JP4577720B2 - Partial blind signature / verification / tracking method and system - Google Patents

Description

  The present invention is an application technique of an electronic signature, and particularly relates to a function expansion technique of a signature scheme for the purpose of concealing a signature target document from a signer, which is called a blind signature scheme.

  As a signature technique for achieving both privacy protection and fraud prevention of a signature requester, a blind signature method having a signature requester tracking function is known (for example, Non-Patent Document 1). This is called Fair Blind Signature (FBS), which is an extension of a technology called blind signature that allows a signer to give a signer a signature request with the signer lying down. Only (disclosing institution) is a technology that can identify a signature requester from a specific signed document generated by a blind signature, or can identify a signed document corresponding to a specific signature requester. Recently, there has also been proposed a method in which certain safety of FBS is proved (Non-Patent Document 2).

  Further, the signer is a CA (Certificate Aithority), the signature request document is a signature public key, and the signature requester uses the FBS to issue a key certificate to the CA without knowing the signature public key. Thus, a method is proposed in which the CA cannot know the correspondence between the signature requester and the signature public key unless it cooperates with the disclosure organization (Non-patent Document 3). By using such an authority distribution method, it is possible to expect an effect of improving the reliability of the service provider (= CA, disclosure organization) from the viewpoint of the user (= signing requester) and preventing information leakage of the service provider.

M.M. Stadler, J .; M.M. Piveteau, and J.M. Camenisch, “Fair blind signatures,” EUROCRYPT '95, LNCS 921, pp. 209-219, Spinger Verlag, 1995 M.M. Abe and M. Ohkubo, “Provably secure fair blind signatures with tight revocation,” ASIA CRYOT '01, LNCS 2248, pp. 583-601, Spinger Verlag, 2001 Senda, Taniguchi, Iono Shiono, Kanai “Anonymous Authentication Method Using Proxy Access” IPSJ Report Vol. 2005, No. 33, pp. 235-240, 2005

  It is considered that a method in which the FBS as described above is applied to the issuance of a key certificate desirably describes open information such as an expiration date and user attributes in the key certificate. For example, X.I., which is a key certificate specification established by the ITU (International Telecommunication Union). The 509v3 certificate format includes information such as version information, certificate number, and signature algorithm. Hereinafter, open information embedded in this type of key certificate is referred to as Info. However, a blind signature method that embeds information open to a signer, a signature requester, and a verifier in a signature request document and has a tracking function has not been proposed so far.

The present invention has been made in view of such circumstances. The blind signature (FBS) having a tracking function is expanded to a partial blind signature (PBS), and the signer opens Info as a key certificate. It is an object to provide a partial blind signature / verification / tracking method and system having a tracking function that can be described as simple information.

  Partial blind signature (PBS) is a technology that allows a signer to request a partially obfuscated document. Regarding this, for example, the document “M. Abe and T. Okamato,“ Probably secure partially blind signatures, ”CRYPTO, '00, LNCS 1880, pp. 271-286, Springer Verlag, 2000” (hereinafter, Non-Patent Document 4). Is described in detail.

In the present invention, FBS is extended to PBS, and a group element used in an arbitrary blind signature is generated by using open information Info. For example, in the FBS proposed in Non-Patent Document 4, p and q are prime numbers, H ₁ (·) is a hash function that maps from an arbitrary bit string to a group Z _p ^* , and g, h, and y are Z _p ^* . Originally, the signer generates z = H ₁ (p‖q‖g‖h‖y) (‖ represents data concatenation), but in the present invention, z = H ₁ (p‖q‖g‖) h‖y‖Info), or by generating any one of g, h, and y by a similar operation, the FBS of Non-Patent Document 4 can be made PBS.

  In addition, the present invention does not constitute a group element including Info as described above, but uses a protocol so that Info is used in signature issuing processing and signature verification processing using Info determined in advance as a constant. By changing, the FBS is expanded to PBS.

  According to the present invention, it is possible to generate a blind signature that includes open information designated by a signer and the like and has a tracking function. As a result, a more flexible operation of the key certificate issuance method using a blind signature having a tracking function is possible.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Although the present invention extends the blind signature (FBS) having a tracking function to the partial blind signature (PBS), the following first and second embodiments are preferable because it is desirable to have high security. In both cases, an example of extending to PBS based on FBS proposed in Non-Patent Document 2 (a certain kind of safety is guaranteed) will be described. However, it is needless to say that the extension of the present invention is not limited to the FBS of Non-Patent Document 2, and can be easily applied to other FBSs.

[First Embodiment]
This embodiment generates a blind signature that includes open information Info specified by a signer and has a tracking function. In the following, for an FBS proposed in Non-Patent Document 2, A method of adding a PBS function by applying the PBS technique proposed in Non-Patent Document 4 will be described with reference to the drawings.

  FIG. 1 is a diagram showing a system configuration of the present embodiment, which includes a signature requesting device 10, a signature device 20, a verification device 30, a disclosure device (management device) 40, and a network 50 connecting these devices. The signature requesting device 10 includes a personal computer, a mobile terminal, a mobile phone, and any other device (user terminal device) operated by the user. The signature device 20, the verification device 30, and the disclosure device 40 are server devices, and the specific configuration thereof is the same as that of a so-called computer system.

It is assumed that the signature request device 10, the signature device 20, the verification device 30 , and the disclosure device 40 generate and share the FBS system parameter prm = (p, q, g, h). Here, p and q are prime numbers of q | p−1, and g and h are elements of the subgroup G of the order q of the multiplicative group Z _p ^* .

<Key generation>
The signature device 20 generates and stores a secret key x, and calculates a public key y = g ^x modp. Here, x is a random natural number of q or less. Further, the disclosure device 40 generates and stores a secret key rsk = (x _t , dk), and calculates a public key rpk = (y _t = g ^xt modp, ek). Here, _{x t} is q following a random natural number, ek, dk is verifiable encryption with each; a public key and a private key (VE Verifiable Encryption). A description and specific examples of VE are shown in Non-Patent Document 2. All devices 10-40 share y, rpk. The signature requesting apparatus 10 creates a private key / public key pair (Sk, PK) of an arbitrary signature scheme such as an RSA signature or a Schnorr signature. FIG. 1 shows information held by the devices 10 to 40 so far.

<Blind signature>
The signature requesting device 10 requests the signature device 20 to generate a PK key certificate. The key certificate generation process is almost the same as the FBS of Non-Patent Document 2, but the generation of the element z of G is different. In Non-Patent Document 2 FBS, z is generated as follows.
z = H ₁ (p‖q‖g‖h‖y)
Here, H ₁ is a one-way hash function that copies an arbitrary bit string p‖q‖g で h‖y to G. In the present embodiment, z is generated as follows in order to add a PBS function to the FBS.
z = H ₁ (p‖q‖g‖h‖y‖Info)

Here, Info is open information designated by the signature device 20. As for the embedding of Info, it is basically possible to embed Info for values other than z as long as it is an element that is not uniquely generated.

Based on the above, a procedure for the signature requesting apparatus 10 to acquire a PK key certificate will be described. FIG. 2 shows a detailed processing flow of key certificate generation in the present embodiment.
The signature requesting device 10 requests the signature device 20 to generate a key certificate (step 101). The signature device 20 returns a specific character string Info to the signature request device 10 (step 102). Further, the signature device 20 registers information (ID) for identifying the signature request device 10 (or the signature requester) (step 103).

The signature requesting apparatus 10 performs the following processing.
(A) A random natural number γ of q or less is selected as a blind coefficient (step 104).
(B) z = H ₁ (p‖q‖g‖h‖y‖Info), zu = z ^{1 / γ} , ξ = g ^γ , E = ε _ek (γ), P = Γ ((z _u , ξ ), Γ, ek) (step 105). Here, ε is an encryption function of verifiable cipher (VE), and E = ε _ek (γ) is a ciphertext obtained by encrypting γ with a public key ek using the VE function. Γ is a function for demonstrating zero knowledge to the signature device 20 that the plaintext (= γ) corresponding to E is equal to 1 / log _z z _u (= γ) and log _g ξ (= γ), and P is A predicate for the proof.
(C) Transmit (z _u , ξ, E, P) to the signature device 20 (step 106).

The signature device 20 that has received (z _u , ξ, E, P) from the signature request device 10 performs the following processing.
(A) Calculate z = H ₁ (p‖q‖g‖h‖y‖Info) and verify whether (z _u , ξ, E, P) is a correct result (step 107). If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature requesting apparatus 10 is illegal.
(B) Random natural numbers v, u, s ₁ , s ₂ , and d less than or equal to q are selected (step 108).
^{_{(C) z 1 = y t}} v, z 2 = z u / z 1, P s = Γ s (z 1, y t, v), a = g u, b 1 = g s1 z 1 d, b 2 = H ^s2 z ₂ ^d is calculated (step 109). Here, Γ _s is a function that proves to the signature requesting apparatus 10 that the value of log _yt z ₁ (= v) is known , and P _s is a predicate for the proof .
(D) (P _s , z ₁ , a, b ₁ , b ₂ ) is transmitted to the signature requesting device (step 110).
(E) ξ ^v is calculated (step 111).
(F) A set of (ID, ξ ^v ) indicating the correspondence between ID and ξ ^v is stored (step 112).

The signature requesting apparatus 10 that has received (P _s , z ₁ , a, b ₁ , b ₂ ) from the signature apparatus 20 performs the following processing.
(A) It is verified whether ( z ₁ , b ₁ , b ₂ ) is an element of G and whether (z ₁ , y _t , P _s ) is a correct result (step 113). If both are verification OK, the process proceeds to the next step, and if either one is NG, the process is terminated because the signature device is invalid.
(B) Random natural numbers t ₁ , t ₂ , t ₃ , t ₄ , t ₅ which are equal to or less than q are selected (step 114).
_{(C) ζ 1 = z 1} γ, ζ 2 = z / ζ 1, α = ag t1 y t2, β 1 = b 1 γ g t3 ζ 1 t5, β 2 = b 2 γ h t4 ζ 2 t5, ε = H ₂ (ζ ₁ ‖α‖β ₁ ‖β ₂ ‖PK), e = ε−t ₂ −t ₅ is calculated (step 115). Here, H ₂ is a one-way hash function that copies an arbitrary character string to a natural number of q or less.
(D) Send e to the signature device 20 (step 116).

The signature device 10 that has received e from the signature request device 10 performs the following processing.
(A) c = ed and r = u-cx are calculated (step 117).
(B) ((r, c, s ₁ , s ₂ , d) is transmitted to the signature requesting apparatus 10 (step 118).

The signature requesting apparatus 10 that has received (r, c, s ₁ , s ₂ , d) from the signature apparatus 20 performs the following processing.
(A) ρ = r + t ₁ , ω = c + t ₂ , σ ₁ = γs ₁ + t ₃ , σ ₂ = γs ₂ + t ₄ , δ = d + t ₅ are calculated (step 119).
(B) It is verified whether or not ω + δ = H ₂ (ζ ₁ ‖g ^ρ y ^ω ‖g ^σ ₁ ζ ₁ ^δ ‖ h ^σ ₂ ζ ₂ ^δ ‖ PK) holds (step 120). If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature device 20 is illegal.
(C) Σ = (ζ ₁ , ρ, ω, σ ₁ , σ ₂ , δ) is output as a certificate of PK (step 121).

<Signature verification>
The signature requesting device 10 that has obtained the PK certificate Σ = (ζ ₁ , ρ, ω, σ ₁ , σ ₂ , δ) from the signature device 20 generates a signature S for the message msg using (SK, PK). T = (S, PK, Info, Σ) is a set of signatures including the key certificate.

The signature verification is assumed to consist of validity verification of the PK key certificate and validity verification of the signature S of the message msg. FIG. 3 shows a processing flow of signature verification in the present embodiment.
The signature requesting apparatus 10 transmits msg, T to the verification apparatus 30 (step 201). Here, T = (S, PK, Info, Σ), and Σ = (ζ ₁ , ρ, ω, σ ₁ , σ ₂ , δ).

The verification apparatus 30 that has received (msg, T) from the signature request apparatus 10 performs the following processing.
(A) It is confirmed whether Info satisfies a predetermined condition (step 202). If it is OK, the process proceeds to the next step, and if it is NG, the process is terminated.
(B) z = H ₁ (p‖q‖g‖h‖y‖Info) is calculated (step 203).
(C) It is verified whether or not ω + δ = H ₂ (ζ ₁ ‖g ^ρ y ^ω ‖g ^σ ₁ ζ ₁ ^δ ‖ h ^{σ 2} (z / ζ ₁ ^δ ) ‖PK) holds (step 204). If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature device 20 is illegal.
(D) Using the signature scheme verification algorithm corresponding to PK, verify whether S is a correct msg signature (step 205). If the verification is NG, the signature device 20 is illegal.

  In the above processing, steps 202 to 204 are the validity verification of the key certificate of the PK, and step 205 is the validity verification of the signature S of the message msg.

<Signature tracking>
This is performed, for example, when the message msg is an invalid message and it is desired to specify the creator of the signature S of the message msg. FIG. 4 shows a processing flow of signature tracking in the present embodiment.
1. The verification device 30 transmits msg, T to the disclosure device 40 and the signature device 20 (step 301).
2. The disclosure apparatus 40 and the signature apparatus 20 perform the same verification process (FIG. 3) as the verification apparatus 30 and confirm that the verification is OK (step 302). If it is NG, the process is terminated.

3. The disclosure device 40 performs the following processing.
(A) I = ζ ₁ ^{1 / xt} is calculated (step 303).
(B) I is transmitted to the signature device 20 (step 304).

4). The signature device 20 that has received I from the disclosure device 40 performs the following processing.
(A) Find ξ ^v such that I = ξ ^v from the stored (ID, ξ ^v ) (step 305).
(B) from the ID corresponding to the xi] ^v, it identifies the signature request device that generated the signature S of msg (or signature requester) (step 306). Here, it is assumed that the signature requester.
(C) The identified signature requester is transmitted to the disclosure device 40 (step 307).
5). The disclosure device 40 transmits the signature requester sent from the signature device 20 to the verification device 30 (step 308).

  Thereby, only when the disclosure device 20 and the signature device 40 cooperate, it is possible to specify the signature requesting device (or the signature requester) that generated the signature S of the message msg.

[Second Embodiment]
In the present embodiment, for the FBS proposed in Non-Patent Document 2, the common information Info obtained by the signing device and the signature requesting device agreeing in advance is used as a constant in the signature issuance processing and signature verification processing. A method of adding the PBS function by making it necessary will be described.

The system configuration of this embodiment is the same as that of the first embodiment. As shown in FIG. 1, the signature requesting device 10, the signature device 20, the verification device 30, the disclosure device 40, and a network connecting these devices Consists of. In the signature request apparatus 10, the signature apparatus 20, the verification apparatus 30, and the disclosure apparatus 40, the FBS system parameter prm = (p, q, g, h) is generated and shared as in the first embodiment. Shall. Here, p and q are prime numbers of q | p−1, and g and h are elements of the subgroup G of the order q of the multiplicative group Z _p ^* .

<Key generation>
The signature device 20 generates and stores a secret key x, and calculates y = g ^x modp. Here, x is a random natural number of q or less. The disclosure apparatus 40 generates and stores a secret key rsk = (x _t , dk), and calculates rpk = (y _t = g ^xt (modp), ek). Here _{x t} is q following a random natural number, ek, dk is verifiable encryption with each; a public key and a private key (VE Verifiable Encryption). All devices 10-40 share y, rpk. The signature requesting apparatus 10 creates a private key / public key pair (SK, PK) of an arbitrary signature scheme such as an RSA signature or a Schnorr signature. Up to this point, the process is the same as in the first embodiment.

<Blind signature>
The signature requesting device 10 requests the signature device 20 to generate a PK key certificate. The key certificate generation process is the same as in the first embodiment, but the following changes may be made in the FBS signature issue process of Non-Patent Document 2.
z ₂ = z _u / z ₁ → z _u / z ₁ ^Info
ζ ₂ = z / ζ ₁ → z / ζ ₁ ^Info
ω + δ = H ((ζ ₁ ‖g ^ρ y ^ω ‖g ^σ1 ζ ₁ ^δ ‖h ^σ2 (z / ζ ₁ ) ^δ ‖ msg)
→ H ((ζ ₁ ‖g ^ρ y ^ω ‖g ^σ1 ζ ₁ ^δ ‖h ^σ2 (z / ζ ₁ ^info ) ^δ ‖ msg)

In the following, a procedure for the signature requesting apparatus 10 to acquire a PK key certificate will be described based on the above changes. The processing flow is the same as in FIG.
The signature requesting device 10 requests the signature device 20 to generate a key certificate. The signature device 20 returns a specific character string Info to the signature request device 10. Here, Info is a natural number of q or less. The signature device 20 registers information (ID) for identifying the signature request device 10 (or the signature requester).

The signature requesting apparatus 10 performs the following processing.
(A) A random natural number γ (blind coefficient) of q or less is selected.
(B) z = H ₁ (p‖q‖g‖h‖y), z _u = z ^{1 / γ} , ξ = g ^γ , E = ε _ek (γ), P = Γ ((z _u , ξ) , Γ, ek). Here, ε is a VE encryption function, and in particular, E = ε _ek (γ) is a ciphertext obtained by encrypting γ with the public key ek using the VE function. Γ is a function for proving zero knowledge to the signature device 20 that the plaintext (= γ) corresponding to E is equal to 1 / log _z z _u (= γ) and log _g ξ (= γ), and in particular P Is a predicate for the proof.

(C) Send (z _u , ξ, E, P) to the signature device 20.

The signature device 20 that has received (z _u , ξ, E, P) from the signature request device 10 performs the following processing.
(A) Calculate z = H ₁ (p‖q‖g‖h‖y) and verify whether (z _u , ξ, E, P) is a correct result. If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature requesting apparatus 10 is illegal.
(B) Select random natural numbers v, u, s ₁ , s ₂ , and d that are less than or equal to q
^{_{(C) z 1 = y t}} v, z 2 = z u / z 1 Info, P s = Γ s (z 1, y t, v), a = g u, b 1 = g s1 z 1 d, b ₂ = h ^s2 z ₂ ^d is calculated. Here, Γ _s is a function for proving zero knowledge to the signature requesting apparatus 10 that the value of log _yt z ₁ (= v) is known , and P _s is a predicate for the proof .
(D) (P _s , z ₁ , a, b ₁ , b ₂ ) is transmitted to the signature requesting apparatus 10.
(E) ξ ^v is calculated.
(F) Save the set of (ID, ξ ^v ).

The signature request apparatus 10 that has received (P _s , z ₁ , a, b ₁ , b ₂ ) from the signature apparatus 20 performs the following processing.
(A) It is verified whether (z ₁ , b ₁ , b ₂ ) is an element of G and whether (z ₁ , y _t , P _s ) is a correct result. If both are verified OK, the process proceeds to the next step, and if either one is NG, the process is terminated because the signature device 20 is illegal.
(B) Random natural numbers t ₁ , t ₂ , t ₃ , t ₄ , t ₅ which are less than or equal to q are selected.
_{(C) ζ 1 = z 1} γ, ζ 2 = z / ζ 1 Info, α = ag t1 y t2, β 1 = b 1 γ g t3 ζ 1 t5, β 2 = b 2 γ h t4 ζ 2 t5, ε = (ζ ₁ ‖α‖β ₁ ‖β ₂ ‖PK), e = ε−t ₂ −t ₅ is calculated. Here, H ₂ is a one-way hash function that copies an arbitrary character string to a natural number of q or less.
(D) Send e to the signature device 20.

The signature device 20 that has received e from the signature request device 10 performs the following processing.
(A) Calculate c = ed, r = u−cx.
(B) (r, c, s ₁ , s ₂ , d) is transmitted to the signature requesting apparatus 10.

The signature requesting apparatus 10 that has received (r, c, s ₁ , s ₂ , d) from the signature apparatus 20 performs the following processing.
(A) ρ = r + t ₁ , ω = c + t ₂ , σ ₁ = γs ₁ + t ₃ , σ ₂ = γs ₂ + t ₄ , δ = d + t ₅ are calculated.
(B) It is verified whether or not ω + δ = H ₂ (ζ ₁ ‖g ^ρ y ^ω ‖g ^σ ₁ ζ ₁ ^δ ‖ h ^σ ₂ ζ ₂ ^δ ‖ PK). If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature device 20 is illegal.
(C) Σ = (ζ ₁ , ρ, ω, σ ₁ , σ ₂ , δ) is output as a certificate of PK.

<Signature verification>
FIG. 5 shows a processing flow of signature verification in the present embodiment. The signature requesting device 10 that has obtained the PK certificate Σ = (ζ ₁ , ρ, ω, σ ₁ , σ ₂ , δ) from the signature device 20 next uses the signature SSK for the message msg using (SK, PK). And T = (S, PK, Info, Σ) is a signature set including a key certificate.

  The signature requesting apparatus 10 transmits a message msg, T = (s, PK, info, Σ) to the verification apparatus 30 (step 401).

The verification device 30 that has received msg and T from the signature requesting device 10 performs the following processing.
(A) Check whether Info satisfies a predetermined condition (step 402). If it is OK, the process proceeds to the next step, and if it is NG, the process is terminated.
(B) z = H ₁ (p‖q‖g‖h‖y) is calculated (step 403).
(C) It is verified whether or not ω + δ = H ₂ (ζ ₁ ‖g ^ρ y ^ω ‖g ^σ ₁ ζ ₁ ^δ ‖ h ^{σ 2} (z / ζ ₁ ^Info ) ^δ ‖ PK) holds (step 404). If the verification is OK, the process proceeds to the next step, and if it is NG, the process is terminated because the signature device 20 is illegal.
(D) Using a signature method verification algorithm corresponding to PK, verify whether S is a correct signature of msg (step 405). If the verification is NG, the signature device 20 is illegal.

  In the above processing, steps 402 to 404 are the validity verification of the PK key certificate, and step 405 is the validity verification of the msg signature S.

<Signature tracking>
When it is determined that the message msg is an illegal message and the generator of the signature S of the msg is to be specified, the verification device 30 sends msg and T to the disclosure device 40 and the signature device 20. The disclosure device 40 and the signature device 20 input msg and T and perform the following processing.

1. The disclosure device 40 and the signature device 20 perform the same verification process (FIG. 5) as the verification device 30 and confirm that the verification is OK. If it is NG, the process is terminated.
2. The disclosure device 40 performs the following processing.
(A) Calculate I = ζ ₁ ^{1 / xt} .
(B) I is transmitted to the signature device 20.
3. The signature device 20 that has received I from the disclosure device 40 performs the following processing.
(A) Find ξ ^v such that I = ξ ^v from (ID, ξ ^v ).
(B) The signature requesting device (or signature requester) that generated the signature S of the message msg is identified from the ID corresponding to the ξ ^v .

  The above processing is the same as in FIG. Thereby, only when the disclosure device 40 and the signature device 30 cooperate, the signature requesting device (or the signature requester) that generated the signature S of the message msg can be specified.

  It is possible to implement the present invention by configuring a part or all of the processing functions of each device in the system configuration shown in FIG. 1 by a computer program and executing the program using the computer, or FIG. It goes without saying that the processing procedure shown in FIGS. 2 to 5 can be constituted by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

The figure which shows the system configuration | structure of embodiment of this invention. FIG. 5 is a process flow diagram of key certificate generation in the first embodiment. FIG. 6 is a processing flow diagram of signature verification in the first embodiment. FIG. 5 is a processing flow diagram of signature tracking in the first embodiment. FIG. 10 is a processing flow diagram of signature verification in the second embodiment.

DESCRIPTION OF SYMBOLS 10 Signature request apparatus 20 Signature apparatus 30 Verification apparatus 40 Disclosure apparatus 50 Network

Claims (3)

A signature requesting device, a signature device, a verification device, and a disclosure device;
The signature requesting device, the signature device, the verification device, and the disclosure device are respectively configured as blind signature system parameters prm = (p, q, g, h) (p, q is a prime number for q | p−1, g , H is group Z _p ^* Of the subgroup G of the order q of
The signing device generates a secret key x (x is a random natural number less than or equal to q), and a public key y = g ^x modp is calculated and x and y are held, and y is transmitted to the signature requesting device, the verification device, and the disclosure device so that each device holds y.
The disclosure device has a secret key rsk = (x _t , Dk) and public key rpk = (y _t = G ^xt modp, ek) (x _t Is a random natural number less than or equal to q, dk and ek are respectively a verifiable cryptographic private key and public key), rsk, rpk, and rpk is transmitted to the signature requesting device, the signature device, and the verification device Make each device hold rpk,
(1) The signature requesting device creates a private key / public key pair (Sk, PK) for signing, requests the signing device to generate a key certificate for the PK,
The signature device returns a specific character string Info to the signature requesting device and registers information (ID) for identifying the signature requesting device or the signature requester,
The signature requesting device randomly selects a natural number γ of g or less, and z = H ₁ (P‖q‖g‖h‖y‖Info) (H ₁ Is a one-way hash function that maps p‖q‖g‖h‖y‖Info, which is an arbitrary bit string, to G), z _u = Z ^{1 / γ} , Ξ = g ^γ , E = ε _ek (Γ) (ε _ek Is a function for encrypting γ with ek), P = Γ ((z _u , Ξ), γ, ek) (Γ is the plaintext corresponding to E (= γ) is 1 / log _z z _u (= Γ) and log _g a function to prove zero knowledge to the signing device that is equal to ξ (= γ), and (z _u , Ξ, E, P) to the signing device,
The signature device is z = H ₁ (P‖q‖g‖h‖y‖Info) is calculated and (z _u , Ξ, E, P) are correct, and if they are correct, natural numbers v, u, s below q ₁ , S ₂ , D are selected at random, z ₁ = Y _t ^v , Z ₂ = Z _u / Z ₁ , P _s = Γ _s (Z ₁ , Y _t , V) (Γ _s Is log _yt z ₁ (= Function to prove zero knowledge to the signature requesting device that the value of v is known), a = g ^u , B ₁ = G ^s1 z ₁ ^d , B ₂ = H ^s2 z ₂ ^d , Ξ ^v And calculate (P _s , Z ₁ , A, b ₁ , B ₂ ) To the signature requesting device, and (ID, ξ) ^v )
The signature requesting device is (z ₁ , B ₁ , B ₂ ) Is an element of G, (z ₁ , Y _t , P _s ) Is correct and (z ₁ , B ₁ , B ₂ ) Is an element of G, and (z ₁ , Y _t , P _s ) Is correct, natural number t less than or equal to q ₁ , T ₂ , T ₃ , T ₄ , T ₅ Randomly select ζ ₁ = Z ₁ ^γ , Ζ ₂ = Z / ζ ₁ , Α = ag ^t1 y ^t2 , Β ₁ = B ₁ ^γ g ^t3 ζ ₁ ^t5 , Β ₂ = B ₂ ^γ h ^t4 ζ ₂ ^t5 , Ε = H ₂ (Ζ ₁ ‖Α‖β ₁ ‖Β ₂ ‖PK) (H ₂ Is a one-way hash function that copies an arbitrary character string to a natural number of q or less), e = ε−t ₂ -T ₅ And sends e to the signing device;
The signature device calculates c = ed, r = u-cx, and (r, c, s ₁ , S ₂ , D) to the signature requesting device,
The signature requesting device has ρ = r + t ₁ , Ω = c + t ₂ , Σ ₁ = Γs ₁ + T ₃ , Σ ₂ = Γs ₂ + T ₄ , Δ = d + t ₅ And ω + δ = H ₂ (Ζ ₁ ‖G ^ρ y ^ω ‖G ^σ1 ζ ₁ ^δ ‖H ^σ2 ζ ₂ ^δ It is verified whether or not (成 り PK) holds, and if it holds, Σ = (ζ ₁ , Ρ, ω, σ ₁ , Σ ₂ , Δ) as a PK certificate,
(2) The signature requesting device generates a signature S for the message msg using (SK, PK), T = (S, PK, Info, Σ) as a signature set including a key certificate, and msg , T,
The verification device receives msg and T as input and checks whether Info satisfies a predetermined condition. ₁ (P‖q‖g‖h‖y‖Info) is calculated and ω + δ = H ₂ (Ζ ₁ ‖G ^ρ y ^ω ‖G ^σ1 ζ ₁ ^δ ‖H ^σ2 (z / ζ ₁ ) ^δ Verifies that） PK) holds, and if so, verifies that S is the correct signature of msg,
(3) The disclosure device and the signature device input msg and T,
The disclosed apparatus has I = ζ ₁ ^{1 / xt} And send I to the signing device,
The signature device is (ID, ξ ^v ) From the set I = ξ ^v Ξ such that ^v Find ξ ^v Identifying the signature requesting device or signature requester that generated the msg signature S from the ID corresponding to
A partial blind signature / verification / tracking method. A signature requesting device, a signature device, a verification device, and a disclosure device;
The signature requesting device, the signature device, the verification device, and the disclosure device are respectively configured as blind signature system parameters prm = (p, q, g, h) (p, q is a prime number for q | p−1, g , H is group Z _p ^* Of the subgroup G of the order q of
The signing device generates a secret key x (x is a random natural number less than or equal to q), and a public key y = g ^x modp is calculated and x and y are held, and y is transmitted to the signature requesting device, the verification device, and the disclosure device so that each device holds y.
The disclosure device has a secret key rsk = (x _t , Dk) and public key rpk = (y _t = G ^xt modp, ek) (x _t Is a random natural number less than or equal to q, dk and ek are respectively a verifiable cryptographic private key and public key), rsk, rpk, and rpk is transmitted to the signature requesting device, the signature device, and the verification device Make each device hold rpk,
(1) The signature requesting device creates a private key / public key pair (Sk, PK) for signing, requests the signing device to generate a key certificate for the PK,
The signature device returns a specific character string Info to the signature requesting device and registers information (ID) for identifying the signature requesting device or the signature requester,
The signature requesting device randomly selects a natural number γ of g or less, and z = H ₁ (P‖q‖g‖h‖y) (H ₁ Is a one-way hash function that copies p‖q‖g‖h‖y, which is an arbitrary bit string, to G), z _u = Z ^{1 / γ} , Ξ = g ^γ , E = ε _ek (Γ) (ε _ek Is a function for encrypting γ with ek), P = Γ ((z _u , Ξ), γ, ek) (Γ is the plaintext corresponding to E (= γ) is 1 / log _z z _u (= Γ) and log _g a function to prove zero knowledge to the signing device that is equal to ξ (= γ), and (z _u , Ξ, E, P) to the signing device,
The signature device is z = H ₁ (P‖q‖g‖h‖y) is calculated and (z _u , Ξ, E, P) are correct, and if they are correct, natural numbers v, u, s below q ₁ , S ₂ , D are selected at random, z ₁ = Y _t ^v , Z ₂ = Z _u / Z ₁ ^Info , P _s = Γ _s (Z ₁ , Y _t , V) (Γ _s Is log _yt z ₁ (= Function to prove zero knowledge to the signature requesting device that the value of v is known), a = g ^u , B ₁ = G ^s1 z ₁ ^d , B ₂ = H ^s2 z ₂ ^d , Ξ ^v And calculate (P _s , Z ₁ , A, b ₁ , B ₂ ) To the signature requesting device, and (ID, ξ ^v )
The signature requesting device is (z ₁ , B ₁ , B ₂ ) Is an element of G, (z ₁ , Y _t , P _s ) Is correct and (z ₁ , B ₁ , B ₂ ) Is an element of G, and (z ₁ , Y _t , P _s ) Is correct, natural number t less than or equal to q ₁ , T ₂ , T ₃ , T ₄ , T ₅ Randomly select ζ ₁ = Z ₁ ^γ , Ζ ₂ = Z / ζ ₁ ^Info , Α = ag ^t1 y ^t2 , Β ₁ = B ₁ ^γ g ^t3 ζ ₁ ^t5 , Β ₂ = B ₂ ^γ h ^t4 ζ ₂ ^t5 , Ε = H ₂ (Ζ ₁ ‖Α‖β ₁ ‖Β ₂ ‖PK) (H ₂ Is a one-way hash function that copies an arbitrary character string to a natural number of q or less), e = ε−t ₂ -T ₅ And sends e to the signing device;
The signature device calculates c = ed, r = u-cx, and (r, c, s ₁ , S ₂ , D) to the signature requesting device,
The signature requesting device has ρ = r + t ₁ , Ω = c + t ₂ , Σ ₁ = Γs ₁ + T ₃ , Σ ₂ = Γs ₂ + T ₄ , Δ = d + t ₅ And ω + δ = H ₂ (Ζ ₁ ‖G ^ρ y ^ω ‖G ^σ1 ζ ₁ ^δ ‖H ^σ2 ζ ₂ ^δ It is verified whether or not (成 り PK) holds, and if it holds, Σ = (ζ ₁ , Ρ, ω, σ ₁ , Σ ₂ , Δ) as a PK certificate,
(2) The signature requesting device generates a signature S for the message msg using (SK, PK), T = (S, PK, Info, Σ) as a signature set including a key certificate, and msg , T,
The verification device receives msg and T as input and checks whether Info satisfies a predetermined condition. ₁ (P‖q‖g‖h‖y) is calculated and ω + δ = H ₂ (Ζ ₁ ‖G ^ρ y ^ω ‖G ^σ1 ζ ₁ ^δ ‖H ^σ2 (z / ζ ₁ ^Info ) ^δ Verifies that） PK) holds, and if so, verifies that S is the correct signature of msg,
(3) The disclosure device and the signature device input msg and T,
The disclosed apparatus has I = ζ ₁ ^{1 / xt} And send I to the signing device,
The signature device is (ID, ξ ^v ) From the set I = ξ ^v Ξ such that ^v Find ξ ^v Identifying the signature requesting device or signature requester that generated the msg signature S from the ID corresponding to
A partial blind signature / verification / tracking method. A partial blind signature / verification / tracking system comprising a signature requesting device, a signature device, a verification device, and a disclosure device, wherein the partial blind signature / verification / tracking method according to claim 1 or 2 is implemented.

Images