitment element D ′ by using a multi-trap door commitment verification algorithm.

  The commitment system of the present invention uses a signature scheme in which the structure of the multi-trap door commitment cannot exist forgery against weakly selected document attacks. The master public key PK corresponds to the signature method verification key, the master trap door corresponds to the signature method signature key, the individual public key corresponds to the signature method document, and the individual public key trap door corresponds to the signature method signature. ing. In other words, breaking the constraint of commitment is equivalent to acquiring a trapdoor. The commitment system of the present invention is a robust commitment method that is non-interactive and allows the common reference information to be reused if the RSA assumption or the calculation DH assumption holds. Therefore, according to the commitment system of the present invention, it is possible to provide a robust commitment method in which non-interactive and common reference information can be reused and safety can be achieved based on the standard assumption of RSA assumption or calculation DH assumption. .

1 is a diagram illustrating a configuration example of a commitment system according to a first embodiment. The figure which shows the processing flow of the commitment system of Example 1. FIG. FIG. 6 is a diagram illustrating a configuration example of a commitment system according to a second embodiment. The figure which shows the processing flow of the commitment system of Example 2. FIG. FIG. 10 is a diagram illustrating a configuration example of a commitment system according to a third embodiment. The figure which shows the processing flow of the commitment system of Example 3. FIG.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  FIG. 1 shows a configuration example of the commitment system of the first embodiment, and FIG. 2 shows a processing flow of the commitment system of the first embodiment. The commitment system according to this embodiment includes a transmission device 200, a reception device 300, and a master device 100, and each device is connected by a network 1000. The master device 100 includes a common reference information generation unit 150 and a master recording unit 190 that generate common reference information crs including at least the master public key PK and the hash function H and transmit the common reference information crs to the transmission device and the reception device. The transmission apparatus 200 includes a transmission input unit 210, a random number generation unit 220, a one-time signature key generation unit 230, a commitment element generation unit 240, a one-time signature generation unit 250, a commitment transmission unit 260, a decommission transmission unit 270, and a transmission recording unit. 290. The reception apparatus 300 includes a reception input unit 310, a one-time signature verification unit 320, a commitment verification unit 330, and a reception recording unit 390.

  In the sealing phase, the common reference information generation unit 150 of the master device 100 generates common reference information crs including the master public key PK and the hash function H, records the common reference information crs in the master recording unit 190, and transmits the common reference information crs to the transmission device 200 and the reception device 300. Transmit (S150). The transmission input unit 210 of the transmission device 200 receives the common reference information crs and the document m and records them in the transmission recording unit 290 (S210). The reception input unit of the reception device 300 also receives the common reference information crs and records it in the reception recording unit 390 (S311).

The random number generation unit 220 of the transmission device 200 generates a random number r and records it in the transmission recording unit 290 (S220). The one-time signature key generation unit 230 generates a signature verification key vk ₀ and a signature generation key sk ₀ for the one-time signature, and records them in the transmission recording unit 290 (S230). The commitment element generation unit 240 uses H (vk ₀ ) as the individual public key pk of the multi-trap door commitment and uses the master public key PK, the individual public key pk, the document m, and the random number r to commit the document m. The commitment element C and the decommitment element D are obtained and recorded in the transmission recording unit 290 (S240). The one-time signature generation unit 250 generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ and records it in the transmission recording unit 290 (S250). The commitment transmission unit 260 transmits a commitment com including the commitment element C and the signature verification key vk ₀ to the reception device 300 (S260). Then, the reception input unit 310 of the reception device 300 receives the commitment com including the commitment element C ′ and the signature verification key vk ₀ ′ and records it in the reception recording unit 390 (S312).

In the unsealing phase, the decommitment transmission unit 270 of the transmission device 200 transmits the decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the reception device 300 (S270). The reception input unit 310 of the reception apparatus 300 receives the decommitment dec including the decommitment element D ′, the document m ′, and the one-time signature σ ₀ ′, and records it in the reception recording unit 390 (S313). The one-time signature verification unit 320 verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′ (S320). The commitment verification unit 330 verifies the legitimacy of the commitment element C ′ and the decommissioning element D ′ using a multi-trap door commitment verification algorithm (S330). In addition, when verification of step S320, S330 fails, an error should be output and a process should be stopped.

  The commitment system of the present embodiment uses a signature scheme in which the configuration of the multi-trap door commitment does not exist forgery against weakly selected document attacks. The master public key PK corresponds to the signature method verification key, the master trap door corresponds to the signature method signature key, the individual public key corresponds to the signature method document, and the individual public key trap door corresponds to the signature method signature. ing. In other words, breaking the constraint of commitment is equivalent to acquiring a trapdoor. The commitment system according to the present embodiment is a robust commitment method in which non-interactive and common reference information can be reused if the RSA assumption or the calculation DH assumption is established.

FIG. 3 shows a configuration example of the commitment system of the second embodiment, and FIG. 4 shows a processing flow of the commitment system of the second embodiment. The commitment system according to this embodiment includes a transmission device 500, a reception device 600, and a master device 400, and each device is connected by a network 1000. The master device 400 includes an RSA modulus unit 410, a master selection unit 420, a function definition unit 430, a master key generation unit 440, a common reference information generation unit 450, and a master recording unit 490. The transmission apparatus 500 includes a transmission input unit 510, a random number generation unit 220, a one-time signature key generation unit 230, a commitment element generation unit 540, a one-time signature generation unit 250, a commitment transmission unit 260, a decommission transmission unit 270, and a transmission recording unit. 590. The receiving device 600 includes a reception input unit 610, a one-time signature verification unit 320, a commitment verification unit 630, and a reception recording unit 690. In this embodiment, λ is a security parameter, f is an integer depending on 1 ^λ , p and q are odd prime numbers of λ bits, and F is a pseudo-random function for converting a bit string of arbitrary bits into a bit string of f bits. And

In the sealing phase, the RSA modulus section 410 of the master device 400 is
2 ^f <φ (N) = (p−1) (q−1) <2 ^{f + 2}
RSA modulus N = pq is calculated and output and recorded in the master recording unit 490 (S410). The master selection unit 420 randomly selects an arbitrary integer h of 1 or more and N−1 or less, the key K of the pseudo random function F, and the bit string c of f bits, and records them in the master recording unit 490 (S420). The function definition unit 430 converts the function P _{K, c} into

And is recorded in the master recording unit 490 (S430). The master key generation unit 440 records (N, h, c, K) as the master public key PK and (p, q, PK) as the master trap door TK, and records them in the master recording unit 490 (S440). The common reference information generation unit 450 generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmission device 500 and the reception device 600 (S450). The transmission input unit 510 of the transmission device 500 receives the common reference information crs and the document m and records them in the transmission recording unit 590 (S510). The reception input unit of the reception device 600 also receives the common reference information crs and records it in the reception recording unit 690 (S611).

The random number generation unit 220 generates a random number r and records it in the transmission recording unit 590 (S220). The one-time signature key generation unit 230 generates a signature verification key vk ₀ and a signature generation key sk ₀ for the one-time signature, and records them in the transmission recording unit 590 (S230). The commitment element generation unit 540
(1) Let H (vk ₀ ) be an individual public key pk,
(2) e _j = P _{K, c} (pk ^(j) ), where pk ^(j) calculates the first j bits of pk from j = 1 to j = J, and e _{min is set} to e ₁ ,. _J is the smallest value,
(3) m _j = m mod e _j
Is calculated from j = 1 to j = J,
(4) M mod e _j = m _j
Is greater than or equal to 0 for all j

Find from the following integers,
(5) In order to commit the document m which is an integer of 0 or more and e _min −1 or less, the commitment element C and the decommitment element D are

And is recorded in the transmission recording unit 590 (S540). The one-time signature generation unit 250 generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ and records it in the transmission recording unit 590 (S250). The commitment transmission unit 260 transmits a commitment com including the commitment element C and the signature verification key vk ₀ to the reception device 600 (S260). Then, the reception input unit 610 of the reception device 600 receives the commitment com including the commitment element C ′ and the signature verification key vk ₀ ′ and records it in the reception recording unit 690 (S612).

In the unsealing phase, the decommitment transmission unit 270 of the transmission device 500 transmits the decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the reception device 600 (S270). The reception input unit 610 of the reception apparatus 600 receives the decommitment dec including the decommitment element D ′ = (M ′, r ′), the document m ′, and the one-time signature σ ₀ ′, and records it in the reception recording unit 690. (S613). The one-time signature verification unit 320 uses the signature verification key vk ₀ ′ to verify the validity of the one-time signature σ ₀ ′ for the commitment element C ′ (S320). The commitment verification unit 630
(1) Let H (vk ₀ ′) be an individual public key pk ′,
(2) e _j ′ = P _{K, c} (pk ′ ^(j) ), where pk ′ ^(j) is the first j bits of pk ′ and
m _j '= M' mod e _j '
Is calculated from j = 1 to j = J,
(3) m ₁ '= m ₂ ' =, ..., = m _J '
And

(S630). In addition, when verification of step S320, S630 fails, an error should be output and a process should be stopped.

  In the commitment system of the present embodiment, the transmission device 500 sets the trap door td.

Can be generated as follows. Also, let M ^~ be m _j ^~ = M ^~ mod e _j
Is calculated from j = 1 to j = J,
m ₁ ^~ = m ₂ ^~ =, ..., = m _J ^~
And M ^~ ≠ M,

And the de-commitment element is D ^~ = (M ^~ , r ^~ ),

It becomes. In other words, it can be double-opened. Thus, the commitment system of the present embodiment has six algorithms for multi-trap door commitment.

  The commitment system of the present embodiment uses a signature scheme in which the configuration of the multi-trap door commitment does not exist forgery against weakly selected document attacks. The master public key PK corresponds to the signature method verification key, the master trap door corresponds to the signature method signature key, the individual public key corresponds to the signature method document, and the individual public key trap door corresponds to the signature method signature. ing. In other words, breaking the constraint of commitment is equivalent to acquiring a trapdoor. The commitment system of the present embodiment is a robust commitment method that is non-interactive and allows the common reference information to be reused if the RSA assumption is satisfied.

FIG. 5 shows a configuration example of the commitment system of the third embodiment, and FIG. 6 shows a processing flow of the commitment system of the third embodiment. The commitment system according to this embodiment includes a transmission device 800, a reception device 900, and a master device 700, and each device is connected by a network 1000. The master device 700 includes a master selection unit 720, a master key generation unit 740, a common reference information generation unit 750, and a master recording unit 790. The transmission apparatus 800 includes a transmission input unit 810, a random number generation unit 820, a one-time signature key generation unit 230, a commitment element generation unit 840, a one-time signature generation unit 250, a commitment transmission unit 260, a decommission transmission unit 270, and a transmission recording unit. 890. The reception device 900 includes a reception input unit 910, a one-time signature verification unit 320, and a commitment verification unit 930. In the present embodiment, lambda is the security parameter, G and G _T is 2 ^lambda greater than bilinear group prime order p, J is a positive predetermined integer, E is the original G × G of G _T The bilinear map to be converted to the original is used.

The sealing phase, the master selection unit 720 of the master device 700, and zero or more p-1 an integer a, the original _v 0 of generator g and the group G of the group G, ..., _{v J} randomly selected, master recording This is recorded in the part 790 (S720). The master key generation unit 740 records (g, v ₀ ,..., V _J , E (g, g) ^a ) as the master public key PK, a as the master trap door, and records it in the master recording unit 790 (S740). . The common reference information generation unit 750 generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmission device 800 and the reception device 900 (S750). The transmission input unit 810 of the transmission device 800 receives the common reference information crs and the document m and records them in the transmission recording unit 890 (S810). The reception input unit of the reception device 900 also receives the common reference information crs and records it in the reception recording unit 990 (S911).

The random number generation unit 820 generates the random numbers r ₁ and r ₂ and records them in the transmission recording unit 890 (S820). The one-time signature key generation unit 230 generates a signature verification key vk ₀ and a signature generation key sk ₀ for the one-time signature, and records them in the transmission recording unit 890 (S230). The commitment element generation unit 840
(1) Let H (vk ₀ ) be an individual public key pk,
(2) randomly selecting elements ρ ₁ and ρ ₂ of group G;
(3) E (ρ ₁ , g) is β ₁ , E (ρ ₂ , V _pk ⁻¹ ) is β ₂ , E (g, g) ^a is β
However,

pk _j is the jth bit of pk,
(4) In order to commit the document m which is an integer of 0 or more and p-1 or less, the commitment element C and the decommitment element D are

And is recorded in the transmission recording unit 890 (S840). The one-time signature generation unit 250 generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ and records it in the transmission recording unit 890 (S250). The commitment transmission unit 260 transmits a commitment com including the commitment element C and the signature verification key vk ₀ to the reception device 900 (S260). Then, the reception input unit 910 of the reception device 900 receives the commitment com including the commitment element C ′ and the signature verification key vk ₀ ′, and records it in the reception recording unit 990 (S912).

In the unsealing phase, the decommitment transmission unit 270 of the transmission device 800 transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the reception device 900 (S270). The reception input unit 910 of the reception apparatus 900 receives and receives the decommitment element D ′ = (m ′, r ₁ ′, r ₂ ′), the document m ′, and the decommitment dec including the one-time signature σ ₀ ′. Recording is performed in the recording unit 990 (S913). The one-time signature verification unit 320 uses the signature verification key vk ₀ ′ to verify the validity of the one-time signature σ ₀ ′ for the commitment element C ′ (S320). The commitment verification unit 930
(1) Let H (vk ₀ ′) be an individual public key pk ′,
(2) E (ρ ₁ ′, g) is β ₁ ′, E (ρ ₂ ′, V _pk ⁻¹ ) is β ₂ ′, E (g, g) ^a is β ′,
(3)

(S930). In addition, when verification of step S320, S630 fails, an error should be output and a process should be stopped.

In the commitment system of the present embodiment, the transmission device 500 can generate the trap door td = (σ ₁ , σ ₂ ). Here, σ ₁ and σ ₂ are

Here, pk _j is the j-th bit of pk, and w is an integer randomly selected from 0 to p−1. Further, ^{m ~} a ^{m ~} ≠ m, r ^- ₂ ^- ₁ and r

Integer ^{satisfying, r} _{~ 1} and ^r _{~ 2} the _{^{r ~ 1 = r 1 - (}} m ~ -m) r - 1 mod p
_{^{r ~ 2 = r 2 - (}} m ~ -m) r - 2 mod p
And the de-commitment element is D ^~ = (m ^~ , r ^~ ₁ , r ^~ ₂ ),

It becomes. In other words, it can be double-opened. Thus, the commitment system of the present embodiment has six algorithms for multi-trap door commitment.

  The commitment system of the present embodiment uses a signature scheme in which the configuration of the multi-trap door commitment does not exist forgery against weakly selected document attacks. The master public key PK corresponds to the signature method verification key, the master trap door corresponds to the signature method signature key, the individual public key corresponds to the signature method document, and the individual public key trap door corresponds to the signature method signature. ing. In other words, breaking the constraint of commitment is equivalent to acquiring a trapdoor. The commitment system according to the present embodiment is a robust commitment method that is non-interactive and allows the common reference information to be reused if the calculation DH assumption holds.

Supplementary explanation regarding safety Terms used in the above description will be described below. The contents of this supplementary explanation are known from the date before the filing date of the present application.

  The multi-trap door commitment is described in detail in Non-Patent Document 3. To introduce a part of them, multi-trap commitment consists of six algorithms (master key generation KGen., Selection Sel., Trapdoor generation TGen., Commitment Com., Verification Vrfy., Double swing Equiv.). Multi-trap door commitment has legitimacy, information-theoretic secrecy, and binding properties.

  The signature scheme is composed of three probabilistic polynomial time algorithms (key generation algorithm Sig.Gen, signature algorithm Sig.Sign, and verification algorithm Sig.Vrfy). The fact that the signature scheme cannot exist forgery against weakly selected document attacks means that the probability that the enemy wins the next game can be ignored for any enemy (attacker).

(1) Question: The enemy first sends a list Q of documents m ₁ ,..., M _k .

(2) Answer: a pair of verification key and the signature key (vk, sk) and, signature σ ₁ to the question document, ..., and sends it to the enemy σ _k.

(3) Output: The enemy outputs (m ^* , σ ^* ). If, m ^* is not included in the Q, and that the enemy has won the game if the signature σ ^* is valid for m ^*.

λ is a security parameter, and p and q are odd prime numbers having different λ bits. When RSA modulus N = pq, φ (N) = (p−1) (q−1) and a relatively prime positive integer e and a random integer y of 1 to N−1 are given, The difficulty in calculating x such that x ^e = y mod N is called the RSA assumption. In other words, under RSA assumption, the advantage of being able to calculate x for any enemy can be ignored.

G and G _T are prime order cyclic groups of p, E is the bilinear map for converting the original G × G in the original G _T, and satisfies the bilinear and non-degenerative. Further, g is a generation source of the group G, and a and b are arbitrary integers of 0 or more and p−1 or less. Then, given (G, G _T , p, g, E) and (g ^a , g ^b ), it is difficult to calculate g ^ab DH (Diffie Hellman) assumption That's it. In other words, under the calculation DH assumption, the superiority of calculating g ^ab for any enemy can be ignored.

Program, Recording Medium When the above-described configuration is realized by a computer, processing contents of functions that the master device, the transmission device, and the reception device should have are described by the program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording medium and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the master device, the transmission device, and the reception device are configured by executing a predetermined program on the computer. However, at least a part of these processing contents is realized by hardware. It is good.

  The present invention can be used in commitment schemes in telecommunications systems.

100, 400, 700 Master device 150, 450, 750 Common reference information generation unit 190, 490, 790 Master recording unit 200, 500, 800 Transmission device 210, 510, 810 Transmission input unit 220, 820 Random number generation unit 230 One-time signature Key generation unit 240, 540, 840 Commitment element generation unit 250 One-time signature generation unit 260 Commitment transmission unit 270 Decommitment transmission unit 290, 590, 890 Transmission recording unit 300, 600, 900 Reception device 310, 610, 910 Reception input unit 320 One-time signature verification unit 330, 630, 930 Commitment verification unit 390, 690, 990 Reception recording unit 410 RSA modulus unit 420, 720 Master selection unit 430 Function definition unit 440, 740 Master key generation unit 1000 Network

Claims (16)

A commitment system composed of a transmission device, a reception device, and a master device,
The master device is
A common reference information generating unit that generates common reference information crs including a master public key PK and a hash function H, and transmits the common reference information crs to the transmitting device and the receiving device;
The transmitter is
A transmission input unit for receiving the common reference information crs and the document m;
A random number generator for generating a random number r;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be the individual public key pk of the multi-trap door commitment and use the master public key PK, the individual public key pk, the document m, and the random number r to commit the document m. A commitment element generator for D,
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
With
The receiving device is:
Receive input for receiving the common reference information crs, a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′, a decommissioning element D ′, a document m ′, and a decommissioning dec including a one-time signature σ ₀ ′ And
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
A commitment verification unit that verifies the legitimacy of the commitment element C ′ and the decommitment element D ′ by a multi-trap door commitment verification algorithm;
A commitment system characterized by A commitment system composed of a transmission device, a reception device, and a master device,
The master device is
λ is a security parameter, f is an integer that depends on 1 ^λ , p and q are different λ-bit odd prime numbers, F is a pseudo-random function that converts a bit string of arbitrary bits into a bit string of f bits,
RSA modulus part that outputs RSA modulus N = pq, where 2 ^f <φ (N) = (p−1) (q−1) <2 ^{f + 2} ,
A master selection unit that randomly selects an arbitrary integer h of 1 or more and N−1 or less, a key K of a pseudo-random function F, and a bit string c of f bits;
Function P _{K, c}

A function definition part defined as
A master key generation unit having (N, h, c, K) as a master public key PK and (p, q, PK) as a master trap door TK;
A common reference information generating unit that generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmitting device and the receiving device;
The transmitter is
A transmission input unit for receiving the common reference information crs and the document m;
A random number generator for generating a random number r;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be an individual public key pk,
e _j = P _{K, c} (pk ^(j) ), where pk ^(j) calculates the first j bits of pk from j = 1 to j = J, and e _min is among e ₁ ,..., e _J To the smallest value,
m _j = m mod e _j
Is calculated from j = 1 to j = J,
M mod e _j = m _j
Is greater than or equal to 0 for all j

Find from the following integers,
In order to commit a document m that is an integer greater than or equal to 0 and less than or equal to e _min −1, a commitment element C and a decommitment element D are

A commitment element generation unit
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
With
The receiving device is:
Including the common reference information crs, a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′, a decommissioning element D ′ = (M ′, r ′), a document m ′, and a one-time signature σ ₀ ′ A receiving input unit for receiving decommitment dec;
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
Let H (vk ₀ ') be the individual public key pk',
e _j '= P _{K, c} (pk' ^(j) ), where pk ' ^(j) is the first j bits of pk' and
m _j '= M' mod e _j '
Is calculated from j = 1 to j = J,
m ₁ '= m ₂ ' =, ..., = m _J '
And

A commitment verification unit that verifies that
A commitment system characterized by A commitment system composed of a transmission device, a reception device, and a master device,
The master device is
lambda security parameters, G and G _T is 2 ^lambda bilinear group larger prime order p, J is a predetermined positive integer, E is bilinear map for converting the original G × G on the original G _T age,
A master selection unit that randomly selects an integer a of 0 or more and p-1 or less, a generator g of the group G, and elements v ₀ ,..., V _J of the group G;
(G, v ₀ ,..., V _J , E (g, g) ^a ) as the master public key PK and a as a master trap door, a master key generator,
A common reference information generating unit that generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmitting device and the receiving device;
The transmitter is
A transmission input unit for receiving the common reference information crs and the document m;
A random number generator for generating random numbers r ₁ and r ₂ ;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be an individual public key pk,
Randomly select elements ρ ₁ and ρ ₂ of group G;
E (ρ ₁ , g) is β ₁ , E (ρ ₂ , V _pk ⁻¹ ) is β ₂ , E (g, g) ^a is β
However,

pk _j is the jth bit of pk,
In order to commit a document m that is an integer of 0 or more and p-1 or less, a commitment element C and a decommitment element D are

A commitment element generation unit
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
With
The receiving device is:
A commitment com including the common reference information crs, a commitment element C ′ = (ρ ₁ ′, ρ ₂ ′, Β) and a signature verification key vk ₀ ′; and a decommitment element D ′ = (m ′, r ₁ ′, a receiving input that receives r ₂ ′), a document m ′, and a decommitment dec that includes a one-time signature σ ₀ ′;
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
Let H (vk ₀ ') be the individual public key pk',
E (ρ ₁ ′, g) is β ₁ ′, E (ρ ₂ ′, V _pk ⁻¹ ) is β ₂ ′, E (g, g) ^a is β ′,

A commitment verification unit that verifies that
A commitment system characterized by λ is a security parameter, f is an integer that depends on 1 ^λ , p and q are different λ-bit odd prime numbers, F is a pseudo-random function that converts a bit string of arbitrary bits into a bit string of f bits,
RSA modulus part that outputs RSA modulus N = pq, where 2 ^f <φ (N) = (p−1) (q−1) <2 ^{f + 2} ,
A master selection unit that randomly selects an arbitrary integer h of 1 or more and N−1 or less, a key K of a pseudo-random function F, and a bit string c of f bits;
Function P _{K, c}

A function definition part defined as
A master key generation unit having (N, h, c, K) as a master public key PK and (p, q, PK) as a master trap door TK;
A master apparatus comprising a common reference information generation unit that generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string. lambda security parameters, G and G _T is 2 ^lambda bilinear group larger prime order p, J is a predetermined positive integer, E is bilinear map for converting the original G × G on the original G _T age,
A master selection unit that randomly selects an integer a of 0 or more and p-1 or less, a generator g of the group G, and elements v ₀ ,..., V _J of the group G;
(G, v ₀ ,..., V _J , E (g, g) ^a ) as the master public key PK and a as a master trap door, a master key generator,
A master apparatus comprising a common reference information generation unit that generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string. A transmission input unit for receiving the common reference information crs including the master public key PK and the hash function H and the document m;
A random number generator for generating a random number r;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be the individual public key pk of the multi-trap door commitment and use the master public key PK, the individual public key pk, the document m, and the random number r to commit the document m. A commitment element generator for D,
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ ;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ ;
A transmission apparatus comprising: λ is a security parameter, f is an integer depending on 1 ^λ , p and q are different λ-bit odd prime numbers, F is a pseudo-random function for converting an arbitrary bit string into an f-bit bit string, P _{K, c} ,

N is N = pq, h is an arbitrary integer between 1 and N−1, K is a key of the pseudorandom function F, c is a bit string of f bits,
A transmission input unit that receives the common reference information crs including the master public key PK = (N, h, c, K) and the hash function H that outputs a bit string of J bits and the document m;
A random number generator for generating a random number r;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be an individual public key pk,
e _j = P _{K, c} (pk ^(j) ), where pk ^(j) calculates the first j bits of pk from j = 1 to j = J, and e _min is among e ₁ ,..., e _J To the smallest value,
m _j = m mod e _j
Is calculated from j = 1 to j = J,
M mod e _j = m _j
Is greater than or equal to 0 for all j

Find from the following integers,
In order to commit a document m that is an integer greater than or equal to 0 and less than or equal to e _min −1, a commitment element C and a decommitment element D are

A commitment element generation unit
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ ;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ ;
A transmission apparatus comprising: lambda security parameters, G and G _T is 2 ^lambda bilinear group larger prime order p, J is a predetermined positive integer, E is bilinear map for converting the original G × G on the original G _T , A is an integer between 0 and p−1, g is a group G generator, v ₀ ,..., V _J are groups G elements,
A transmission input unit that receives the master reference key PK = (g, v ₀ ,..., V _J , E (g, g) ^a ) and the common reference information crs including the hash function H that outputs a bit string of J bits and the document m. When,
A random number generator for generating random numbers r ₁ and r ₂ ;
A one-time signature key generation unit that generates a signature verification key vk ₀ and a signature generation key sk ₀ for a one-time signature;
Let H (vk ₀ ) be an individual public key pk,
Randomly select elements ρ ₁ and ρ ₂ of group G;
E (ρ ₁ , g) is β ₁ , E (ρ ₂ , V _pk ⁻¹ ) is β ₂ , E (g, g) ^a is β
However,

pk _j is the jth bit of pk,
In order to commit a document m that is an integer of 0 or more and p-1 or less, a commitment element C and a decommitment element D are

A commitment element generation unit
A one-time signature generation unit that generates a one-time signature σ ₀ for the commitment element C using the signature generation key sk ₀ ;
A commitment transmitter that transmits a commitment com including a commitment element C and a signature verification key vk ₀ ;
A decommitment transmission unit that transmits a decommitment dec including the decommitment element D, the document m, and the one-time signature σ ₀ ;
A transmission apparatus comprising: The common reference information crs including the master public key PK and the hash function H, the commitment com including the commitment element C ′ and the signature verification key vk ₀ ′, the decommissioning element D ′, the document m ′, and the one-time signature σ ₀ ′ A receiving input unit for receiving a decommissioning dec including:
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
A receiving apparatus comprising a commitment verification unit that verifies the validity of a commitment element C ′ and a decommitment element D ′ by a multi-trap door commitment verification algorithm. λ is a security parameter, f is an integer depending on 1 ^λ , p and q are different λ-bit odd prime numbers, F is a pseudo-random function for converting an arbitrary bit string into an f-bit bit string, P _{K, c} ,

N is N = pq, h is an arbitrary integer between 1 and N−1, K is a key of the pseudorandom function F, c is a bit string of f bits,
Master reference key PK = (N, h, c, K) and common reference information crs including hash function H that outputs a bit string of J bits, commitment com including commitment element C ′ and signature verification key vk ₀ ′, A reception input unit that receives a decommitment element D ′ = (M ′, r ′), a document m ′, and a decommitment dec including a one-time signature σ ₀ ′;
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
Let H (vk ₀ ') be the individual public key pk',
e _j '= P _{K, c} (pk' ^(j) ), where pk ' ^(j) is the first j bits of pk' and
m _j '= M' mod e _j '
Is calculated from j = 1 to j = J,
m ₁ '= m ₂ ' =, ..., = m _J '
And

And a commitment verification unit that verifies that lambda security parameters, G and G _T is 2 ^lambda bilinear group larger prime order p, J is a predetermined positive integer, E is bilinear map for converting the original G × G on the original G _T , A is an integer between 0 and p−1, g is a group G generator, v ₀ ,..., V _J are groups G elements,
Master public key PK = (g, v ₀ ,..., V _J , E (g, g) ^a ) and common reference information crs including a hash function H that outputs a bit string of J bits, and commitment element C ′ = (ρ ₁ ′, ρ ₂ ′, Β) and the commitment com including the signature verification key vk ₀ ′, the decommitment element D ′ = (m ′, r ₁ ′, r ₂ ′), the document m ′, and the one-time signature σ ₀ A receiving input unit that receives a decommitment dec including ';
A one-time signature verification unit that verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
Let H (vk ₀ ') be the individual public key pk',
E (ρ ₁ ′, g) is β ₁ ′, E (ρ ₂ ′, V _pk ⁻¹ ) is β ₂ ′, E (g, g) ^a is β ′,

A commitment verification unit that verifies that
A receiving device. A commitment method using a commitment system composed of a transmission device, a reception device, and a master device,
In the sealing phase,
The master device generates common reference information crs including a master public key PK and a hash function H, and transmits the common reference information crs to the transmitting device and the receiving device;
A transmission input step in which the transmission device receives the common reference information crs and the document m;
A first receiving input step in which the receiving device receives the common reference information crs;
The transmitting device generates a random number r;
A one-time signature key generation step in which the transmitting device generates a signature verification key vk ₀ and a signature generation key sk ₀ of a one-time signature;
The transmitting device uses H (vk ₀ ) as the individual public key pk of the multi-trap door commitment, and uses the master public key PK, the individual public key pk, the document m, and the random number r to commit the document m. C, a commitment element generation step for obtaining a decommitment element D;
A one-time signature generation step in which the transmitting device generates a one-time signature σ ₀ for the commitment element C using a signature generation key sk ₀ ;
A commitment transmitting step in which the transmitting device transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
The receiving device has a second receiving input step of receiving a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′;
In the opening phase,
A de-commitment transmission step in which the transmitting device transmits a de-commitment dec including the de-commitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
A third receiving input step in which the receiving device receives a decommitment dec including a decommitment element D ′, a document m ′, and a one-time signature σ ₀ ′;
A one-time signature verification step in which the receiving device verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
The commitment method, comprising: a commitment verification step of verifying validity of the commitment element C ′ and the decommitment element D ′ by a multi-trap door commitment verification algorithm. A commitment method using a commitment system composed of a transmission device, a reception device, and a master device,
λ is a security parameter, f is an integer that depends on 1 ^λ , p and q are different λ-bit odd prime numbers, F is a pseudo-random function that converts a bit string of arbitrary bits into a bit string of f bits,
In the sealing phase,
An RSA modulus step in which the master device outputs an RSA modulus N = pq where 2 ^f <φ (N) = (p−1) (q−1) <2 ^{f + 2} ;
A master selection step in which the master device randomly selects an arbitrary integer h of 1 to N−1, a key K of a pseudo-random function F, and a bit string c of f bits;
The master device determines the function P _{K, c}

A function definition step defined as
A master key generating step in which the master device uses (N, h, c, K) as a master public key PK and (p, q, PK) as a master trap door TK;
The master device generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmitting device and the receiving device;
A transmission input step in which the transmission device receives the common reference information crs and the document m;
A first receiving input step in which the receiving device receives the common reference information crs;
The transmitting device generates a random number r;
A one-time signature key generation step in which the transmitting device generates a signature verification key vk ₀ and a signature generation key sk ₀ of a one-time signature;
The transmitting device uses H (vk ₀ ) as an individual public key pk,
e _j = P _{K, c} (pk ^(j) ), where pk ^(j) calculates the first j bits of pk from j = 1 to j = J, and e _min is among e ₁ ,..., e _J To the smallest value,
m _j = m mod e _j
Is calculated from j = 1 to j = J,
M mod e _j = m _j
Is greater than or equal to 0 for all j

Find from the following integers,
In order to commit a document m that is an integer greater than or equal to 0 and less than or equal to e _min −1, a commitment element C and a decommitment element D are

Commitment element generation step
A one-time signature generation step in which the transmitting device generates a one-time signature σ ₀ for the commitment element C using a signature generation key sk ₀ ;
A commitment transmitting step in which the transmitting device transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
The receiving device has a second receiving input step of receiving a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′;
In the opening phase,
A de-commitment transmission step in which the transmitting device transmits a de-commitment dec including the de-commitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
A third receiving input step in which the receiving device receives a decommitment element D ′ = (M ′, r ′), a document m ′, and a decommitment dec including a one-time signature σ ₀ ′;
A one-time signature verification step in which the receiving device verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
The receiving device uses H (vk ₀ ′) as an individual public key pk ′,
e _j '= P _{K, c} (pk' ^(j) ), where pk ' ^(j) is the first j bits of pk' and
m _j '= M' mod e _j '
Is calculated from j = 1 to j = J,
m ₁ '= m ₂ ' =, ..., = m _J '
And

And a commitment verification step for verifying that the commitment method is included. A commitment method using a commitment system composed of a transmission device, a reception device, and a master device,
lambda security parameters, G and G _T is 2 ^lambda bilinear group larger prime order p, J is a predetermined positive integer, E is bilinear map for converting the original G × G on the original G _T age,
A master selection step in which the master device randomly selects an integer a between 0 and p−1, a group G generator g, and a group G element v ₀ ,..., V _J ;
A master key generating step in which the master device uses (g, v ₀ ,..., V _J , E (g, g) ^a ) as the master public key PK and a as a master trap door;
The master device generates common reference information crs including a hash function H that outputs a master public key PK and a J-bit bit string, and transmits the common reference information crs to the transmitting device and the receiving device;
A transmission input step in which the transmission device receives the common reference information crs and the document m;
A first receiving input step in which the receiving device receives the common reference information crs;
A random number generation step in which the transmission device generates random numbers r ₁ and r ₂ ;
A one-time signature key generation step in which the transmitting device generates a signature verification key vk ₀ and a signature generation key sk ₀ of a one-time signature;
The transmitting device uses H (vk ₀ ) as an individual public key pk,
Randomly select elements ρ ₁ and ρ ₂ of group G;
E (ρ ₁ , g) is β ₁ , E (ρ ₂ , V _pk ⁻¹ ) is β ₂ , E (g, g) ^a is β
However,

pk _j is the jth bit of pk,
In order to commit a document m that is an integer of 0 or more and p-1 or less, a commitment element C and a decommitment element D are

Commitment element generation step
A one-time signature generation step in which the transmitting device generates a one-time signature σ ₀ for the commitment element C using a signature generation key sk ₀ ;
A commitment transmitting step in which the transmitting device transmits a commitment com including a commitment element C and a signature verification key vk ₀ to the receiving device;
The receiving device has a second receiving input step of receiving a commitment com including a commitment element C ′ and a signature verification key vk ₀ ′;
In the opening phase,
A de-commitment transmission step in which the transmitting device transmits a de-commitment dec including the de-commitment element D, the document m, and the one-time signature σ ₀ to the receiving device;
A third receiving input step in which the receiving device receives a decommitment dec including a decommitment element D ′ = (m ′, r ₁ ′, r ₂ ′), a document m ′, and a one-time signature σ ₀ ′;
A one-time signature verification step in which the receiving device verifies the validity of the one-time signature σ ₀ ′ with respect to the commitment element C ′ using the signature verification key vk ₀ ′;
The receiving device uses H (vk ₀ ′) as an individual public key pk ′,
E (ρ ₁ ′, g) is β ₁ ′, E (ρ ₂ ′, V _pk ⁻¹ ) is β ₂ ′, E (g, g) ^a is β ′,

A commitment verification step to verify that
A commitment method characterized by comprising:   A program that causes a computer to function as the master device according to claim 4 or 5, the transmission device according to any one of claims 6 to 8, or the reception device according to any one of claims 9 to 11.   A computer-readable recording medium on which the program according to claim 15 is recorded.

Images