JP3316466B2 - Electronic secret balloting method, device thereof, and program recording medium - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and apparatus for implementing secret ballot in a telecommunications system.

[0002]

2. Description of the Related Art There is a digital signature as a technique for ensuring that digital information is not falsified. As a typical example of the digital signature scheme, RSA encryption (RL Rivest,
etal. “A Method for Obtaining Digital Signatures
and Public-Key Cryptosystems ”, Communications of
The ACM, Vol. 21, No. 2, pp. 120-126, (1978)). The RSA encryption is as follows.

The signer A uses the signing key (d, n) and the verification key (e, n) as n = p × q e × d≡1 (mod LCM ｛(p−1), (q− 1)｝) (1) is generated to satisfy, the inspection key is made public, and the signature key is secretly managed. Here, LCM {a, b} represents the least common multiple of integers a and b, and p and q are two different large prime numbers. A≡b (mod L) indicates that a−b is a multiple of L.

[0004] The RSA cryptosystem is a cryptosystem having a security basis that it is difficult to factorize n when n is large.
From the public inspection key (n, e) to the secret signature key d
It is difficult to determine the components. Verifier B signer A
Inspection key (e, n) is managed in combination with personal identification information (ID). Set up a center to manage authentication keys,
The center often manages the inspection key as a public information management book.

A signature function D and a verification function E are defined by D (x) = x ^d mod n (2) E (y) = y ^e mod n (3) When 0 < x <n is satisfied, it can be shown that E (D (x)) = x holds for the integer x. Here, a mod n is a
Represents the remainder when divided by.

The digital signature system using the RSA encryption is as follows. The signer A applies a secret signature function D to f (m) generated from the document m using the one-way function f to generate a signature σ at σ = D (f (m)). ,
Combination of personal identification information (ID), document m, and signature σ (I
D, m, σ) to the verifier V as a signed message. The verifier V searches the public information management book in which the inspection key is registered using the ID as a key, obtains a verification function E, obtains E (σ) from the σ component of the signed communication message, and obtains E (σ) from m. A check is made to see if it matches the obtained f (m). E (σ) = f (m)
Holds, only the true signer A knows the signature function D, so it is determined that the sender (signer) is the real A and (ID, m, σ) has not been tampered with. I do.

Here, f is a one-way function from x to f
Although the calculation for obtaining (x) is easy, it is a function that is difficult to obtain x from f (x). f is a high-speed conventional encryption device, for example, DES encryption (Data, Encryption Standard, F
ederal Information Rrocessing Standards Publicatio
n 46, 1977). Here, a blind signature that can guarantee the privacy of the user will be described. With blind signatures, the signer can be signed while keeping the content of the document confidential. A method based on the RSA method is described in D. Chaum, “Security withoutId.
entification: Transaction Systems to Make Big Brot
her Obsolete, "Comm. of the ACM, 28, 10, pp.1030
In -1044 (1985), a blind signature based on dialogue proof was described in T. Okamoto et al. “Divertible Zero-Knowledge In
teractive Proofs and Commutative Random Self-Reduc
ible, "The Rroc. of Eurocrypt'89 (1989).

[0008] The concept of blind signature is as follows. The signature requester P disturbs the document (m) with the random number (r) by the blind signature preprocessing to generate a blind message (m ′). The signer A calculates a temporary signature (σ ′) corresponding to m ′ using the secret signature key.
At this time, since m is disturbed by r, the signer cannot know the document (m). The requester P removes the influence of the random number (r) from σ ′ by the blind signature post-processing, obtains the true signature (σ) for the original document (m), and sends the pair of m and σ to the verifier. Send. The verifier uses the signer's public key to confirm that σ is a signature with m. Here, when a plurality of documents are signed by the signer A, the signer A and the verifier cannot know which σ corresponds to a certain σ even if they cooperate.

The method of realizing a blind signature using the RSA method is as follows. Step 1 The signature requester P has a random number r∈
(Z / nZ) to generate generates a m '= r ^e × m mod by n (4) m' from the document m, and transmits the signer A. Step2
A generates σ ′ using σ ′ = m ′ ^d mod n (5) using the secret signature key d, and transmits it to P.

Step 3 P calculates the true digital signature σ of A corresponding to m by σ = σ ′ / rmod n (6), and transmits m and σ to the verifier V. Step4
V checks whether m = σ ^e mod n (7) holds.

Here, σ ^e ≡ (σ ′ / r) ^e ≡σ ′ ^e /
^{r e ≡m '/ r e ≡} (r e · m) / r e ≡m (mod n)
Holds, σ is the signature of m. When 0 <m <n in the above example, since the verifier V can restore m,
It is not necessary to send m to the verifier, but if m is long, the hash value f (m) may be calculated and the value may be regarded as the above m and processed. Note that transmission of document m is required to calculate m).

For simplicity, the following notation is used. m ′ = Ψ (m, r): blind signature pre-processing function σ ′ = Σ _A (m ′): signer A's signature creation function y = Φ (σ ′, r): blind signature post-processing function Pass / fail Pass = V _A (m, y): Signature verification function of signer A In the above example, m ′ = Ψ (m, r) = r ^e × m mod n,
σ ′ = Σ _A (m ′) = m ′ ^d mod n, σ = Φ (σ ′,
r) = σ ′ / rmod n, V _A is “pass = V _A (m, y) if and only if y ^e ≡m mod n”
Note that

An electronic voting method using digital prominence is as follows.
Various schemes have been proposed, but the scheme using a blind signature is considered to be the most promising, as described in a specialized book on cryptography ("Contemporary Cryptography" written by Okamoto and Yamamoto). For example, Kazuo Ota: "Electronic voting method using a single election manager", proposed in 1988 at the IEICE Spring National Convention, A-294 (Showa 63-3).

In the above method, the signature requester P cannot complete the signature request processing until the temporary signature σ ′ is returned from the signer and Step 3 is executed. For example,
Applying a blind signature to electronic voting, the voter will reply from the Election Commission because the voter is the signer, the Election Commission is the signatory, and the ballot count is the signature verifier. Have to wait. The waiting time depends on the signer's signature creation time and the line status of the signer and the signer.

[0015]

In order to shorten the waiting time of the voter who is the signer, the computer of the election administration committee which is the signer should be made faster and the line should always be available. Must be. If the Internet is used for the line, a lot of waiting time is required depending on the situation, and the signature generation process is concentrated on the signer (election committee). Becomes larger.

An object of the present invention is to provide an electronic voting method using a blind signature in which a voter is a signer (election administrator).
It is an object of the present invention to provide a method and an apparatus capable of performing voting without waiting for a response from a user.

[0017]

According to the present invention, post-blind signature processing is outsourced to a trusted third party U's device.
The signature requester apparatus adds the newly encrypted random number component r ′ (= E _u (r)) in addition to the blind message m ′.
And sends m ′ and r ′ to the signer device. Here, the encrypted random number component r 'is generated so that the device of the third party U can decrypt it. U uses the decrypted random number r to perform a blind signature on behalf of the signer himself. Execute a processing function. The signer apparatus transfers the signature σ ′ to the third party U apparatus together with r ′ without returning it to the signature requester apparatus.

The signature requester apparatus can complete the process when transmitting the blind message and the encrypted random number component. Unless the signer and the third party collude, the original document m cannot be obtained from the blind message m '.

[0019]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below. Explain the case where the anonymous committee is composed of multiple anonymous committee members.
L = 1). In addition, there shall be a single election administrator (if there is more than one, it will be described later).

FIG. 1 is a diagram showing the overall configuration of the present invention. The voter device 100 is connected to the election manager device 200 via the communication channel 500, and the election manager device 200 is connected to the anonymous committee 1 device 300-1 via the communication channel 500, and The device 300-i is an anonymous member i + 1
Device 300- (i + 1) via the communication channel 500, and the device 300-L of the anonymous committee member L is the totalizer device 4
A communication path 500 is provided between the communication path 500 and the communication path 00.

FIG. 2 shows an example of a communication sequence of the present invention, FIG. 3 shows an example of a functional configuration of the voter apparatus 100, FIG. 4 shows an example of a functional configuration of the election manager apparatus 200, and FIG. FIG. 6 shows an example of a functional configuration of −i, and FIG. 6 shows an example of a functional configuration of the tally person apparatus 400. In the embodiment shown here, a case where an RSA blind signature is used will be described. Therefore, the election manager apparatus 200 generates the public key (n, e) and the secret key (d) in advance and makes the public key public. Regarding the RSA blind signature, refer to Reference D. introduced above. Chaum, "Securi
ty without Identificatio
n: Transaction Systems to
Make Big Brother Obsolet
e, "Comm. of the ACM, 28, 10,
PP. 1030-1044 (1985).

Other blind signatures (eg, Sch
Norr blind signature and Fiat-Shamir bra
Signed in India: Okamoto and Yamamoto, "Contemporary Crypto", Industrial Books
) Can be similarly realized. In addition, each anonymous committee
Member U_iThe public cryptographic function of (i = 1,..., L) is E_iWhen
Then U _iIs the secret decryption function D_iShall hold
You.

The hash function (SH) used for the signature
A, MD5). Step 1 The voter P's device 100 uses the random number generator 101 to generate L
Generate random numbers r _i (i = 1, 2,..., L).
Further, random numbers r ₁ ,..., R _L and voting m are input to a blind signature pre-processing function calculator including a hash function calculator 107 and a residue multiplier 102, and the following blind signature pre-processing is performed to obtain B. Generate.

B = h (m) · (r₁, ..., r_L)^emod
n Also, using the encryptor 103, r₁, ..., r_LAnd m
C₀Generate C_L-1= E_L(M‖r_L), C_i-1= E_i(C_i‖R_i), (I = 1,..., L−1) That is, as shown in FIG.
And r_LWith input as C _L-1= E_L(M‖r_L) And encryption
And in the next encryption stage 103- (L-1)_K-1And r_L-1
With input as C_L-2= E_L-1(C_L-1‖R_L-1) And encryption
And then sequentially encrypted in the same manner.
Is C_TwoAnd r₁With input as C₀= E₁(C_Two‖R₁)When
Encrypted. Thus, m and r in the first stage_LAnd input
And r₁, ..., r_L-1Are used one by one, and m is many
It is heavily encrypted.

The device 100 of Step 2 P has B and C ₀
Is transmitted to the election manager apparatus 200 together with information proving his / her identity. For example, as information to prove your identity,
There are a digital signature and a password for (B, C ₀ ). Step 3 The election manager device 200 authenticates the identity of P and checks whether P is registered as an elector in the election management book. It also checks to see if the election administrator has already been signed. If the identity has been proved and registered as an elector, and the signature request has not already been made, the following signature issuance processing is performed. Otherwise, the subsequent processing is not performed.

Step 4 Device 200 of Election Manager A
Inputs the secret signature key d and the received B to the signature creation function calculator, that is, the remainder multiplier 202, and generates the following signature σ ₀ . σ ₀ = B ^d mod n 200 of election officials A is, sigma ₀ with C ₀ received
And transmits to the device 300-1 anonymous members U _1.

Step 5: Device 300 of anonymous committee member U _i
i _{is, (C i-1, σ} i-1) receives a blind signature postprocessing function calculator as shown in Figure 5A, that is, using the remainder operator 302 and the decoder 304, the following (C _i , Σ
_i ). _{C i ‖r i = D i (} C i-1), device 300-i of the _{σ i = σ i-1 /} r i mod n U i is than the other voters device (C _i, σ _i) And sends it to the device 300- (i + 1) of the anonymous committee member U _{i + 1} .

[0028] Step6 anonymous committee member U _L of the device 300-
L is received from the U _L-1 of the device 300- (L-1) (C L-1, σ L-1) and as shown in FIG. 5B remainder operator 3
02 and the decoder 304, and the following m and σ are generated. _{m‖r L = D L (C L} -1), device 300-L of _{σ = σ L-1 / r} L mod n U L is than the other voter apparatus (m,
σ) and shuffle (m, σ) into the tallyer device (40
Send to 0).

Step 7 The device 400 of the tallyer V uses the hash function calculator 407, the signature verification function calculator (remainder calculator) 402, and the comparator 405 as shown in FIG. Can be verified by whether the following verification formula holds. h (m) = σ ^e mod n The totalizer device totals only the votes m for which the verification formula is satisfied.

Next, a case where there are a plurality of election managers will be described. In the simplest implementation, the procedure described above may be performed in parallel for each election manager. As a more efficient implementation method, a case where an efficient multiple signature is used based on a Schnorr blind signature will be described.

FIG. 7 is a diagram showing the overall configuration. Voter device 100 (of K's) multiple via a communication path 500 election officials 200-1, ..., combined with 200-K, which election officials device apparatus anonymous members U ₁ 300- 1 is linked via a communications channel 500, the device 300-i of the anonymous members U _i is anonymous members U _{i + 1} of the device 300- (i +
1) through the communication channel 500, and the anonymous committee U
_L is the device 300-L there is a communication path 500 between the totalizer device 400.

[0032] The exemplary communication sequence of FIG. 8 the invention, an example of a functional configuration of the voter apparatus 100 in FIG. 9, an example of a functional configuration of the election officials device 200 in FIG. 10, the anonymous members U _i in FIG. 11
12 shows a functional configuration example of the device 300-i, and FIG. 12 shows a functional configuration example of the tallyer device 400. First, the common information (p, g) of the system is disclosed and the order q of g
(The minimum value of the integer t such that g ^t = 1 mod p is the order q) is also released at the same time.

[0033] Also, the device 200-j of election officials A _j
(J = 1,..., K) is determined in advance by the public key v _j = g ^-sj
mod p), a secret key (s _j ) is generated, and the public key is made public. Step 1 Election administrator A _j device 2
As shown in FIG. 10, 00-j generates a large number of r _j using a random number generator 201, and calculates x _j = g ^rj mod p using a remainder operation unit 202 for each r _j. , X _j are distributed to each voter device together with a public key in advance as information for an election manager .

Step 2 In the apparatus 100 of the voter P, as shown in FIG. 9, the random number generator 101 generates L sets of random numbers (u _i ,
d _i ) (i = 1, 2,..., L). further,
(U ₁ , d ₁ ),..., (U _L , d _L ) and voting m are input to a hash function operation unit 107, a blind signature pre-processing function calculator including residue multipliers 102 and 104, and an encryption unit 103. , (U, d, x ^* , e ^* , e,
C ₀ ).

[0035] _{u = u 1 + ... + u} L mod q, d = d 1 + ... + d L mod q, x * = g u v -d (x 1 ... x k) mod p, e * = h (x * ^{, m), e = e *} + dmod q, C L-1 = E L ((m, e *) ‖ _{(u L, d L))} , C i-1 = E i (C i ‖ (u _i, d _i )), (i = 1,
.., L-1) The device 100 of Step 3 P transmits (e, x _j ) and C ₀ to the devices 200-j (j = 1, 2) of the respective election managers j.
2,..., K) together with information proving their identity. For example, as information for certifying the identity, (e,
x _j , C ₀ ).

Step 4 The election manager device 200
, And checks whether P is registered as an elector in the election management book. It also checks to see if the election administrator has already been signed. You have been identified and registered as an elector,
If a signature request has not been made, the following signature issuing process is performed. Otherwise, the subsequent processing is not performed.

Step 5: Device 200 of election manager j
As shown in FIG. 10, _j inputs the secret signature key s _j , r _j corresponding to x _j , and the received e to the signature creation function calculator (remainder multiplier) 203 to generate the following y _j . y _j = r _j + es _j mod q The device 200-j of the election manager A _j receives (C ₀ ,
with x _j) to send a y _j to the device 300-1 anonymous members U _1.

Step ₆ The device 300-of the anonymous committee member U ₁
1 from the device 200j of K election administrators (C ₀ , x
_j , y _j ) (j = 1, 2,..., K)
First, as shown in 1A, multiplexing using a remainder operator 302
Signature y and comprehensive manager information _{x y = y 1 + ... +} y K mod q, to generate the _{x = x 1 ... x K mod} p. Next, using a blind signature post-processing function calculator (residue calculator) 303 and a decoder 304, C ₁ ‖ (u ₁ , d ₁ ) = D ₁ (C ₀ ), x ₍₁₎ = xgu ^{1v _{-d1 mod p, y (1)}} = calculates the y + u ₁ mod q. 300-1 anonymous members U ₁ is, (C _1,
x ₍₁₎ , y ₍₁₎ ) to other voters (C ₁ , x ₍₁₎ , y ₍₁₎ )
Shuffled and sent to the unit 300-2 of the anonymous committee U ₂ in.

[0039] Step7 anonymous committee member U _i of the device 300-
When i receives (C _i-1 , x _(i-1) , y _{(i-1 )} ),
As shown in FIG. 11B, using a blind signature post-processing function calculator (remainder operation unit) 302 and a decoder 304, C _i ‖ (u _i , d _i ) = D _i (C _i−1 ), x _{(i ) = x (i-1)} g ui v -di mod p, y (i) = y (i-1) calculating a + u _i mod q. Unit 300-i of the anonymous committee U _i is,
(C _i , x _(i) , y _(i) ) is replaced by (C _i , x
_(i) , y _(i) ) and sends it to the device 300- (i + 1) of the anonymous committee member U _{i + 1} .

[0040] Step8 anonymous committee member U _L of the device 300-
L is received from the U _L-1 of the device 300- (L-1) (C L-1, x (L-1), y (L-1)) blind signature post-treatment as shown in FIG. 11C the Function calculator (remainder arithmetic unit) 30
2 and input to the decoder _{304, m‖ (u L, d} L) = D L (C L-1), x * = x (L) = x (L-1) g uL v -dL mod p, Calculate y ^* = y _(L) = y _(L-1) + u _L mod q. Device 300-L of U _L is, (m, x ^*, y
^*) Of other voters ^{(m, x *, y *} ) and sends it to shuffle to aggregate user device 400.

Step 9 The device 400 of the tallyer V uses the hash function calculator 407, the signature verification function calculator (remainder calculator) 402, and the comparator 405 to obtain (m, x ^* , y ^{* ) as shown} in FIG ^. ) Can be verified based on whether the following verification formula holds. ^{e * = h (x *,} m), x * = g y * v e * mod p tabulation person, to report only vote m the verification equation is satisfied.

[0042]

According to the present invention, the voter can obtain (B, C ₀ )
And (e, x _j , C ₀ ) are sent to the election manager, and the processing of the voter is completed. Therefore, the process is completed when the voting information is simply transmitted to the election manager as if an e-mail was transmitted. In addition, it is easy to introduce a plurality of anonymous committee members and a plurality of election managers, thereby improving security.

[Brief description of the drawings]

FIG. 1 is a diagram showing a system configuration according to an embodiment of the present invention.

FIG. 2 is a diagram showing a communication sequence in the embodiment of the present invention.

3A is a diagram illustrating an example of a functional configuration of the voter apparatus 100 in FIG. 1, and FIG. 3B is a diagram illustrating a specific configuration of an encryptor 103 in FIG. 3A.

FIG. 4 is a diagram showing a functional configuration of an election manager device in FIG. 1;

FIG. 5 is a diagram showing a functional configuration of the anonymous committee device 300 in FIG. 1;

FIG. 6 is a diagram showing a functional configuration of a tally person apparatus 400 in FIG. 1;

FIG. 7 is a diagram showing a system configuration according to another embodiment of the present invention.

FIG. 8 is a diagram showing a communication sequence in the embodiment of FIG. 7;

FIG. 9 is a diagram showing a functional configuration of a voter apparatus 100 in FIG. 7;

FIG. 10 is a diagram showing a functional configuration of an election manager device 200j in FIG. 9;

11 is a diagram showing a functional configuration of the anonymous committee device 300 in FIG. 7;

FIG. 12 is a diagram showing a functional configuration of a tally person apparatus 400 in FIG. 7;

Continuation of the front page (72) Inventor Jun Fujioka 3-19-2 Nishi-Shinjuku, Shinjuku-ku, Tokyo Nippon Telegraph and Telephone Corporation (56) References JP-A-1-177164 (JP, A) JP-A-8 -315053 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB name) H04L 9/32 G06F 17/60 148 JICST file (JOIS)

Claims (8)

(57) [Claims] 1. An electronic secretary voting method for electronically voting via a network, wherein the voter device includes a random number generator, a blind signature preprocessing function calculator, and an encryptor, and the election manager device includes an electoral list. And the function to authenticate the elector and the signature creation function calculator, the anonymous committee device has a decryption device, a blind signature post-processing function calculator, the tallyer device has a signature verification function calculator, and the voter device has: blind enter the random number r voting m and a random number generator has generated the blind station name processing function calculator
Generates a signature preprocessing information B, dark and further inputs the information including the random number r anonymous members device decodable encrypter
Then , the voter device transmits B and C to the election manager device, and the election manager device inputs the received B to the signature creation function calculator, and generates the signature σ ′. Is generated, and (σ ′, C) is transmitted to the anonymous committee device. The anonymous committee device inputs the received C to the decoder to vote m
And r and the received σ ′ are input to the blind signature post-processing function calculator to obtain the signature σ of the vote m, and the other voter's vote and signature pair (m, σ) A number of voting / signature pairs (m, σ) shuffled by the order are transmitted to the counting device V, and the counting device transmits each voting / signature pair (m, σ) to a signature verification function calculator. An electronic anonymous voting method, characterized by inputting and validating the voting data, and counting the votes that have passed the verification. 2. Elections are made electronically via a network.
In the electronic secret balloting method, the voter device includes a random number generator, a blind signature pre-processing function meter.
It is equipped with a calculator and an encryption device.
Equipped with a function to authenticate a person and a signature creation function calculator
Of the anonymous committee members (U ₁ ,..., U _L )
Each anonymous committee device is a decoder, a blind signature post-processing function total
The tallyer device includes a signature verification function calculator, and the voter device includes a vote m and a random number r generated by the random number generator.
_1, ..., type r _L blind station name processing function calculator generates a blind station name processed information B, the first stage input m, a r _L further by apparatus decodable encoders of each anonymous members The random numbers r ₁ ,..., R _L are sequentially input and encrypted in multiple stages to generate encrypted information C ₀ , and the voter device transmits B and C ₀ to the election manager device, caretaker apparatus inputs the received B to the signature creation function calculator, and generates the signature sigma _0, transmits (σ _0, C ₀₎ in the device of the anonymous committee U ₁ a, anonymous members U ₁ device retrieves the encryption C ₁ with obtaining r ₁ by entering the C ₀ received to the decoder, signature sigma ₁ by entering the sigma ₀ received with the r ₁ to blind signature postprocessing function calculator was calculated, from other voter device (C _1, σ ₁₎ and shuffles the order, it shuffled many (C _1, σ ₁ ) to the next anonymous committee U
Sent to the _{second device, (C i-1, σ} i-1) device anonymous members U _i having received the (i
= 2,3, ..., L) are, C _i-1 is input to the decoder retrieves the C _i with obtaining r _i, the r _i and the received sigma _i-1
The Calculate the sigma _i is input to the blind signature postprocessing function calculator, from another voter device (C _{i, σ i)} and shuffles the order, number of which is shuffled (C _{i, σ i)} Next anonymous committee member U
sent to the _{i + 1} device, the last anonymous member _UL device received ( _CL-1 , σL _-1 )
Is input to a decoder and a blind signature post-processing function calculator to obtain a vote m and its signature σ. This (m, σ) and a pair of a vote and a signature (m , Σ) and the number of voting / signature pairs (m, σ) shuffled and transmitted to the counting device, and the counting device signs each voting / signature pair (m, σ).
Enter the name into the name verification function calculator and verify it.
Electronic secret balloting method characterized by counting votes . 3. An electronic secret balloting method for electronically voting via a network, wherein the voter device includes a random number generator, a blind signature pre-processing function calculator, and an encryptor, and manages two or more integer K persons. Each of the election manager devices of the persons (A ₁ ,..., A _K ) has a function of authenticating an electoral list and an elector and a signature creation function calculator, and the anonymous committee device has a decryption device and a blind signature post-processing function calculator. The tallyer device includes a signature verification function calculator, and the voter device inputs the voting m and the random number r generated by the random number generator to the blind signature preprocessing function calculator, and performs the blind signature preprocessing information e. Is generated, and the information including the random number r is input to an encryptor that can be decrypted by the anonymous committee device to generate ciphertext information C, and a plurality of election manager information x _j (j = 1 , ..., k) 'S device
e , C and x _j are sent to the election manager device of the manager A _j , and each of the election manager devices receives the received information ( e , C, x _j ).
Enter the e in the signature creation function calculator generates the signature _{y j (y j, C,} x j) sends anonymous members device, anonymous members device receives the C received in the decoder Vote
And r, and input all received y _j to a blind signature post-processing function calculator to obtain multiple signatures y for a plurality of election manager devices for vote m, and a plurality of elections from received x _j Obtain general manager information x of manager information,
Voting and multiple signatures from (m, y, x) and other voter devices, a large number of voting / multiple signatures disturbed by disturbing the order (m, y, x) and order of the general manager information, total The manager information pair (m, y, x) is transmitted to the tallyer device, and the tallyer device calculates a signature verification function for each voting / multiple signature and total manager information pair (m, y, x). An electronic anonymous voting method characterized by inputting into a container and verifying, and counting the votes that passed the verification. 4. An electronic secretary voting method for electronically voting via a network, wherein the voter device includes a random number generator, a blind signature pre-processing function calculator, and an encryptor, and manages two or more integer K persons. Each of the election manager devices of the persons (A ₁ ,..., A _K ) has a function of authenticating an electoral list and an elector, and a signature creation function calculator, and an integer L or more anonymous members (U ₁ ,. , _UL ) each has a decoder and a blind signature post-processing function calculator, the tallyer device has a signature verification function calculator, and the voter device has a vote m and a random number generated by a random number generator. r ₁ ,..., r _L are input to a blind signature pre-processing function calculator to generate information e that has been subjected to the blind signature pre-processing, and further, m, r _L and then, the random number r _1, ..., sequentially enter the r _L It is encrypted in multiple stages, to generate the information C ₀ of encryption, information for a plurality of election officials _{x j (j = 1, ···} , k)
And the voter device sends e , C ₀ and x _j to the election manager device of the manager A _j , and each election manager device transmits e, C ₀ , x _{j in} the received information (e, C ₀ , x _j ).
The Enter the signature generating function calculator, and generates the signature y _j, and sends the received information (C _0, x _j) to y _j the apparatus anonymous members U _1, apparatus anonymous members U ₁ is , received information _{(C 0, x j, y} j) a C ₀ in is input to the decoder retrieves the encryption C ₁ with obtaining r _1, of all the received and the r ₁ x _j and all y _j Is input to a blind signature post-processing function calculator to calculate information x ₍₁₎ , y ₍₁₎ , and (C ₁ , x ₍₁₎ , y ₍₁₎ ) and (C) from another voter device. _1, x _(1), and shuffle the order and y _(1)), shuffled many (C _1, x _(1), it sends y to ₍₁₎₎ to the next device anonymous members U _2, (C _i-1 , x _(i-1) , y _(i-1) ) Anonymous committee member U _i
The device (i = 2,3, ..., L ) are, C _i-1 is input to the decoder retrieves the C _i with obtaining r _i, x received as the _{r i (i-1),} y _(i-1) is input to the blind signature post-processing function calculator to calculate x _(i) and y _(i) , and these (C _i , x _(i) and y _(i) ) and other voters are calculated. (C _i , x _(i) , y _(i) ) calculated with respect to the information received from the device and the order are shuffled, and a number of shuffled (C _i , x _(i) , y _(i) ) are calculated as follows: It is sent to the device of the anonymous committee member U _{i + 1} , and the last anonymous committee member _UL device receives each received information ( _CL-1 , x
_(L-1) , y _(L-1) ) as a decoder and a blind signature post-processing function calculator to obtain a vote m and its signature x _(L), y _(L), and obtain (m, x _(L), y _(L) ) and a pair of voting and signatures from other voter devices (m, x _(L), y _(L) ) and a number of voting / signature pairs shuffled in order. (M, x
_(L), y _(L) ) to the tallyer's device, and the tallyer's device sends each voting / signature pair (m, x _(L), y
_(L) ) is input to a signature verification function calculator and verified, and votes that pass verification are totaled. 5. An integer L of two or more random numbers r ₁ , r ₂ ,.
means for generating r _L , means for inputting voting m and random numbers r ₁ , r ₂ ,..., r _L and performing blind signature pre- processing to obtain blind signature pre-processed information B; Means for combining the random numbers r ₁ , r ₂ ,..., R _L and multiply encrypting the voting m to obtain an encryption C _0, and means for transmitting the B and C ₀ to the election manager device. Voter device to have. 6. An i-th anonymous committee device, a plurality of which are connected in series between an election manager device and a tallyer device, wherein (i-1) th anonymous committee device _{sends a} cipher C _{i- 1} and signature σ
means for receiving the _i-1, means for determining a cryptographic C _i and the random number r _i by decrypting the encrypted C _i-1, with respect to the signature sigma _i-1 by using the random number r _i, blind signature post An anonymous committee device comprising: means for performing processing to obtain a signature σ _i; and means for transmitting the signature σ _i and the cipher C _i to the (i + 1) th anonymous committee device. 7. an integer greater than or equal to 2 L number of random number r _1, r _2, ...,
means for generating a r _L, voting m and the random number r _1, r _2, ..., voting means for determining a blind station name processed information B by performing a blind station name processing to input r _L, the first stage input m and r _L and the random number r _1, r _2, ..., transmitting means for obtaining the encryption C ₀ are multiplexed encrypted to vote m by sequentially input r _L, the B and the C ₀ to election officials device Means to do
For causing a computer to function as voter apparatus comprising
And a computer-readable recording medium recording the program. 8. In the i-th anonymous members device plurality is coupled in series between the totalizer device with election officials apparatus, a cipher C _i-1 from the (i-1) th anonymous members device Signature σ
means for receiving the _i-1, means for determining a cryptographic C _i and the random number r _i by decrypting the encrypted C _i-1, with respect to the signature sigma _i-1 by using the random number r _i, blind signature post means for determining a signature sigma _i subjected to a treatment, con as anonymous members and means for transmitting the signature sigma _i, the cryptographic C _i to (i + 1) th anonymous members device
Con recording a program for causing function computer
A computer-readable recording medium.