JP3434251B2 - Message recovery type signature system and program recording medium thereof - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is used for safely distributing electronic documents in a telecommunications system, and sends only a signature without sending the document and the signature for the document, The present invention relates to a message recovery signature system capable of recovering a document and its program recording medium.

[0002]

2. Description of the Related Art The conventional message recovery signature method is based on RSA.
The signature method will be described as an example. Let N be the product of large prime numbers p and q, and let e and d be e · d≡1 (mod LCM (p-1, q
-1)). However, LCM (p-1,
q-1) is the greatest common divisor of p-1 and q-1. (E,
Let N) be a public key and (d, N) be a secret key. Using the hash function H as an input for a message with an arbitrary number of bits,
A function that outputs a k _1- bit hash value. The number of bits of N is n. The notation [a] _b indicates a bit string consisting of lower b bits of a, and similarly, [a] ^b indicates a bit string consisting of higher b bits.

The signer creates a message recovery signature for the document m of n−k ₁ bits or less by the following procedure. 1. Input m to the hash function H and calculate H (m). 2. Let M: = H (m) | m. However, a || b means the bit combination of a and b.

3. Compute s: = M ^d mod N. Above s
Is the signature for m. The verifier who received the signature s
According to the following procedure, the signature is verified and the document m is obtained. 1. Compute M ': = s ^e mod N.

2. m ′: = [M ′] _n-k1 and H
Calculate (m '). 3. Check if [M '] ^k1 is equal to H (m'). If they are equal, it is considered as a correct signature, and if they are not equal, it is concluded as an incorrect signature. 4. If the signature is correct, let [M '] _n-k1 be the document m.

[0006]

In the above-mentioned conventional method, m is included in a part of the message M after the hash process, and therefore the signature requester (the person who inputs m to the signer) arbitrarily selects this part. It is easy to operate, that is, operate on m in M before generating the signature s by the signature key d for M, and set it to a value convenient for some fraudulent act. That is, the selected plaintext attack may be effective against the above conventional method.

The signature method used in a situation where the signer is required to issue a signature for an arbitrary message is desired to be a strong signature method against a selective plaintext attack. Be done. The purpose of this invention is
It is an object to provide a message recovery type signature system that is resistant to selective plaintext attacks and its program recording medium.

[0008]

In a calculation of signature generation using a signature key, an input to the calculation does not include a portion that a signature requester can arbitrarily operate. k for _one bit of input, using the hash function G with n-k _1-bit output, M: = H (m) ‖ {G (H (m))
By setting (+) m}, the influence of the hash function is applied to all bits of M. A (+) B represents an exclusive OR operation of A and B. A signature is generated and calculated for this M using a signature key. Since the hash function affects all the bits of the value of M, and it is difficult to operate the value of m to obtain a convenient hash value. Cannot be the desired convenient value.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiment 1 In the first embodiment of the present invention, a message recovery type signature system based on an RSA signature will be described. Let N be the product of large prime numbers p and q, and let e and d be e · d≡1 (mod LC
It is a number that satisfies M (p-1, q-1)). However, L
CM (p-1, q-1) is the greatest common divisor of p-1 and q-1. Let the (e, N) pair be the public key X, the (d, N) pair be the secret key Y, and the number of bits of N be n.

A block diagram of a message recovery signature device is shown in FIG. The message recovery signature device 11 includes an encoder 12 for making the message m redundant and randomized, and
A signer 13 that calculates a signature using a private key is provided.
The message recovery signature device 11 receives the message m and
With the private key X as input, execute the following procedure. Input m to the encoder 12 and obtain the encoded message M and m _s which is a part of m. The signer 13 cannot process M having n bits or more. That is, the number of bits of the message that can be recovered from the signature is k ₂ , and k ₂
The longer message m encodes its k ₂ bits to M
And output the rest as m _s . k ₂ will be described later.

The secret key X and the encoded message M read from the storage device 14 are input to the signer 13,
The signature s is obtained and (s, m _s ) is output from the transmitter 15.
FIG. 2 shows a block diagram of the encoder 12. Encoder 12
Has hash units 21 and 22, a bit slicing unit 23, an exclusive OR unit 24, and a bit embedding unit 25. For the input message m, the encoder 12 operates as follows.

Input m to the hash device 21 to obtain a hash value m ₁ = H (m) of k ₁ bits. Input m ₁ into the hash device 22 to obtain a k ₂ -bit hash value G (m ₁ ).・ Input m to the bit slicing device 23, and the part m of k ₂ bit
Divide into _r and the remaining part m _s . If m is less than or equal to k ₂ bits, m _s is an empty bit string and nothing is included.

.G (m₁) And m_rExclusive OR
24, and the output is m₂And ・ M₁And m₂Input to the bit embedder 25 and
K₁+ K₂The bit output value M is output. However,
Bit width k₁, K₂Is the number of bits of public information N is n
K₁+ K ₂= N is satisfied.

The bit slicing device 23 sets the value obtained by combining the k ₂ bits collected from the predetermined arbitrary bit positions with respect to the input as m _r . For example, k ₂ bits from the beginning of the input may be set as m _r, and all the remaining bits may be set as m _s for output. The bit embedding device 25 causes m ₂ to interrupt each bit of m _{1 at} a predetermined arbitrary inter-bit position to create an output of k ₁ + k ₂ bits. For example, simply m
Immediately after ₁ , all the bits of m ₂ may be output as a value.

FIG. 5 shows a block diagram of the signer 13 based on the RSA signature. The signer 13 here includes a modular exponentiation calculator 51, and a secret key (d, N) and an encoder 12
The output M is input, and s: = M ^d mod N is calculated and output. The verifier receiving the signature (s, _ms ) drives the message recovery signature verification device to verify the signature. FIG. 3 shows a block diagram of the message recovery signature verification device 31.
The message recovery signature verification device 31 uses the signature (s, m _s )
A message recovering device 32 for recovering the redundant and randomized message from the above, and a decoder 33 for removing the random component of the message and verifying the correctness of the redundancy. The signature (s, m _s ) and the public key Y are input, and the operation is as follows.

The signature (s,
_{s in} m _s ) and the public key Y read from the storage device 35
To the message recoverer 32 to obtain the encoded message M. Input M and m _s to the decoder 33, output the original message m if M has the correct redundancy,
Otherwise, it outputs NG.

FIG. 6 shows message recovery based on RSA signature.
The block diagram of the container 32 is shown. This message recovery device 32
Has a modular exponentiation unit 61, and a public key (e, N)
And s as input, M: = s^emod N is calculated and output
To do. The decoder 33 is a bit embedder 4 as shown in FIG.
1, hash device 42, 43, bit cutout device 44, exclusive
The logical OR device 45 and the comparator 46 are provided. Bit embedder 4
1 is a reverse operation of the bit slicing device 23 included in the encoder 12.
Do That is, k₂Bit input m'and arbitrary length
Input m_sOn the other hand, the bit cutting device 23 is_rCut from m
M at the protruding bit position_rTo return m_sTo m_r′
Embed each bit of. For example, if the bit cutting device 23
From the beginning of input to k₂If you cut out a bit,
The potting device 41 is m_r′ Is m_sThe result of joining to the beginning of
Is output. Similarly, the bit slicing device 44 is used by the encoder 1
The bit embedding device 25 included in 2 performs the reverse operation. That is,
k₁+ K₂For bit input, the bit embedder 25
₂To m₁From the bit position where₁Collect bits
Result of bit combination ₁'And the remaining k₂bit
The result of bit combination of m₂Output as'. example
If the bit embedder 25 is simply k₁Immediately after entering a bit
To k₂If the result of combining the input of bits is output,
The bit clipper 44 is k from the beginning of the input₁Bit
m₁Output as ′ and input k₁Bit after m₂'When
And output.

For the input message m, the decoder 33
Works as follows. -Input M to the bit slicing device 44 and output k ₁ bit m
₁ 'and k ₂ bit output m _2' obtained. Input m ₁ ′ to the hash unit 43 to obtain a k ₂ -bit hash value G (m ₁ ′).

Input m ₂ ′ and G (m ₁ ′) to the exclusive OR device 45, and _{let the} output be m _r ′. Input m _s and m _r ′ into the bit embedder 41, and k ₁
Obtain the output m'of + k ₂ bits. Input m'to the hash device 42 and output k ₁ bit H
Get (m ').

[0020] · H (m ') type and m _1' to the comparator 46, equal, outputs m 'if that is M is correct, if not equal outputs NG. The hash circuits 21, 42 and 22, 43 may use the same circuit. Instead of the exclusive OR device 24, a k ₂ -bit adder (or subtractor) may be used. In that case, the exclusive OR device 45 uses a k ₂ -bit subtracter (or adder). In other words, this arithmetic unit may perform group operation, and the signature verification side may perform group operation so as to obtain the state before the group operation performed on the signature side. Example 2 This example describes a message recovery type signature method based on the discrete logarithm problem.

It is assumed that p and q are large prime numbers and that q divides p-1. Let g be the element of order q in Z _p . It is assumed that xεZ _q ^* and yεZ _p ^* are values satisfying y = g ^−x mod _p . The public key Y is Y: = (y, g, p, q),
Let the secret key X be X: = (x, g, p, q). Z _p is 0
~ P-1 set of integers, Z _q ^* represents a set of 1 to p-1 integers.

The configurations of the message recovery signature device and the message recovery signature verification device are shown in FIG.
It is the same as FIG. The configurations of the encoder and the decoder are the same as those in FIGS. 2 and 4, respectively. However, in this embodiment, k ₁ + k ₂ is the number of bits of p. The configuration of the signature device will be described with reference to FIG. This signature device 71
Is a random number generator 72, a modular exponentiation calculator 73, an exclusive OR unit 74, a hash unit 75, and a modular exponentiation adder 76.
It is equipped with. It operates as follows for inputs X and M.

1. q is input to the random number generator 72, and the random number r
Generate εZ _q . 2. The generated random number r, g, p is used as a modular exponentiation operator 7
3 is input and g ^r mod ^p is obtained. 3. Inputs the output of the power residue arithmetic unit 73, and M to the exclusive OR circuit 74, T: = obtain ^{M (+) (g r mod} p). A (+) B indicates an exclusive OR operation of A and B.

4. The T is input to the hash device 75 to obtain the hash value c. 5. x, q, c and r are input to the modular exponentiation adder 76,
We obtain z: = cx + rmod q. 6. Output (T, z). The configuration of the message recovery device will be described with reference to FIG. This message recovery unit 81
The hash calculator 82, the modular exponentiation calculator 83, and the exclusive OR calculator 84 are provided. It operates as follows for inputs s and Y.

1. The T is input to the hash device 82 to obtain the hash value c. 2. The g, p, y, z and the output c of the hash unit 82 are input to the modular exponentiation calculator 83, and g ^z y ^c mod p is calculated. 3. The output of the modular exponentiation unit 83 and T are input to the exclusive OR unit 84, and the result is output.

G if the input is a correct signature^zy^c=
g^{cx + r}(G^-x)^c= G^rTherefore, T (+) g^zy^c
mod p = M (+) g^rmod p (+) g^rmod p = M
The original redundant message is obtained. Example 3 In this example, a message based on the elliptic discrete logarithm problem
The recovery type signature method will be described. Let q be a prime number and E be a finite field
F_qLet the upper elliptic curve. divide p by the number of rational points on E
Let it be a prime number. Let n be the number of bits of q. g on E
Let q be the point of order q. x ∈ Z_qIs a secret key, and y (=-
x.g) is the public key. Notation, (a) _xIs a point on E
It shall represent the x coordinate of a.

The configurations of the message recovery signature device and the message recovery signature verification device are shown in FIG.
It is the same as FIG. The configurations of the encoder and the decoder are the same as those in FIGS. 2 and 4, respectively. However, in this embodiment, k ₁ + k ₂ is the number of bits of q. The configuration of the signature device is similar to that of FIG. However, the modular exponentiation calculator 73 is a scalar multiplication calculator. The scalar multiplication unit is a unit that inputs a rational point and an integer value on an elliptic curve and outputs the x coordinate of a point that is a scalar multiple of the rational point. The operation of the signer will be described below.

1. q is input to the random number generator 72, and the random number r
Generate εZ _q . 2. The generated random numbers r, g, p are scalar multiplication unit 7
Input 3 and get the x coordinate of rg. 3. The output of the scalar multiplication unit 73 and M are input to the exclusive OR unit 74 to obtain the output T.

4. The T is input to the hash device 75 to obtain the hash value c. 5. x, q, c and r are input to the modular exponentiation adder 76,
We obtain z: = cx + rmod q. 6. Output (T, z). The configuration of the message recovery device is also similar to that of FIG. 8, but the modular exponentiation calculator 83 is a scalar multiplication calculator. The scalar multiplication calculator 83 here calculates (zg + cy) for the inputs g, q, y, and z by scalar multiplication and addition on an elliptic curve, and outputs the x coordinate thereof. For inputs s and Y, the message recoverer operates as follows.

1. The T is input to the hash device 82 to obtain the hash value c. 2. The g, q, y, z and the output c of the hash unit 82 are input to the scalar multiplication unit 83. 3. The output of the scalar multiplication unit 83 and T are input to the exclusive OR unit 84, and the result is output as M.

In the above, the message recovery signature device,
Each of the message recovery signature verification devices can be made to function by causing a computer to explain and execute a program.

[0032]

The hash functions H and G are ideal runs.
Assuming dumbness, m in M _rIs randomized
M to m_rThe signature is difficult to estimate
If the requester arbitrarily selects m, there is H (m).
Iha G (H (m)) (+) m_rA convenient value for the attacker
Is difficult to manipulate, and therefore a selective plaintext attack
It becomes possible to prevent it.

[Brief description of drawings]

FIG. 1 is a block diagram showing a functional configuration of a message recovery signature device.

FIG. 2 is a block diagram showing a functional configuration of an encoder 12 in FIG.

FIG. 3 is a block diagram showing a functional configuration of a message recovery signature verification device.

4 is a block diagram showing a functional configuration of a decoder 33 in FIG.

FIG. 5 is a block diagram showing an RSA signer.

FIG. 6 is a block diagram illustrating an RSA message recovery device.

FIG. 7 is a block diagram showing a functional configuration of a discrete logarithmic signature device.

FIG. 8 is a block diagram showing a functional configuration of a discrete logarithmic message recovery device.

─────────────────────────────────────────────────── ─── Continuation of the front page (56) References Japanese Patent Laid-Open No. 9-34357 (JP, A) The Exact Security of Digital Signatures- How to Sign with RSA and Rabbin, Lecture Notes, Inc., Inc. 1070, p. 399-316 Message Recovery for Signage Schemes based on the Discrete Logarithm Problem, Lecture No notes in Computer Science, Vol. 950, p. 182-193 (58) Fields investigated (Int.Cl. ⁷ , DB name) H04L 9/32 G09C 1/00 640 JISST file (JOIS)

Claims (3)

(57) [Claims] 1. A secret key, x is a public key, m is a document, a value determined by the number of bits of the public key y is n, and k is a key.
₁ and k ₂ are two integers such that k ₁ + k ₂ = n, and the message recovery signature device includes an encoder and a signer.
For the input m, x, the message recovery signature generator inputs m into the encoder to obtain its output M, m _s , inputs M, x into the signer to obtain its signature s, The message recovery signature verification device has a function of outputting s, m _s, and includes a message recovery device and a decryption device. For s, m _s received, s, y is input to the message recovery device and The output is M and M and m
Input _s to the decoder and m if M is the correct code
A message recovery type signature system that outputs, the encoder k for _two bits longer than the input m, a result of the bit combination are cut out k ₂ bits from predetermined bit positions m and m _{r, Let} m _s be the result of bit-combining the cut-out remaining portions and output m _r and m _s . If the input m is k ₂ bits or less, m _r = m and m _s is an empty character string. Hash value of k ₁ bit m ₁ =
Group of a first hash for outputting a H (m), and the second hash for outputting the m ₁ is inputted k ₂ bits of the hash value G (m _1), G and (m ₁₎ and m _r a first calculator for outputting m ₂ performs operation, and bit embedding bonded together and m ₁ and m ₂ k ₁ + k ₂
A bit embedder for outputting M of bits, wherein the decoder has a first bit embedder m ₂ for the input M.
A second bit slicing device which collects the k ₁ bits from the bit position in which m ₁ is embedded and outputs the result of bit combining as m ₁ ′, and outputs the result of bit combining the remaining k ₂ bits as m ₂ ′, A third hash unit, which receives k ₁ -bit m ₁ ′ and outputs k ₂ -bit hash value G (m ₁ ′), performs a group operation on m ₂ ′ and G (m ₁ ′) to obtain k 'a second arithmetic unit for outputting the input m _r' of ₂ bits m _r to, m _s, m _s is if not the empty string, the first bit cutting device is cut out with respect to m _s Output m'which is the result of embedding m _r 'in the bit position,
When m _s is an empty character string, the second embedder that outputs m _r ′ as m ′ and the output m ′ of the second embedder are input and the hash value H (m ′) of k ₁ bit is input. message recovery type signature system and a fourth hash unit, is equal to compare and H (m ') and m _1' is characterized by comprising a comparator for outputting the m 'as a recovery message m to be output . 2. An encoder for processing an input document m to output an n-bit encoded document M and a remaining document m _s , and the code.
Document M the station you output the signature s and signature process with the private key x
It consists of a famous device , where n depends on the number of bits of the public key y.
Is determined by the following equation, and k ₁ and k ₂ are k ₁ + k ₂ = n
And two integer values, if the encoder m is longer than k ₂ bits, and the result m _r where bit connecting cut the k ₂ bits from a predetermined bit position of m, and cut out by the remaining portion The remaining documents m _s are output by bit-combining, and when m is k ₂ bits or less, m _r = m, and m _s is a bit segmenter that is an empty character string, and m is a hash function operation to calculate k ₁ Bit hash value m ₁
= H a first hash device to obtain the (m), and a hash function computes the m ₁ k ₂ bit hash value G
(M ₁₎ and the second hash unit obtaining performs bit embedded together with calculator and m ₁ and m ₂ for performing group operation to output a m ₂ of G and (m ₁₎ and m _r, the M message recovery signature instrumentation and a bit embedder which <br/> output as
A program for operating a computer
A recorded computer-readable recording medium. 3. A was treated with the public key y of the input signature s Rume message restorer to restore the encoded document M, is input
And than the remaining document m _s and the encoded document M, becomes more and decoder for outputting a recovered document m when the M is correct <br/> have the decoder predetermined location M of n bits 'and, cut out by the remaining m ₂ of k ₂ bits by bit-binding portion "m ₁ that bit combination is cut out k ₁ bits of the bit cutting device for outputting and, where n is the public key y Number of bits
And k ₁ and k ₂ are k ₁ + k ₂ = n
Become an integer, a first hash device to obtain a '(k ₂ bits of the hash value G m ₁₎ and hash function operation the' m _1, the group operation 'and G (m _1' m ₂ and) m _r go 'and bit embedder obtaining, m' m by interrupting each bit of 'a calculator to obtain, m _r to a predetermined bit position between the m _s' to the hash function computes the k _1- bit hash value H
'A second hash device to obtain, H (m (m)''compared with the, if equal, m') and m ₁ message and a comparator for outputting as a recovery document m
To make a computer function as a recovery signature verification device
A computer-readable record of the program
Recording medium.