JP4621075B2 - Verifier-designated signature generation apparatus, verifier-designated signature system, program, and recording medium thereof - Google Patents

Description

  The present invention relates to an application technology of information security technology, and particularly to the field of signature.

At present, verifier-designated signatures of various methods have been proposed (see, for example, Non-Patent Document 1 and Non-Patent Document 2). Here, the verifier-designated signature refers to a signature that can designate a signature verifier for verifying whether or not the signature is correct when the signature generator generates the signature. In other words, the signature verifier designated as the signature creator can verify the correctness of the verifier-designated signature (identify whether or not the signature is correct), but other parties cannot verify it. .
Proposed verifier-designated signature schemes include a scheme based on prime factorization difficulty (RSA type scheme), a scheme based on difficulty finding a discrete logarithm problem (Shnorr type scheme), and the like. In any case, in the signature generation process, information that cannot be obtained without using the designated signature verifier's private key (for example, the public key corresponding to the designated signature verifier's private key) and the signature generator The signature is generated using the private key. The basic configuration of a conventional verifier-designated signature is shown below.

[Key generation]
・ Signer generator key pair generation 1.Input: L-bit initial data (L is security parameter)
2. Output: Signature generator's (secret key, public key) = (xs, ys)
・ Signature verifier key pair generation 1.Input: L bit initial data (L is security parameter)
2. Output: Signature verifier's (secret key, public key) = (xc, yc)
[Signature generation]
For the message m (mε {0,1} ^* [m is data of any bit length in which each bit is 0 or 1]), the signature generator sends the message m, the signature generator's private key xs, and The verifier-designated signature σ is generated using the public key ys and the public key yc of the signature verifier to be designated.

[Signature verification]
The signature verifier designated as the signature generator receives the message m, the verifier-designated signature σ, the signature generator's public key ys, the signature verifier's public key yc, and the private key xc, and whether or not the verification formula holds. Verify that. The signature verifier recognizes that the received verifier-designated signature σ is correctly generated by the signature generator when the verification formula is satisfied.
[Any third party]
Any third party other than the signature verifier designated as the signature generator does not know the private key xc of the designated signature verifier. Therefore, this arbitrary third party cannot verify whether or not the verifier-designated signature σ has been generated by a valid signature generator. In addition, depending on the method, an arbitrary third party can verify that the verifier-designated signature σ is generated by either a valid signature generator or a signature verifier designated by it. However, even in this case, this arbitrary third party cannot identify which is the true signature generator.
D. Chaum, Private signature and proof systems, United States Patent 5,493,614, 1996. M. Jakobsson, K. Sato, R. Impagliazzo, "Designated verifier proofs and their application," EUROCRYPT '96, LNCS 1070, pp.143-154, Springer-Verlag, 1996.

As described above, in the conventional verifier-designated signature, a person other than the signature verifier designated as the signature creator cannot verify whether or not the signature is correctly generated by the signature creator. Can not.
In the case of such a signature, for example, even if some trouble occurs and the signature generator wants to prove that the verifier-designated signature is indeed generated by itself, the signature generator This cannot be proved to a third party other than the verifier.
The present invention has been made in view of the above points, and normally functions as a verifier-designated signature. However, when the signature creator desires, the signature creator surely created the verifier-designated signature. It is an object of the present invention to provide a signature technique that can prove to a third party other than a specific signature verifier.

  In the present invention, in order to solve the above-mentioned problem, a verifier-designated signature generation device that generates a verifier-designated signature that can be verified only by a specific signature verifier, and a third party used by a person other than the specific signature verifier A person terminal device is provided. The verifier-designated signature generation device includes a secret value storage memory for storing a secret value of a signature generator, a key storage memory for storing at least a signature generator private key and a specific signature verifier public key, a secret A verifier that can be verified only by a specific signature verifier using at least a hash value, a signature generator's private key, and a specific signature verifier's public key. For a person other than a specific signature verifier, a signature generation unit that generates a specified signature, a signature transmission unit that transmits a verifier-designated signature, and that a verifier-designated signature is generated by the verifier-designated signature generation device. And a secret value transmission unit that transmits a secret value. In addition, the third-party terminal device, at least a signature receiving unit that receives a verifier-designated signature, a secret value receiving unit that receives a secret value, a hash value of information that includes the secret value received by the secret value receiving unit, A self-certifying unit that uses the verifier-designated signature received by the signature receiving unit to determine whether the creator of the verifier-designated signature is valid.

  Here, a hash value of information including a secret value is used for the verifier-designated signature. This secret value is normally stored secretly to the outside by the verifier-designated signature generation apparatus that generated the signature. In addition, for the generation of the verifier-designated signature, a hash value of information including the secret value of the verifier-designated signature generation apparatus that generates the verifier is used. It is difficult to specify a secret value. That is, only the verifier-designated signature generation apparatus (and the signature generator that manages it) that has generated the verifier-designated signature can indicate this secret value. Therefore, in the third-party terminal device, by verifying the consistency between the hash value of the information including the received secret value and the verifier-designated signature, the verifier-designated signature generation device that presented the secret value It is possible to know whether or not a person-designated signature has been generated.

In the present invention, it is preferable that the verifier-designated signature generation device includes a secret value storage memory that stores a secret value of the signature generator, a parameter storage memory that stores parameters as, cc, sc, and g, and a signature generator. Key storage memory for storing the private key xs of the signature and the public key yc of the specific signature verifier, the message storage memory for storing the message m to be signed, and the first hash for calculating the hash value of the information including the secret value a calculation ^{unit, rc} = g sc · ^yc and modular multiplication unit for calculating a ^cc, rs ⁼ an exponent arithmetic unit for calculating the ^{g the as,} rs the hash value of the bit coupling value of rc and m C = H (rs, rc, m), a first subtraction unit for calculating cs = C-cc, a multiplication unit for calculating cs · xs, and a second for calculating ss = as−cs · xs. Subtraction and verification A signature generation unit that generates a designated signature σ = (C, cc, sc, cs, ss), a signature transmission unit that transmits a verifier-designated signature σ together with a message m, and a verifier-designated signature that generates the verifier-designated signature A secret value transmission unit that transmits a secret value when proving to a person other than a specific signature verifier that the device has generated the information, and at least one of the parameters as, cc, and sc is a first value This is a hash value of information including a secret value calculated by the hash calculation unit. In addition, the third-party terminal device includes at least a signature receiving unit that receives a verifier-designated signature σ = (C, cc, sc, cs, ss), a secret value receiving unit that receives a secret value, and a signature receiving unit. Using at least a part of cc, sc, ss of the received verifier-designated signature σ and the hash value of information including the secret value received by the secret value receiving unit, the creator of the verifier-designated signature σ is valid. And a self-certification unit for determining whether or not there is.

  More preferably, only one of the parameters cc and sc is a hash value of information including a secret value calculated by the first hash calculation unit of the verifier-designated signature generation device. Then, the self-certification unit of the third party terminal device includes cc of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiving unit and the secret value received by the secret value receiving unit. When the hash value of the information is equal, it is determined that the generator of the verifier-designated signature σ is valid, or the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiving unit When the sc and the hash value of the information including the secret value received by the secret value receiving unit are equal, the verifier-designated signature σ is determined to be valid. Thereby, even after the verifier-designated signature generation apparatus proves that the creator of the verifier-designated signature σ ′ is valid, the forgery difficulty of this signature can be maintained (details will be described later).

  More preferably, the first hash calculator of the verifier-designated signature generation device calculates a hash value of information including the secret value and the parameter sc as the parameter cc, or information of the information including the secret value and the parameter cc. A hash value is calculated as a parameter sc. Then, the self-certification unit of the third-party terminal device obtains cs of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiving unit and the secret value received by the secret value receiving unit. When the hash value of the information to be included is equal to the cc of the verifier-designated signature σ, it is determined that the creator of the verifier-designated signature σ is valid, or the verifier-designated signature σ = (C , Cc, sc, cs, ss) and the generator of the verifier-designated signature σ when the hash value of information including the secret value received by the secret-value receiving unit is equal to the cs of the verifier-designated signature σ. Is determined to be valid.

Preferably, in the present invention, the verifier-designated signature generation device includes a secret value storage memory for storing the signature generator's secret value seed, a signature generator's secret key xs and public key ys, n, and a specific signature verification. A key storage memory for storing the public key yc of the user, a message storage memory for storing the message m to be signed, a hash calculation unit for calculating a hash value cc of information including the secret value seed, and ac = cc ^ys mod an exponent operation unit that calculates n, and a first ciphertext generation unit that calculates a ciphertext e0 = E _yc (cc) obtained by encrypting the hash value cc with a public key cryptosystem using the public key yc of the signature verifier , Cc · m ^xs and the ciphertext e1 = E _yc (cc · m) obtained by encrypting cc · m ^xs with the public key cryptosystem using the first remainder multiplication unit for calculating cc · m ^xs and the public key yc of a specific signature verifier. ^xs A second ciphertext generation unit that calculates a ciphertext transmission unit that transmits (ac, e0, e1) to a specific signature verifier terminal device, and (ac, e0, e1) the challenge receiver for receiving B∈ {0, 1} which are sent from a particular signature verification of the terminal apparatus, and a second modular multiplication unit for calculating a ^{c = cc · (m xs)} b mod n, the verifier The signature generation unit that generates the designated signature σ = (ac, c, b), the signature transmission unit that transmits the verifier-designated signature σ together with the message m, and the verifier-designated signature are generated by the verifier-designated signature generation apparatus. And a secret value transmission unit that transmits a secret value seed when certifying to a person other than a specific signature verifier. The third-party terminal device also includes a key storage memory that stores the signature generator's public key ys, a signature receiver that receives at least a verifier-designated signature σ = (ac, c, b), and a secret value seed. When the ac value of the verifier-designated signature σ received by the signature receiver and the ac value of the hash value of the information including the secret value seed are equal to each other, the generator of the verifier-designated signature σ is valid. And a self-certifying part that judges that

Preferably, in the present invention, the verifier-designated signature generation device includes a secret value storage memory for storing a signature generator's secret value seed, a signature generator's secret key xs, and a specific signature verifier's public key yc. A key storage memory for storing the message m, a message storage memory for storing the message m to be signed, a hash calculation unit for calculating the hash value cc of the information including the secret value seed, and a first division for calculating ac = cc / yc Part, a first exponent operation part for calculating sc = ^mac , a subtraction part for calculating cs = xs-cc, a second division part for calculating as = cs / yc, and ss = ^mas A second exponent operation unit, a signature generation unit that generates a verifier-designated signature σ = (sc, ss), a signature transmission unit that transmits the verifier-designated signature σ together with the message m, and the verifier-designated signature Designated signature student That has been generated by the apparatus when the certificate to a person other than the specific signature verifier, and a secret value transmission unit that transmits the secret seed. In addition, the third-party terminal device includes a key storage memory that stores a public key yc of a specific signature verifier, a signature receiver that receives a verifier-designated signature σ = (sc, ss), and a message m, a secret When the secret value receiving unit that receives the value seed, the sc of the verifier-designated signature σ received by the signature receiving unit, and m ^A [A is (hash value of information including the secret value seed) / yc] And a self-certifying unit that judges that the creator of the verifier-designated signature σ is valid.

  In the present invention, a verifier-designated signature is generated by using a hash value of information including a secret value in the verifier-designated signature generation device, and the signature creator confirms that the signature creator has generated the verifier-designated signature. When certifying to a third party other than the verifier, the secret value used to generate the verifier-designated signature is disclosed. As a result, the third party verifies the consistency between the hash value of the information including the disclosed secret value and the verifier-designated signature, and the verifier-designated signature generation device that disclosed the secret value designates the verifier It is possible to know whether or not a signature has been generated. As a result, it normally functions as a verifier-designated signature, but when the signature generator desires, a third party other than a specific signature verifier confirms that the signature generator has indeed generated the verifier-designated signature. It is possible to construct a signature that can be proved.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Configuration>
FIG. 1 is a conceptual diagram illustrating the overall configuration of a verifier-designated signature system 1 according to this embodiment.
As illustrated in FIG. 1, a verifier-designated signature system 1 according to the present embodiment includes a verifier-designated signature generation device 10 that generates a verifier-designated signature that can be verified only by a specific signature verifier, and the specific signature verification. A signature verification device 20 used by a person and a third-party terminal device 30 used by a person other than the specific signature verifier. These devices are communicably connected through a network such as the Internet. Here, the verifier-designated signature generation device 10, the signature verification device 20, and the third-party terminal device 30 in this example are known Neumann type devices including a CPU (central processing unit), a RAM (Random Access Memory), and the like. It is constructed by executing a predetermined program on a computer.

  FIG. 2A is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 10 illustrated in FIG. As illustrated in this figure, the verifier-designated signature generation device 10 includes a secret value storage memory 11 for storing a secret value of the signature generator, at least a secret key of the signature generator, and a public key of a specific signature verifier. A key storage memory 12 for storing information, a hash calculation unit 13 for calculating a hash value of information including a secret value, at least a hash value, a secret key of a signature generator, and a public key of a specific signature verifier Generation unit 14 that generates a verifier-designated signature that can be verified only by the signature verifier, a signature transmission unit 15 that transmits the verifier-designated signature, and a verifier-designated signature are generated by the verifier-designated signature generation apparatus. A secret value transmission unit 16 that transmits a secret value and a control unit 17 that controls the entire verifier-designated signature generation device 10 when certifying to a person other than a specific signature verifier. Yes.

  FIG. 2B is a block diagram illustrating the configuration of the third party terminal device 30 illustrated in FIG. As illustrated in this figure, the third party terminal device 30 includes at least a signature receiving unit that receives a verifier-designated signature, a secret value receiving unit that receives a secret value, and a secret value received by the secret value receiving unit. A self-certification unit that determines whether or not the creator of the verifier-designated signature is valid using the hash value of the information to be included and the verifier-designated signature received by the signature receiver, and the third-party terminal device 30 And a control unit 34 for controlling the whole.

<Verifier-designated signature processing>
Next, a verifier designated signature process performed in the verifier designated signature generation apparatus 10 will be described.
First, the hash calculator 13 of the verifier-designated signature generation apparatus 10 reads the secret value from the secret value storage memory 11 and calculates the hash value. Next, the signature generation unit 14 uses at least the hash value calculated by the hash calculation unit 13, the signature generator's private key stored in the key storage memory 12, and the public key of the specific signature verifier, A verifier-designated signature that can be verified only by a specific signature verifier (in this example, only the signature verification device 20) is generated. Note that the verifier-designated signature in this example is configured such that, for example, some bits thereof are equal to the hash value calculated by the hash calculation unit 13.

  The verifier-designated signature generated in this way is transmitted from the signature transmission unit 15 to the signature verification device 20 via the network 40, for example, and the signature verification device 20 verifies the verifier-designated signature. As a result, the signature verification apparatus 20 can determine whether or not the verifier-designated signature has been generated by the verifier-designated signature generation apparatus 10. On the other hand, at this point in time, even if a device other than the signature verification device 20 (for example, the third-party terminal device 30) receives this verifier-designated signature, it has been generated by the verifier-designated signature generation device 10. I can't judge.

<Verifier-designated signature verification process by third party terminal device 30>
Next, the verifier designated signature verification process by the third party terminal device 30 will be described. As described above, normally, the third-party terminal device 30 cannot verify the verifier-designated signature. However, when the verifier-designated signature generation device 10 desires the third-party terminal device 30 to verify the verifier-designated signature generated by itself, first, a user of the verifier-designated signature generation device 10 (for example, a signature) The creator) inputs to the verifier-designated signature generation apparatus 10 an instruction to “instruct the third-party terminal device 30 to verify the verifier-designated signature”. This input is performed from an input device such as a keyboard (not shown). The control unit 17 uses the input as a trigger to give an instruction to the signature transmission unit 15, and the signature transmission unit 15 that has received this instruction transmits the verifier-designated signature generated by the signature generation unit 14 via the network 40. To the user terminal device 30. Further, the control unit 17 gives an instruction to the secret value transmission unit 16, and the secret value transmission unit 16 transmits the secret value stored in the secret value storage memory 11 to the third party terminal device 30 through the network 40.

  In the third party terminal device 30, the signature receiving unit 31 receives this verifier-designated signature and the secret value receiving unit 32 receives the secret value. Then, the self-certifying unit 33 uses the hash value of the information including the secret value received by the secret value receiving unit 32 and the verifier-designated signature received by the signature receiving unit 31, and the creator of the verifier-designated signature is Determine whether it is valid. Specifically, for example, when some bits of the verifier-designated signature generated by the signature generation unit 14 are equal to the hash value calculated by the hash calculation unit 13, the self-certification unit 33 determines that the signature reception unit 31 When some bits of the received verifier-designated signature are equal to the hash value of the information including the secret value received by the secret value receiving unit 32, it is determined that the creator of the verifier-designated signature is valid.

  Here, for generation of the verifier designated signature, a hash value of information including the secret value stored in the secret value storage memory 11 of the verifier designated signature generation apparatus 10 is used. It is difficult to specify this secret value only from the verifier-designated signature. That is, only the verifier-designated signature generation apparatus 10 that has generated the verifier-designated signature can indicate this secret value. Therefore, the third party terminal device 30 verifies the consistency between the hash value of the information including the received secret value and the verifier-designated signature, so that the verifier-designated signature generation device 10 presenting the secret value It is possible to know whether or not the verifier designated signature has been generated.

[Example 1]
Next, Example 1 of this embodiment will be described.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in the present embodiment, the verifier-designated signature generation device 110 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 120 is used as a specific example of the signature verification device 20, and the third-party terminal device 30 A case where the third party terminal device 130 is used will be described as a specific example.

<Verifier-designated signature generation apparatus 110>
FIG. 3 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 110 according to this embodiment.
As illustrated in FIG. 3, the verifier-designated signature generation device 110 in this example includes a CPU (Central Processing Unit) 111, an input unit 112, an auxiliary storage device 113, a ROM (Read Only Memory) 114, and a RAM (Random Access Memory). ) 115, communication unit 116, output unit 117, and bus 118.

  The CPU 111 in this example includes a control unit 111a, a calculation unit 111b, and a register 111c, and executes various calculation processes according to various programs read into the register 111c. The input unit 112 is an input port for inputting data, a keyboard, a mouse, and the like. The output unit 117 is an output port for outputting data, a display, and the like. The auxiliary storage device 113 is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, or the like, and a program that stores a program for causing the CPU 111 or the like to execute the process of the verifier-designated signature generation device 110 of this embodiment. It has an area 113a and a data area 113b in which various data such as secret values are stored. The RAM 115 is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), or the like, and has a program area 113a in which the above program is written and a data area 113b in which various data are stored. The bus 118 connects the CPU 111, the input unit 112, the output unit 117, the auxiliary storage device 113, the RAM 115, and the ROM 114 so that they can communicate with each other.

  The CPU 111 writes the program stored in the program area 113a of the auxiliary storage device 113 in the program area 115a of the RAM 115 in accordance with the read OS (Operating System) program. Similarly, the CPU 111 writes various data stored in the data area 113 b of the auxiliary storage device 113 into the data area 115 b of the RAM 115. The address on the RAM 115 where the program and data are written is stored in the register 111c of the CPU 111. The control unit 111a of the CPU 111 sequentially reads these addresses stored in the register 111c, reads a program and data from the area on the RAM 115 indicated by the read address, causes the calculation unit 111b to sequentially execute the calculation indicated by the program, The calculation result is stored in the register 111c.

FIG. 4 is a block diagram illustrating a functional configuration of the verifier-designated signature generation device 110 configured by reading the program into the CPU 111 in this way. In addition, although the arrow in FIG. 4 shows the flow of data, the arrow corresponding to the flow of data going into and out of the controller 110r is omitted (the same applies hereinafter).
As illustrated in FIG. 4, the verifier-designated signature generation device 110 of this example includes a secret value storage memory 110a, a parameter storage memory 110b, a key storage memory 110c, a message storage memory 110d, and a first hash calculation unit. 110e, remainder multiplication unit 110f, exponent operation unit 110g, second hash operation unit 110h, first subtraction unit 110i, multiplication unit 110j, second subtraction unit 110k, signature generation unit 110m, and signature transmission 110n, secret value transmission unit 110p, temporary memory 110q, and control unit 110r. The verifier-designated signature generation apparatus 110 executes each process under the control of the control unit 110r.

<Signature Verification Device 120>
The signature verification apparatus 120 has the same hardware configuration as that of the verifier-designated signature generation apparatus 110 (see FIG. 3). Then, a predetermined program is read into the CPU and executed, whereby a signature verification apparatus 120 as illustrated in FIG. 5 is configured.
As illustrated in this figure, the signature verification apparatus 120 of this example includes a parameter storage memory 121, a key storage memory 122, a signature reception unit 123, a temporary memory 124, a signature verification unit 125, and a control unit 126. have. In addition, the signature verification unit 125 includes a hash calculation unit 125a and a comparison unit 125b. Note that the signature verification apparatus 120 executes each process under the control of the control unit 126.

<Third-party terminal device 130>
Third-party terminal device 130 also has the same hardware configuration as verifier-designated signature generation device 110 (see FIG. 3). Then, a predetermined program is read into the CPU and executed, whereby the third party terminal device 130 illustrated in FIG. 6 is configured.
As illustrated in this figure, the third party terminal device 130 includes a signature receiving unit 131, a secret value receiving unit 132, a self-certifying unit 133, a temporary memory 134, and a control unit 135. Here, the self-certifying unit 133 includes a hash calculation unit 133a and a comparison unit 133b. The third party terminal device 130 executes each process under the control of the control unit 135.

<Pretreatment>
Two types of hash functions H and G: {0, 1} ^* → {0, 1} ^L are selected as pre-processing for signature generation / verification processing. In addition, as a hash function, SHA-1, MD5 etc. can be illustrated, for example. Further, {0, 1} ^* means all binary sequences, and {0, 1} ^L means a binary sequence having an L bit length. H (α) and G (α) mean results (hash values) obtained by applying hash functions H and G to α, respectively. These hash functions H and G are written in the code of a program for configuring the verifier-designated signature generation apparatus 110. Further, the hash function H is further written in a code of a program for configuring the signature verification apparatus 120, and the hash function G is written in a code of a program for configuring the third party terminal apparatus 130. And these programs are read by CPU as mentioned above, and the hash calculation in each apparatus is attained.

Also, the key pair of the private key xs and the public key ys of the verifier designated signature generation device 110 and the key pair of the private key xc and the public key yc of the signature verification device 120 are set. In this embodiment, a key pair similar to a Schnorr signature (see, for example, Tatsuaki Okamoto and Hiroshi Yamamoto, “Contemporary Cryptography”, 3rd edition, Sangyo Tosho, P182, etc.) based on the difficulty of solving discrete logarithm problems. Set. That is, when p and q are large prime numbers where q divides p-1 (q | p-1), Z _q is a cyclic subgroup of order _q of Z _q ^* , and g is a generator of Z _q The key pair of xsεZ _q , ys = g ^xs mod p and the key pair of xcεZ _q , yc = g ^xc mod p are set.

  The key storage memory 110c of the verifier-designated signature generation apparatus 110 stores the secret key xs of the verifier-designated signature generation apparatus 110 (the signature generator's private key) and the public key of the signature verification apparatus 120 thus set. yc (a public key of a specific signature verifier) is stored. Also, the key storage memory 122 of the signature verification device 120 stores the public key ys (public key of the signature generator) of the verifier-designated signature generation device 110 and the public key yc (public of a specific signature verifier) of the signature verification device 120. Key) is stored.

Further, an arbitrary secret value seed ∈ {0, 1} ^L is set in the signature generator, and it is stored securely (secretly with respect to the outside) in the secret value storage memory 110a. Further, the parameter as, scε {0, 1} ^L is set at random and stored in the parameter storage memory 110b. Further, the above-described parameter g (Z _q generation source) is also stored in the parameter storage memory 110b. Here, at least the parameter as is secret information. The parameter g is public information, and the parameter g is also stored in the parameter storage memory 121 of the signature verification apparatus 120.
Further, the message storage memory 110d of the verifier-designated signature generation apparatus 110 stores the message to be signed mε {0, 1} ^L.

<Verifier-designated signature processing>
Next, a verifier designated signature process performed in the verifier designated signature generation apparatus 110 will be described.
FIG. 7 is a flowchart for explaining the verifier-designated signature processing in the present embodiment. Hereinafter, the verifier designated signature process in the present embodiment will be described with reference to this figure. Unless otherwise specified, each data of each calculation process is stored in a memory such as a register and is read out as necessary (the same applies to each embodiment).

First, the first hash calculator 110e of the verifier-designated signature generation apparatus 110 reads the secret value seed from the secret value storage memory 110a, and calculates the hash value cc = G (seed) of the secret value seed (step S1). . The hash value cc calculated in this way is stored in the parameter storage memory 110b as a parameter cc. Next, the remainder multiplication unit 110f reads the parameters cc, sc, and g from the parameter storage memory 110b, and reads the public key yc from the key storage memory 110c. Then, the remainder multiplication unit 110f calculates rc = g ^sc · yc ^cc , and stores the calculation result rc in the temporary memory 110q (step S2). Next, the exponent calculation unit 110g, from the parameter storage memory 110b, reads the parameters the as, g, performs calculation of rs ^{= g the as,} and stores the calculation result rs in the temporary memory 110q (step S3). Next, in the second hash calculation unit 110h, rs and rc are read from the temporary memory 110q, and the message m is read from the message storage memory 110d. Then, the second hash calculation unit 110h calculates a hash value C = H (rs, rc, m) of the bit combination value of rs, rc, and m, and stores the hash value C in the temporary memory 110q (step). S4). The bit combination value means a combination of a bit string and a bit string. For example, when rs = 101, rc = 110, and m = 110, the bit combination value (rs, rc, m) of rs, rc, and m is 101110110. The order of the bit strings to be combined is not particularly limited to this, but the order must correspond to the bit combination in the hash calculation in the hash calculation unit 125a of the signature verification apparatus 120 (for details) Later).

  Next, in the first subtraction unit 110i, the hash value C is read from the temporary memory 110q, and the parameter cc is read from the parameter storage memory 110b. Then, the first subtraction unit 110i performs a calculation of cs = C-cc, and stores the calculation result in the temporary memory 110q (step S5). Next, the multiplication unit 110j reads cs from the temporary memory 110q and reads the secret key xs from the key storage memory 110c. Then, the multiplication unit 110j calculates cs · xs, and stores the calculation result in the temporary memory 110q (step S6). Next, the second subtraction unit 110k reads cs · xs from the temporary memory 110q, and reads the parameter as from the parameter storage memory 110b. Then, the second subtraction unit 110k performs an operation of ss = as−cs · xs and stores the operation result ss in the temporary memory 110q (step S7). Thereafter, in the signature generation unit 110m, C, cs, and ss are read from the temporary memory 110q, the parameters cc and sc are read from the parameter storage memory 110b, and the verifier-designated signature σ = (C, cc, sc, cs, ss) is obtained. Generate (step S8). The verifier designated signature σ generated in this way is sent to the signature transmission unit 110n, and the signature transmission unit 110n transmits the verifier designated signature σ together with the message m read from the message storage memory 110d through the network 40. (Step S9).

<Signature verification processing>
Next, a signature verification process in the signature verification apparatus 120 will be described.
FIG. 8 is a flowchart for explaining the signature verification processing of the signature verification apparatus 120 in this embodiment. The signature verification process will be described below with reference to this figure.
First, the signature verification apparatus 120 receives the verifier-designated signature σ = (C, cc, sc, cs, ss) and the message m, which are transmitted through the network 40 as described above, in the signature reception unit 123 (steps). S11). These are stored in the temporary memory 124. Next, in the hash calculation unit 125a of the signature verification unit 125, the message m and cc, sc, cs, and ss of the verifier designated signature σ are read from the temporary memory 124. Then, the hash calculation unit 125a calculates a hash value H (g ^ss · ys ^cs , g ^sc · yc ^cc , m) of these bit combination values (step S12). Note that the bit combination order of g ^ss · ys ^cs , g ^sc · yc ^cc, and m corresponds to the bit combination order of rs, rc, and m in the hash calculation of the second hash calculation unit 110h. . That is, g ^ss · ys ^cs is bit-coupled to the bit position of rs, and g ^sc · yc ^cc is bit-coupled to the bit position of rc. For example, when the bit combination order of rs, rc, and m in the hash calculation of the second hash calculation unit 110h is rs | rc | m, the bit combination order in the hash calculation unit 125a is g ^ss · ys ^cs | g ^sc Yc ^cc | m The calculated hash value H (g ^ss · ys ^cs , g ^sc · yc ^cc , m) is stored in the temporary memory 124.

Next, the comparison unit 125b of the signature verification unit 125 reads C, cs, and cc from the temporary memory 124, and determines whether or not C = cs + cc is satisfied (step S13). If C = cs + cc is not satisfied, the signature verification unit 125 outputs information indicating that the authentication has failed (step S14), and the control unit 126 ends the processing in the signature verification device 120. On the other hand, if it is determined that C = cs + cc, then the comparison unit 125b further reads the hash value H (g ^ss · ys ^cs , g ^sc · yc ^cc , m) from the temporary memory 124, and C = H. It is determined whether or not (g ^ss · ys ^cs , g ^sc · yc ^cc , m) (step S15). Here, if C = H (g ^ss · ys ^cs , g ^sc · yc ^cc , m), the signature verification unit 125 outputs information indicating that the authentication is unsuccessful (step S14), and the control unit 126 terminates the processing in the signature verification apparatus 120. On the other hand, if C = H (g ^ss · ys ^cs , g ^sc · yc ^cc , m), the signature verification unit 125 outputs information indicating that the authentication is successful (step S16), and the control unit 126. Ends the processing in the signature verification apparatus 120.

Note that the secret information of the signature verification apparatus 120 is not used for the signature verification process. Therefore, the signature verification process itself can be performed by an apparatus other than the signature verification apparatus 120. However, it can be said that the verification formulas in steps S13 and S15 hold only that the verifier-designated signature σ is generated in either the verifier-designated signature generation apparatus 110 or the signature verification apparatus 120 (this is true). It can be easily derived from the change of the expression and the application of the key pair conditions xs∈Z _q , ys = g ^xs mod p, xc∈Z _q , yc = g ^xc mod p). Here, since the user of the signature verification apparatus 120 knows that he / she has not generated the verifier-designated signature σ, the verifier-designated signature σ is surely verified when the verification formulas of steps S13 and S15 hold. It can be seen that it is generated by the person-designated signature generation apparatus 110. However, other third parties cannot identify whether the verifier-designated signature σ is generated by the verifier-designated signature generation device 110 or the signature verification device 120.

<Self-certification processing by the signer>
Next, a process in which the signer proves that the creator of the verifier-designated signature σ is himself / herself to a third party other than the specific signature verifier will be described.
FIG. 9 is a flowchart for explaining the self-certification processing in the present embodiment. This flowchart shows processing in the third party terminal device 130 used by a third party other than a specific signature verifier.
First, when proving to a third party other than a specific signature verifier that a verifier-designated signature has been generated by the verifier-designated signature generation apparatus 110, the user of the verifier-designated signature generation apparatus 110 An instruction to that effect is input from the input unit 112 (FIG. 3). With this as a trigger, the control unit 110r of the verifier-designated signature generation apparatus 110 gives an instruction to the secret value transmission unit 110p, the signature generation unit 110m, and the signature transmission unit 11n. On the other hand, the signature generation unit 110m generates a verifier-designated signature σ and transmits it to the third party terminal device 130 of the third party who performs the certification through the network 40 in the signature transmission unit 110n. Further, the secret value transmission unit 110p transmits the secret value seed stored in the secret value storage memory 110a to the third party terminal device 130 of the third party through the network 40. The verifier-designated signature σ and the secret value seed may be transmitted simultaneously, or the verifier-designated signature σ may be transmitted after transmitting the secret value seed. If the third-party terminal device 130 already stores the verifier-designated signature σ, the verifier-designated signature σ may not be transmitted again.

  The third party terminal device 130 receives the verifier-designated signature σ = (C, cc, sc, cs, ss) at the signature receiving unit 131 (step S21), and receives the secret value seed at the secret value receiving unit 132. (Step S22). The received verifier-designated signature σ and secret value seed are stored in the temporary memory 134. Next, the hash value calculation unit 133a of the self-certification unit 133 reads the secret value seed from the temporary memory 134 and calculates the hash value G (seed) (step S23). Then, the comparison unit 133b of the self-certification unit 133 further reads cc from the temporary memory 134, and determines whether or not cc = G (seed) (step S24). Here, when cc = G (seed), the self-certifying unit 133 outputs information indicating that the proof is successful (the verifier-designated signature σ is certainly generated by the verifier-designated signature generating apparatus 110). Then (step S25), the control unit 135 ends the process of the third party terminal device 130. On the other hand, if cc = G (seed) is not true, the self-certifying unit 133 outputs information indicating that the proof is unsuccessful (the verifier-designated signature σ is not generated by the verifier-designated signature generating device 110) ( In step S <b> 26, the control unit 135 ends the process of the third party terminal device 130.

  Normally, the third-party terminal device 130 cannot know whether the verifier-designated signature σ has been generated by the verifier-designated signature generation device 110 or the signature verification device 120. However, when the secret value seed is indicated from the verifier-designated signature generation device 110, the third-party terminal device 130 determines whether or not the verifier-designated signature σ is generated by the verifier-designated signature generation device 110. Can know. That is, even if a person other than the user (signature generator) of the verifier-designated signature generation apparatus 110 tries to deceive that the verifier-designated signature σ is generated, this person satisfies seed cc = G (seed). Since it is not possible to indicate that it is a generator of the verifier-designated signature σ, it cannot be false. Therefore, the third-party terminal device 130 can determine that the verifier-designated signature generation device 110 that has been able to present seed satisfying cc = G (seed) is certainly the creator of the verifier-designated signature σ.

  In this embodiment, cc = G (seed) is used, but sc = G (seed) is used instead, and whether or not sc = G (seed) is satisfied in the self-certification unit 133 of the third-party terminal device 130. Thus, it may be verified whether or not the verifier-designated signature σ is generated in the verifier-designated signature generation apparatus 110. Also, a plurality of secret values are set (seed, seed ′), cc = G (seed), and sc = G (seed ′), and the self-certification unit 133 of the third party terminal device 130 sets cc = G (seed). It is also possible to determine that the verifier-designated signature σ has been generated by the verifier-designated signature generation apparatus 110 on the condition that the above and sc = G (seed ') are satisfied.

  Further, it is preferable that at least one of cc and sc is constituted by the hash value of the secret value seed that can be disclosed to the third party terminal device 130. When the secret value seed is disclosed to the third-party terminal device 130, the third-party terminal device 130 knows the value of cc or sc. Even if these values are known, the verifier-designated signature σ This is because the forgery difficulty does not decrease so much. Therefore, even after the secret value seed is disclosed to the third party terminal device 130 for self-certification, the signature generation in the verifier-designated signature generation device 210 can be continued using the same secret value and parameter. it can.

[Example 2]
The present embodiment is a modification of the first embodiment, and is different from the first embodiment in that as = G (seed). Below, it demonstrates centering on difference with Example 1. FIG. Further, in the following drawings, the same reference numerals as those used in the first embodiment are used for portions common to the first embodiment.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in the present embodiment, the verifier-designated signature generation device 210 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 120 same as that of the first embodiment is used as a specific example of the signature verification device 20, and the third A case where a third-party terminal device 230 is used as a specific example of the person terminal device 30 will be described.

<Verifier-designated signature generation apparatus 210>
FIG. 10 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 210 in this embodiment. The only difference between the verifier-designated signature generation device 110 of the first embodiment and the verifier-designated signature generation device 210 of the present embodiment is that the first hash calculation unit 110e is replaced with the first hash calculation unit 210e.
<Third-party terminal device 230>
FIG. 11 is a block diagram illustrating the configuration of the third party terminal device 230 in the present embodiment. The difference between the third-party terminal device 130 of the first embodiment and the third-party terminal device 230 of the present embodiment is that the self-certifying unit 133 is replaced with the self-certifying unit 233 and the verifier-designated signature generating device in the preprocessing Only a key storage memory 236 for storing the public key ys 210 and a parameter storage memory 237 for storing the parameter g in the preprocessing are added. The self-certifying unit 233 according to the present embodiment includes a hash calculation unit 233a, an exponent calculation unit 233b, a remainder multiplication unit 233c, and a comparison unit 233d.

<Verifier-designated signature processing>
The difference from the first embodiment is that instead of step S1 of the first embodiment, the first hash calculation unit 210e of the verifier-designated signature generation device 210 reads the secret value seed from the secret value storage memory 110a, and this secret value Only the point where the hash value as = G (seed) of seed is calculated and this as is stored in the parameter storage memory 110b as the parameter as.
<Signature verification processing>
Same as Example 1.

<Self-certification processing by the signer>
FIG. 12 is a flowchart for explaining the self-certification processing in the present embodiment. This flowchart shows processing in the third party terminal device 230 used by a third party other than a specific signature verifier.
First, the third party terminal device 230 receives the verifier-designated signature σ = (C, cc, sc, cs, ss) in the signature receiving unit 131 as in the first embodiment (step S31), and receives the secret value. The unit 132 receives the secret value seed (step S32). The received verifier-designated signature σ and secret value seed are stored in the temporary memory 134. Next, the hash calculation unit 233a of the self-certification unit 233 reads the secret value seed from the temporary memory 134 and calculates the hash value G (seed) (step S33). Next, the exponent operation unit 233b reads the parameter g from the parameter storage memory 237, uses this and the hash value ^{G (seed)} , calculates ^{gG (seed)} , and stores it in the temporary memory 134 (step S34). . The remainder multiplication unit 233c reads cs and ss from the temporary memory 134, reads the public key ys from the key storage memory 236, reads the parameter g from the parameter storage memory 237, and calculates g ^ss · ys ^cs (step S35). ). Then, the comparison unit 233d reads g ^{G (seed)} from the temporary memory 134, and determines whether or not g ^{G (seed)} = g ^ss · ys ^cs (step S36). Here, if g ^{G (seed)} = g ^ss · ys ^cs , the self-certifying unit 233 outputs information indicating that the proof is successful (step S37), and the control unit 135 outputs the third-party terminal device 230. End the process. On the other hand, if g ^{G (seed)} = g ^ss · ys ^cs is not satisfied, the self-certification unit 233 outputs information indicating that the proof is unsuccessful (step S38), and the control unit 135 performs the processing of the third party terminal device 230. Terminate.

Example 3
This embodiment is a modification of the first embodiment, and is different from the first embodiment in that as = G (seed, m). Below, it demonstrates centering on difference with Example 1. FIG.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in this embodiment, the verifier-designated signature generation device 410 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 120 same as that of the first embodiment is used as a specific example of the signature verification device 20, and the third A case where a third party terminal device 430 is used as a specific example of the person terminal device 30 will be described.

<Verifier-designated signature generation apparatus 410>
FIG. 13 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 410 according to this embodiment. The only difference between the verifier-designated signature generation device 110 of the first embodiment and the verifier-designated signature generation device 410 of the present embodiment is that the first hash calculation unit 110e is replaced with the first hash calculation unit 410e.
<Third party terminal device 430>
FIG. 14 is a block diagram illustrating the configuration of the third party terminal device 430 in the present embodiment. The only difference between the third party terminal device 130 of the first embodiment and the third party terminal device 430 of the present embodiment is that the self-certifying unit 133 is replaced with a self-certifying unit 433. The self-certifying unit 433 includes a hash calculation unit 433a and a comparison unit 433b.

<Verifier-designated signature processing>
The difference from the first embodiment is that instead of step S1 of the first embodiment, the first hash calculation unit 410e of the verifier-designated signature generation device 410 reads the secret value seed from the secret value storage memory 110a, and the message storage memory The message m is read from 110d, the hash value cc = G (seed, m) of the bit combination value of seed and m is calculated, and this cc is stored in the parameter storage memory 110b as the parameter as.
<Signature verification processing>
Same as Example 1.

<Self-certification processing by the signer>
FIG. 15 is a flowchart for explaining self-certification processing in the present embodiment. This flowchart shows processing in the third party terminal device 430 used by a third party other than a specific signature verifier.
First, the third party terminal device 430 receives the verifier-designated signature σ = (C, cc, sc, cs, ss) in the signature receiving unit 131 as in the first embodiment (step S61), and receives the secret value. The unit 132 receives the secret value seed (step S62). The received verifier-designated signature σ and secret value seed are stored in the temporary memory 134. Next, in the hash calculation unit 433a of the self-certification unit 433, the secret value seed and the message m are read from the temporary memory 134, and the hash value G (seed, m) of these bit combination values is calculated (step S63). Next, the comparison unit 433b reads cc from the temporary memory 134, and determines whether or not cc = G (seed, m) (step S64). Here, if cc = G (seed, m), the self-certifying unit 433 outputs information indicating that the certification is successful (step S65), and the control unit 135 performs the processing of the third party terminal device 430. Terminate. On the other hand, when cc = G (seed, m) is not true, the self-certifying unit 433 outputs information indicating that the certification has failed (step S66), and the control unit 135 ends the processing of the third party terminal device 430.

Example 4
The present embodiment is a modification of the first embodiment, and is different from the first embodiment in that as = G (seed, m, sc). Below, it demonstrates centering on difference with Example 1. FIG.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in this embodiment, the verifier-designated signature generation device 510 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 120 same as that of the first embodiment is used as a specific example of the signature verification device 20, and the third A case where a third party terminal device 530 is used as a specific example of the person terminal device 30 will be described.

<Verifier-designated signature generation apparatus 510>
FIG. 16 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 510 according to the present embodiment. The only difference between the verifier-designated signature generation device 110 of the first embodiment and the verifier-designated signature generation device 510 of the present embodiment is that the first hash calculation unit 110e is replaced with the first hash calculation unit 510e.
<Third-party terminal device 530>
FIG. 17 is a block diagram illustrating the configuration of the third party terminal device 530 in the present embodiment. The only difference between the third party terminal device 130 of the first embodiment and the third party terminal device 530 of the present embodiment is that the self-certifying unit 133 is replaced with a self-certifying unit 533. The self-certifying unit 533 includes a hash calculation unit 533a and a comparison unit 533b.

<Verifier-designated signature processing>
The difference from the first embodiment is that, instead of step S1 of the first embodiment, the first hash calculation unit 510e of the verifier-designated signature generation apparatus 510 reads the secret value seed from the secret value storage memory 110a, and the message storage memory The message m is read from 110d, the parameter sc is read from the parameter storage memory 110b, the hash value cc = G (seed, m, sc) of the bit combination value of seed, m, and sc is calculated, and this cc is used as the parameter as It is only a point stored in the storage memory 110b.

<Signature verification processing>
Same as Example 1.
<Self-certification processing by the signer>
FIG. 18 is a flowchart for explaining the self-certification process in the present embodiment. This flowchart shows processing in the third-party terminal device 530 used by a third party other than a specific signature verifier.
First, the third party terminal device 530 receives the verifier-designated signature σ = (C, cc, sc, cs, ss) at the signature receiving unit 131 as in the first embodiment (step S81), and receives the secret value. The unit 132 receives the secret value seed (step S82). The received verifier-designated signature σ and secret value seed are stored in the temporary memory 134. Next, in the hash calculation unit 533a of the self-certification unit 533, the secret value seed and the message m and sc are read from the temporary memory 134, and the hash value G (seed, m, sc) of these bit combination values is calculated ( Step S83). Next, the comparison unit 533b reads cc from the temporary memory 134, and determines whether or not cc = G (seed, m, sc) (step S84). Here, if cc = G (seed, m, sc), the self-certifying unit 533 outputs information indicating that the certification is successful (step S85), and the control unit 135 determines that the third-party terminal device 530 End the process. On the other hand, if not cc = G (seed, m, sc), the self-certifying unit 533 outputs information indicating that the certification has failed (step S86), and the control unit 135 ends the processing of the third party terminal device 530. Let

  With such a configuration, it is possible to more strictly verify the creator of the verifier-designated signature σ. In this embodiment, the verifier designator signature σ is generated and self-certified as cc = G (seed, m, sc). However, sc = G (seed, m, cc) and cc∈ The verifier assigner signature σ may be generated or self-certified as {0, 1}. Also, these processes may be executed as cc = G (seed, sc) or sc = G (seed, cc).

Example 5
In this embodiment, an RSA type key pair is used.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in this embodiment, the verifier-designated signature generation device 610 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 620 is used as a specific example of the signature verification device 20, and the third-party terminal device 30 The case where the third party terminal device 630 is used as a specific example will be described.
<Verifier-designated signature generation device 610>
FIG. 19 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 610 in the present embodiment. The verifier-designated signature generation apparatus 610 of this embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and the configuration shown in FIG. 19 is obtained by reading and executing a predetermined program in the CPU. Realize.

  As illustrated in this figure, the verifier-designated signature generation device 610 includes a secret value storage memory 610a, a parameter storage memory 610b, a key storage memory 610c, a message storage memory t, a hash operation unit 610d, and an exponent operation. Unit 610e, first ciphertext generation unit 610f, first residue multiplication unit 610g, second ciphertext generation unit 610h, ciphertext transmission unit and 610i, challenge reception unit 610j, second residue multiplication unit 610k, , A signature generation unit 610m, a signature transmission unit 610n, a secret value transmission unit 610q, a temporary memory 610r, and a control unit 610s. In addition, the first remainder multiplication unit 610g includes an exponent operation unit 610ga and a multiplication unit 610gb. The verifier-designated signature generation apparatus 610 executes each process under the control of the control unit 610s.

<Signature Verification Device 620>
FIG. 20 is a block diagram illustrating the configuration of the signature verification apparatus 620 in the present embodiment. The signature verification apparatus 620 of this embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and a predetermined program is read and executed by the CPU, thereby realizing the configuration shown in FIG.
As illustrated in this figure, the signature verification device 620 includes a key storage memory 622, a ciphertext reception unit 623, a random value generation unit 624, a challenge transmission unit 625, a signature reception unit 626, and a signature verification unit 627. A temporary memory 628 and a control unit 629. The signature verification unit 627 includes a decryption unit 627a, a comparison unit 627b, an exponent operation unit 627c, a multiplication unit 627d, and a comparison unit 627e. Note that the signature verification apparatus 620 executes each process under the control of the control unit 629.

<Third-party terminal device 630>
FIG. 21 is a block diagram illustrating the configuration of the third party terminal device 630 in the present embodiment. The third-party terminal device 630 of this embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and the configuration shown in FIG. 21 is realized by reading and executing a predetermined program in the CPU. To do.
As illustrated in this figure, the third party terminal device 630 includes a signature receiving unit 631, a secret value receiving unit 632, a self-certifying unit 633, a temporary memory 634, a key storage memory 635, a control unit 636, have. The self-certifying unit 633 includes a hash calculation unit 633a, an exponent calculation unit 633b, and a comparison unit 633c. The third-party terminal device 630 executes each process under the control of the control unit 636.

<Pretreatment>
As pre-processing of signature generation / verification processing, one type of hash function G: {0, 1} ^* → {0, 1} ^L is selected. This hash function G is written in the program code for configuring the verifier-designated signature generation apparatus 610 and the program code for configuring the third-party terminal apparatus 630. And these programs are read by CPU as mentioned above, and the hash calculation in each apparatus is attained.
In addition, the private key xs and public key ys, n key pair of the verifier designated signature generation apparatus 610 and the private key xc and public key yc, n key pair of the signature verification apparatus 620 are set. In this embodiment, a key pair similar to the RSA type signature is set. That is, p and q are large prime numbers, n = p · q, and a key pair satisfying xs · ys = 1 mod n and xc · yc = 1 mod n is set.

  The key storage memory 610c of the verifier-designated signature generation device 610 stores the secret key xs (signature generator's private key), the public key n, and the signature verification device of the verifier-designated signature generation device 610 thus set. 620 public key yc (public key of a specific signature verifier) is stored. Also, the key storage memory 622 of the signature verification device 620 includes the public key ys, n (public key of the signature generator) of the verifier designated signature generation device 610 and the private key xc (specific signature verifier of the signature verification device 620). Public key). Further, the key storage memory 635 of the third party terminal device 630 stores the public key ys of the verifier designated signature generation device 610. In addition, the RSA encryption program is written in the program code for configuring the verifier-designated signature generation apparatus 610, and the decryption program is written in the program code for configuring the signature verification apparatus 620. Then, these programs are read into the CPU as described above, thereby enabling the encryption operation and the decryption operation in each device.

Further, an arbitrary secret value seed ∈ {0, 1} ^L is set in the signature generator, and it is stored securely (secretly with respect to the outside) in the secret value storage memory 610a. Further, a message mε {0, 1} ^L to be signed is stored in the message storage memory 610t of the verifier designated signature generation apparatus 610.
<Verifier-designated signature processing>
Next, a verifier designated signature process performed in the verifier designated signature generation apparatus 610 will be described.

FIG. 22 is a flowchart for explaining the verifier-designated signature processing in the present embodiment. Hereinafter, the verifier designated signature process in the present embodiment will be described with reference to this figure.
First, the hash calculator 610d of the verifier-designated signature generation device 610 reads the secret value seed from the secret value storage memory 610a, calculates the hash value cc = G (seed), and stores it in the temporary memory 610r ( Step S101). Next, the exponent operation unit 610e reads the public key ys, n from the key storage memory 610c and reads cc from the temporary memory 610r. Then, exponent operation unit 610e performs an operation of ac = cc ^ys mod n, and stores the operation result ac in temporary memory 610r (step S102). Next, in the first ciphertext generation unit 610f, the signature verifier's public key yc is read from the key storage memory 610c, and cc is read from the temporary memory 610r. Then, the first ciphertext generation unit 610f uses the public key yc to calculate a ciphertext e0 = E _yc (cc) obtained by encrypting the hash value cc with the public key cryptosystem (RSA in this example), and this e0 Is stored in the temporary memory 610r (step S103). Next, in the exponent operation unit 610ga of the first remainder multiplication unit 610g, the message m is read from the message storage memory 610t, the secret key xs is read from the key storage memory 610c, and m ^xs is calculated. The calculation result m ^xs is stored in the temporary memory 610r. Then, the multiplication unit 610gb of the first modular multiplication unit 610 g, from the temporary memory 610r reads cc and ^{m xs,} stored in the temporary memory 610r calculates the cc · ^{m xs.} Next, in the second ciphertext generating unit 610h, reads the public key yc from the key storage memory 610c, read cc · ^{m xs} from the temporary memory 610r. Then, the second ciphertext generation unit 610h uses the public key yc to encrypt a ciphertext e1 = E _yc (cc · m ^xs ) obtained by encrypting cc · m ^xs with a public key cryptosystem (RSA in this example). Calculate (step S104) and store it in the temporary memory 610r.

  Next, the ciphertext (ac, e0, e1) is read from the temporary memory 610r to the ciphertext transmission unit 610i, and the ciphertext transmission unit 610i verifies the ciphertext (ac, e0, e1) through the network 40. It transmits to the apparatus 620 (step S105). On the other hand, the signature verification apparatus 620 receives the ciphertext (ac, e0, e1) at the ciphertext receiving unit 623 and stores it in the temporary memory 628. Then, the random value generation unit 624 generates a random value bε {0, 1} and stores it in the temporary memory 628. Then, the challenge transmission unit 625 transmits the random value b to the verifier designated signature generation device 610 through the network 40.

The verifier designated signature generation apparatus 610 receives the random value b at the challenge receiving unit 610j and stores it in the temporary memory 610r (step S106). Next, in the second remainder multiplication unit 610k, the public key n is read from the key storage memory 610c, and cc, m ^xs , b are read from the temporary memory 610r. Then, the second remainder multiplication unit 610k calculates c = cc · (m ^xs ) ^b mod n, and stores the calculation result c in the temporary memory 610r (step S107). Next, the signature generation unit 610m reads ac, c, b from the temporary memory 610r and generates a verifier-designated signature σ = (ac, c, b) (step S108). The signature transmission unit 610n transmits the verifier-designated signature σ together with the message m read from the message storage memory 610t to the signature verification apparatus 620 through the network 40 (step S109).

<Signature verification processing>
Next, a signature verification process in the signature verification apparatus 620 will be described.
FIG. 23 is a flowchart for explaining the signature verification processing of the signature verification apparatus 620 in this embodiment. The signature verification process will be described below with reference to this figure.
First, the signature verification apparatus 620 receives the verifier-designated signature σ = (ac, c, b) and the message m transmitted through the network 40 as described above at the signature receiving unit 626 (step S111). These are stored in the temporary memory 628. Next, the decryption unit 627a of the signature verification unit 627 calculates Dec _xc (eb) (b = 0: eb = e0, b = 1: eb = e1) (step S112). That is, first, the decoding unit 627a reads b from the temporary memory 628 and determines its value. Here, when b = 0, the decoding unit 627a reads e0 from the temporary memory 628 as eb, and when b = 1, the decoding unit 627a reads e1 from the temporary memory 628 as eb. Also, the private key xc is read from the key storage memory 622, and Dec _xc (eb) obtained by decrypting eb according to the RSA decryption method is calculated using the private key xc.

Next, the comparison unit 627b of the signature verification unit 627 further reads c from the temporary memory 628, and determines whether Dec _xc (eb) = c (step S113). If Dec _xc (eb) = c is not satisfied, the signature verification unit 627 outputs information indicating that the authentication has failed (step S118), and the control unit 629 terminates the processing in the signature verification device 620. To do. On the other hand, when Dec _xc (eb) = c, the exponent operation unit 627c of the signature verification unit 627 reads c from the temporary memory 628 and reads the public key ys from the key storage memory 622. Then, the exponent calculation unit 627c calculates c ^ys and stores the calculation result in the temporary memory 628 (step S114). Further, the multiplication unit 627 d reads ac, m, b from the temporary memory 628 and reads the public key n from the key storage memory 622. Then, the multiplication unit 627d calculates ac · m ^b mod n. Then, the comparison unit 627e further reads c ^ys from the temporary memory 628, and determines whether c ^ys = ac · m ^b mod n (step S116). Here, when c ^ys = ac · m ^b mod n is not satisfied, the signature verification unit 627 outputs information indicating that the authentication has failed (step S118), and the control unit 629 performs processing in the signature verification device 620. Exit. On the other hand, if c ^ys = ac · m ^b mod n, the signature verification unit 627 outputs information indicating that the authentication is successful (step S117), and the control unit 629 performs the processing in the signature verification device 620. finish.

In this example,
Dec _xc (eb) = c (1)
c ^ys = ac · m ^b mod n (2)
If both of these are satisfied, authentication is considered successful. The reason for this will be described below.
If b = 0:
In this case, since eb = e0, if the verifier-designated signature σ = (ac, c, b) is correct, the left side of equation (1) is cc (see step S103). Since b = 0, the right side of the equation (1) is cc mod n (see step S107). When b = 0, the left side of Equation (2) is cc ^ys mod n (see step S107). Further, since b = 0, the right side of the equation (2) is ac mod n = cc ^ys mod n (step S102).

If b = 1:
In this case, since eb = e1, if the verifier-designated signature σ = (ac, c, b) is correct, the left side of equation (1) is cc · ^mxs (see step S104). Further, since b = 1, the right side of the equation (1) is c = cc · ^mxs mod n (see step S107).
When b = 1, the left side of Equation (2) is (cc · m ^xs ) ^ys (see step S107). Since c = cc · m ^xs mod n, the left side of the equation (2) becomes (cc · m ^xs ) ^ys mod n, and m ^xs · ^ys = m due to the nature of the RSA key. The left side of (2) is cc ^ys · m mod n = ac · m mod n (see step S102). Since b = 1, the right side of the equation (2) is ac · mmod n.

  From the above, it can be seen that if the verifier-designated signature σ = (ac, c, b) is correct, equations (1) and (2) hold. Expressions (1) and (2) indicate that the verifier-designated signature σ = (ac, c, b) is generated by either the verifier-designated signature generation device 610 or the signature verification device 620. However, the user of the signature verification device 620 knows that the signature verification device 620 has not generated the verifier-designated signature σ = (ac, c, b). Therefore, the user of the signature verification device 620 can recognize that the verifier-designated signature σ is generated by the verifier-designated signature generation device 610. On the other hand, since an arbitrary third party does not know the secret key xc of the signature verification apparatus 620, it cannot perform the decryption operation on the left side of Expression (1), and cannot perform the signature verification.

<Self-certification processing by the signer>
FIG. 24 is a flowchart for explaining the self-certification process in the present embodiment. Note that this flowchart shows processing in the third-party terminal device 630 used by a third party other than a specific signature verifier.
First, the verifier designated signature generation device 610 proves to a third party other than a specific signature verifier that the verifier designated signature σ generated by the verifier designated signature σ is generated by the verifier designated signature generation device 610. In addition, the verifier-designated signature σ = (ac, c, b), the secret value seed, and the network 40 are transmitted to the third-party terminal device 630 used by the third party.

The third-party terminal device 630 uses the verifier-designated signature σ = (ac, c, b) and the secret value seed transmitted from the verifier-designated signature generation device 610 as the signature receiver 631 and the secret value receiver 632. And stored in the temporary memory 634 (steps S121 and 122). Next, the hash value calculation unit 633a of the self-certification unit 633 reads the secret value seed from the temporary memory 634 and calculates the hash value G (seed) (step S123). Further, the exponent operation unit 633b reads the public key ys from the key storage memory 635, and calculates {G (seed)} ^ys with respect to G (seed) calculated in step S123 (step S124). Further, the comparison unit 633c reads ac from the temporary memory 634, and determines whether or not ac = {G (seed)} ^ys (step S125). Here, if ac = {G (seed)} ^ys , the self-certifying unit 633 outputs information indicating that the certification is successful (step S126), and the control unit 636 performs processing of the third party terminal device 630. End. On the other hand, if ac = {G (seed)} ^ys is not true, the self-certification unit 633 outputs information indicating that the proof is unsuccessful (step S127), and the control unit 635 terminates the process of the third party terminal device 630. .

When the third party terminal device 630 receives the secret value seed from the verifier designated signature generation device 610, the third party terminal device 630 generates the verifier designated signature σ generated by the verifier designated signature generation device 610. You can know whether it is a thing. That is, even if a person other than the user (signature generator) of the verifier-designated signature generation apparatus 610 tries to fake that the verifier-designated signature σ is generated, this person satisfies ac = {G (seed)} ^ys . Since such seed cannot be indicated, it cannot be false that the verifier-designated signature σ is generated. Therefore, the third-party terminal device 630 can determine that the verifier-designated signature generation device 610 that has been able to present seed that satisfies ac = {G (seed)} ^ys is indeed the creator of the verifier-designated signature σ. .

In this embodiment, eo may be referred to as e1, e1 may be referred to as e0, processing for b = 0 may be performed for e1, and processing for b = 1 may be performed for e0.
Example 6
This embodiment is also an example using an RSA type key pair.
<Configuration>
The overall configuration of this embodiment is the same as that illustrated in FIG. However, in the present embodiment, the verifier-designated signature generation device 710 is used as a specific example of the verifier-designated signature generation device 10, the signature verification device 720 is used as a specific example of the signature verification device 20, and the third-party terminal device 30 The case where the third party terminal device 730 is used as a specific example will be described.

<Verifier-designated signature generation device 710>
FIG. 25 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus 710 according to this embodiment. The verifier-designated signature generation apparatus 710 of this embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and the configuration shown in FIG. 25 is obtained by reading and executing a predetermined program in the CPU. Realize.
As illustrated in this figure, the verifier-designated signature generation device 710 includes a secret value storage memory 710a, a key storage memory 710b, a message storage memory 710c, a hash calculation unit 710d, a first division unit 710e, 1 exponent operation unit 710f, subtraction unit 710g, second division unit 710h, second exponent operation unit 710i, signature generation unit 710j, signature transmission unit 710k, secret value transmission unit 710m, temporary memory 710n, And a control unit 710p. The verifier-designated signature generation apparatus 710 executes each process under the control of the control unit 710p.

<Verification verification device 720>
FIG. 26 is a block diagram illustrating the configuration of the verification / verification apparatus 720 according to the present embodiment. The verification / verification apparatus 720 of the present embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and a predetermined program is read and executed by the CPU, thereby realizing the configuration shown in FIG.
As illustrated in this figure, the signature verification apparatus 720 includes a key storage memory 721, a signature reception unit 722, a temporary memory 723, a signature verification unit 724, and a control unit 725. The signature verification unit 724 includes multiplication units 724a and 724b, an exponent operation unit 724c, and a comparison unit 724d. Note that the signature verification apparatus 720 executes each process under the control of the control unit 725.

<Third-party terminal device 730>
FIG. 27 is a block diagram illustrating the configuration of the third party terminal device 730 in the present embodiment. The third-party terminal device 730 of the present embodiment also has the same hardware configuration as that of the first embodiment (see FIG. 3), and the configuration shown in FIG. To do.
As illustrated in this figure, the third-party terminal device 730 includes a key storage memory 736, a signature receiving unit 731, a secret value receiving unit 732, a self-certifying unit 733, a temporary memory 734, a control unit 735, Have The self-certifying unit 733 includes a hash calculation unit 733a, a division unit 733b, an exponent calculation unit 733c, and a comparison unit 733d. The third-party terminal device 730 executes each process under the control of the control unit 735.

<Pretreatment>
As pre-processing of signature generation / verification processing, one type of hash function G: {0, 1} ^* → {0, 1} ^L is selected. This hash function G is written in the program code for configuring the verifier-designated signature generation apparatus 710 and the program code for configuring the third-party terminal apparatus 730. And these programs are read by CPU as mentioned above, and the hash calculation in each apparatus is attained.
In addition, the private key xs and public key ys, n key pair of the verifier-designated signature generation apparatus 710 and the private key xc and public key yc, n key pair of the signature verification apparatus 720 are set. In this embodiment, the same key pair as the RSA type signature as in the fifth embodiment is set. That is, p and q are large prime numbers, n = p · q, and a key pair satisfying xs · ys = 1 mod n and xc · yc = 1 mod n is set.

  In the key storage memory 710b of the verifier-designated signature generation device 710, the secret key xs (signature generator's private key) of the verifier-designated signature generation device 710 thus set and the public key of the signature verification device 720 are stored. yc (a public key of a specific signature verifier) is stored. Also, the key storage memory 721 of the signature verification device 720 stores the public key ys (signature generator public key) of the verifier-designated signature generation device 710 and the public key yc of the signature verification device 720 (public of a specific signature verifier). Key) is stored. Further, the public key yc of the signature verification device 720 is stored in the key storage memory 736 of the third party terminal device 730.

Further, an arbitrary secret value seed ∈ {0, 1} ^L is set in the signature generator, and it is stored securely (secretly with respect to the outside) in the secret value storage memory 710a. Further, the message storage memory 710c of the verifier-designated signature generation device 710 stores the message to be signed mε {0, 1} ^L.
<Verifier-designated signature processing>
Next, a verifier designated signature process performed in the verifier designated signature generation apparatus 710 will be described.

FIG. 28 is a flowchart for explaining the verifier designated signature processing in the present embodiment. Hereinafter, the verifier designated signature process in the present embodiment will be described with reference to this figure.
First, the hash calculator 710d of the verifier-designated signature generation device 710 reads the secret value seed from the secret value storage memory 710a, calculates the hash value cc = G (seed), and stores it in the temporary memory 610r ( Step S201). Next, the first division unit 710e reads the public key yc from the key storage memory 710b and reads cc from the temporary memory 710n. Then, the first division unit 710e calculates ac = cc / yc and stores the calculation result ac in the temporary memory 710n (step S202). Next, in the first exponent operation unit 710, the message m is read from the message storage memory 710c, and ac is read from the temporary memory 710n. The first exponent calculation unit 710f calculates the sc ^{= m ac,} and stores the calculation result sc in the temporary memory 710n (step S203). Next, the subtraction unit 710g reads the secret key xs from the key storage memory 710b and reads cc from the temporary memory 710n. Then, the subtraction unit 710g calculates cs = xs−cc, and stores the calculation result cs in the temporary memory 710n (step S204). Next, the second division unit 710h reads the public key yc from the key storage memory 710b and reads cs from the temporary memory 710n. Then, the second division unit 710h calculates as = cs / yc and stores the calculation result as in the temporary memory 710n (step S205). Next, in the second exponent operation unit 710i, the message m is read from the message storage memory 710c, and as is read from the temporary memory 710n. The second exponent calculation unit 710i includes, ss ⁼ calculates ^{m the as,} and stores the calculation result ss in the temporary memory 710n (step S206). Next, the signature generation unit 710j reads sc and ss from the temporary memory 710n, and generates a verifier-designated signature σ = (sc, ss) (step S207). Then, the signature transmission unit 710k transmits the verifier-designated signature σ together with the message m in the message storage memory 710c to the signature verification apparatus 720 through the network 40 (step S208).

<Signature verification processing>
Next, a signature verification process in the signature verification apparatus 720 will be described.
FIG. 29 is a flowchart for explaining the signature verification processing of the signature verification apparatus 720 in this embodiment. The signature verification process will be described below with reference to this figure.
First, the signature verification apparatus 720 receives the verifier-designated signature σ = (sc, ss) and the message m transmitted through the network 40 as described above at the signature receiving unit 722 (step S211). These are stored in the temporary memory 723. Next, the multiplication unit 724a of the signature verification unit 724 reads sc and ss from the temporary memory 723, and calculates sc · ss (step S212). The multiplication unit 724b reads the public keys yc and ys from the key storage memory 721 and calculates yc · ys (step S213). Then, the exponent calculation unit 724c calculates (sc · ss) ^{yc · ys} (step S214), and the comparison unit 724d reads the message m from the temporary memory 723, and m = (sc · ss) ^{yc · ys} . It is determined whether or not there is (step S215). If m = (sc · ss) ^{yc · ys} is not satisfied, the signature verification unit 724d outputs information indicating that the authentication has failed (step S217), and the control unit 725 The process ends. On the other hand, if m = (sc · ss) ^{yc · ys} , the signature verification unit 724 outputs information indicating that the authentication is successful (step S216), and the control unit 715 performs processing in the signature verification device 720. Exit.

In this embodiment, m = (sc · ss) ^{yc · ys} is used as a verification formula. ^{This, sc · ss = m as ·} m ac = m as + ac = m xs / yc and can transform (see step S202 to S206), the right-hand side of the verification equation ^{is, (sc · ss) yc ·} ys = ( m ^{xs / yc} ) ^{yc · ys} = m ^{xs · ys} = m (from the nature of the RSA key). The verification expression indicates that the verifier-designated signature σ = (sc, ss) is generated by either the verifier-designated signature generation device 710 or the signature verification device 720. However, the user of the signature verification device 720 knows that the verifier-designated signature σ = (sc, ss) has not been generated by the signature verification device 720. Therefore, the user of the signature verification device 720 can recognize that the verifier-designated signature σ is generated by the verifier-designated signature generation device 710. On the other hand, an arbitrary third party can verify that the verifier-designated signature σ is generated by either the verifier-designated signature generation device 710 or the signature verification device 720, but in which case the verifier-designated signature σ is generated. Cannot be identified.

<Self-certification processing by the signer>
FIG. 30 is a flowchart for explaining the self-certification processing in the present embodiment. Note that this flowchart shows processing in the third-party terminal device 730 used by a third party other than a specific signature verifier.
First, the verifier designated signature generation device 710 proves to a third party other than a specific signature verifier that the verifier designated signature σ generated by the verifier designated signature σ is generated by the verifier designated signature generation device 710. The verifier-designated signature σ = (sc, ss), the secret value seed, and the network 40 are transmitted to the third-party terminal device 730 used by the third party.

The third-party terminal device 730 sends the verifier-designated signature σ = (sc, ss) and the secret value seed transmitted from the verifier-designated signature generation device 710 to the signature receiving unit 731 and the secret value receiving unit 732, respectively. It is received and stored in the temporary memory 734 (steps S221 and 222). Next, in the hash calculation unit 733a of the self-certification unit 733, the secret value seed is read from the temporary memory 734, and the hash value G (seed) is calculated (step S223). Next, the division unit 733b reads the public key yc from the key storage memory 736, and calculates A = {G (seed)} / yc (step S224). Furthermore, the exponent calculation unit 733 c, reads the message m from the temporary memory 734, calculates the ^{m A} (step S225). Then, the comparison unit 733D, reads sc from further temporary memory 734, it is determined whether sc = ^{m A} (step S226). Here, if the sc = ^{m A,} the self-certification unit 533 outputs information indicating that certification is successful (step S227), the control unit 735 terminates the processing of the third party terminal apparatus 730. On the other hand, if it is not sc = ^{m A,} the self-certification unit 733 outputs information of the certificate is a failure (step S228), the control unit 735 terminates the processing of the third party terminal apparatus 730.

Normally, the third-party terminal device 730 cannot know whether the verifier-designated signature generation device 710 or the signature verification device 720 has generated the verifier-designated signature σ. However, when the secret value seed is indicated from the verifier-designated signature generation device 710, the third-party terminal device 730 determines whether or not the verifier-designated signature σ is generated by the verifier-designated signature generation device 710. Can know. That is, even if a person other than the user (signature generator) of the verifier-designated signature generation apparatus 710 tries to deceive that the verifier-designated signature σ has been generated, this person is sc = m ^ac = m ^{cc / yc} = m ^{Since {G (seed) / yc}} or ss = m ^as = m ^{cs / ys} = m ^{(xs−cs) / ys} = m ^{(xs−G (seed)) / ys} cannot be indicated Therefore, it is not possible to pretend that this is the generator of the verifier-designated signature σ. Therefore, the third-party terminal device 730 can determine that the verifier-designated signature generation device 710 that has been able to present seed satisfying cc = G (seed) is certainly the creator of the verifier-designated signature σ.

  The present invention is not limited to the embodiment described above. For example, in the fifth and sixth embodiments, cc = G (seed, m) may be used to generate the verifier-designated signature σ or perform self-certification. Further, the concept of the present invention may be applied to a verifier-designated signature generation apparatus that uses a general encryption algorithm different from the above. Needless to say, other modifications are possible without departing from the spirit of the present invention. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary.

Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. And a processing function is implement | achieved on a computer by running this program with a computer.
The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  As an application field of the present invention, for example, an electronic signature for an electronic contract exchanged by an electronic document can be exemplified.

FIG. 1 is a conceptual diagram illustrating the overall configuration of a verifier-designated signature system according to this embodiment. FIG. 2A is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus illustrated in FIG. FIG. 2B is a block diagram illustrating the configuration of the third-party terminal device illustrated in FIG. FIG. 3 is a block diagram illustrating the configuration of the verifier-designated signature generation apparatus according to the first embodiment. FIG. 4 is a block diagram illustrating a functional configuration of the verifier-designated signature generation apparatus according to the first embodiment. FIG. 5 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the first embodiment. FIG. 6 is a block diagram illustrating the functional configuration of the third-party terminal device according to the first embodiment. FIG. 7 is a flowchart for explaining a verifier-designated signature process according to the first embodiment. FIG. 8 is a flowchart for explaining the signature verification processing of the signature verification apparatus according to the first embodiment. FIG. 9 is a flowchart for explaining the self-certification process in the first embodiment. FIG. 10 is a block diagram illustrating a functional configuration of the verifier-designated signature generation device according to the second embodiment. FIG. 11 is a block diagram illustrating a functional configuration of a third party terminal device according to the second embodiment. FIG. 12 is a flowchart for explaining self-certification processing in the second embodiment. FIG. 13 is a block diagram illustrating a functional configuration of the verifier-designated signature generation device according to the third embodiment. FIG. 14 is a block diagram illustrating a functional configuration of a third party terminal device according to the third embodiment. FIG. 15 is a flowchart for explaining self-certification processing in the third embodiment. FIG. 16 is a block diagram illustrating a functional configuration of the verifier-designated signature generation device according to the fourth embodiment. FIG. 17 is a block diagram illustrating a functional configuration of a third party terminal device according to the fourth embodiment. FIG. 18 is a flowchart for explaining the self-certification process in the fourth embodiment. FIG. 19 is a block diagram illustrating a functional configuration of the verifier-designated signature generation device according to the fifth embodiment. FIG. 20 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the fifth embodiment. FIG. 21 is a block diagram illustrating a functional configuration of a third party terminal device according to the fifth embodiment. FIG. 22 is a flowchart for explaining a verifier-designated signature process according to the fifth embodiment. FIG. 23 is a flowchart for explaining the signature verification processing of the signature verification apparatus according to the fifth embodiment. FIG. 24 is a flowchart for explaining the self-certification process in the fifth embodiment. FIG. 25 is a block diagram illustrating a functional configuration of a verifier-designated signature generation device according to the sixth embodiment. FIG. 26 is a block diagram illustrating a functional configuration of the signature verification apparatus according to the sixth embodiment. FIG. 27 is a block diagram illustrating a functional configuration of a third party terminal device according to the sixth embodiment. FIG. 28 is a flowchart for explaining a verifier-designated signature process according to the sixth embodiment. FIG. 29 is a flowchart for explaining the signature verification processing of the signature verification apparatus according to the sixth embodiment. FIG. 30 is a flowchart for explaining self-certification processing in the sixth embodiment.

Explanation of symbols

1 Verifier-designated signature system 10, 110, 210, 410, 510, 610, 710 Verifier-designated signature generation device 20, 120, 620, 720 Signature verification device 30, 130, 230, 430, 530, 630, 730 Third Terminal device

Claims (14)

A verifier-designated signature generation device that generates a verifier-designated signature in which a specific signature verifier is designated ,
A secret value storage memory for storing the secret value of the signature generator;
A key storage memory for storing at least the private key of the signature generator and the public key of the specific signature verifier;
A hash calculation unit for calculating a hash value of information including the secret value;
Using at least the hash value, the signature generator's private key and the public key of the specific signature verifier, including the hash value or a function value obtained by using the hash value, and the specific signature verifier A signature generation unit that generates a verifier-designated signature that can be verified without using the secret value ;
A signature transmitter that transmits the verifier-designated signature;
When proving that the verifier-designated signature is generated by the verifier-designated signature generation device to a person other than the specific signature verifier, the secret value is obtained by a person other than the specific signature verifier. A secret value transmission unit that transmits to a third-party terminal device to be used ;
A verifier-designated signature generation device characterized by comprising: A verifier-designated signature generation device that generates a verifier-designated signature in which a specific signature verifier is designated ,
A secret value storage memory for storing the secret value of the signature generator;
A parameter storage memory for storing parameters as, cc, sc, g;
A key storage memory for storing the secret key xs of the signature generator and the public key yc of the specific signature verifier;
A message storage memory for storing the message m to be signed;
A first hash calculator that calculates a hash value of information including the secret value;
a remainder multiplier for calculating rc = g ^sc · yc ^cc ;
an exponent calculation unit for calculating a rs ^{= g as,}
A second hash calculator that calculates a hash value C = H (rs, rc, m) of the bit combination value of rs, rc, and m,
a first subtraction unit for calculating cs = C-cc;
a multiplier for calculating cs · xs;
a second subtraction unit for calculating ss = as−cs · xs;
A signature generation unit that generates a verifier-designated signature σ = (C, cc, sc, cs, ss) that can be verified only by the specific signature verifier without using the secret value ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
When proving that the verifier-designated signature is generated by the verifier-designated signature generation device to a person other than the specific signature verifier, the secret value is obtained by a person other than the specific signature verifier. A secret value transmission unit that transmits to a third party terminal device to be used ,
At least one of the parameters as, cc, and sc is the hash value calculated by the first hash calculator.
A verifier-designated signature generation apparatus characterized by the above. The verifier-designated signature generation device according to claim 2,
Only one of the parameters cc and sc is the hash value calculated by the first hash calculator.
A verifier-designated signature generation apparatus characterized by the above. The verifier-designated signature generation device according to claim 2,
The first hash calculation unit is
A hash value of information including the secret value and the parameter sc is calculated as the parameter cc, or a hash value of information including the secret value and the parameter cc is calculated as the parameter sc.
A verifier-designated signature generation apparatus characterized by the above. A verifier-designated signature generation device that generates a verifier-designated signature in which a specific signature verifier is designated ,
A secret value storage memory for storing the secret value seed of the signature generator;
A key storage memory for storing the signature generator's private key xs and public key ys, n and the specific signature verifier's public key yc;
A message storage memory for storing the message m to be signed;
A hash calculation unit for calculating a hash value cc of information including the secret value seed;
an exponent operation unit for calculating ac = cc ^ys mod n;
A first ciphertext generation unit that calculates a ciphertext e0 = E _yc (cc) obtained by encrypting the hash value cc using a public key cryptosystem using the public key yc of the specific signature verifier;
a first modular multiplication unit for calculating cc · m ^xs ;
A second ciphertext generation unit that calculates a ciphertext e1 = E _yc (cc · m ^xs ) obtained by encrypting the cc · m ^xs by a public key cryptosystem using the public key yc of the specific signature verifier;
A ciphertext transmission unit that transmits (ac, e0, e1) to the terminal device of the specific signature verifier;
A challenge receiver that receives bε {0, 1} transmitted from the terminal device of the specific signature verifier after transmitting (ac, e0, e1);
a second modular multiplication unit for calculating c = cc · (m ^xs ) ^b mod n;
A signature generation unit that generates a verifier-designated signature σ = (ac, c, b) that can be verified only by the specific signature verifier without using the secret value seed ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
When proving to the person other than the specific signature verifier that the verifier designated signature has been generated by the verifier designated signature generation apparatus, the secret value seed is assigned to a person other than the specific signature verifier. A secret value transmission unit that transmits to a third party terminal device used by
A verifier-designated signature generation device characterized by comprising: A verifier-designated signature generation device that generates a verifier-designated signature in which a specific signature verifier is designated ,
A secret value storage memory for storing the secret value seed of the signature generator;
A key storage memory for storing the secret key xs of the signature generator and the public key yc of the specific signature verifier;
A message storage memory for storing the message m to be signed;
A hash calculation unit for calculating a hash value cc of information including the secret value seed;
a first division unit for calculating ac = cc / yc;
a first exponent operation unit for calculating sc = ^mac ;
a subtraction unit for calculating cs = xs−cc;
a second division unit for calculating as = cs / yc;
a second exponent calculation unit for calculating ss = ^mas ;
A signature generation unit that generates a verifier-designated signature σ = (sc, ss) that can be verified only by the specific signature verifier without using the secret value seed ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
When proving to the person other than the specific signature verifier that the verifier designated signature has been generated by the verifier designated signature generation apparatus, the secret value seed is assigned to a person other than the specific signature verifier. A secret value transmission unit that transmits to a third party terminal device used by
A verifier-designated signature generation device characterized by comprising: A verifier-designated signature system that performs a verifier-designated signature process in which a specific signature verifier is designated ,
A verifier-designated signature generation device that generates a verifier-designated signature that can be verified only by a specific signature verifier, and a third-party terminal device used by a person other than the specific signature verifier,
The verifier-designated signature generation device is
A secret value storage memory for storing the secret value of the signature generator;
A key storage memory for storing at least the private key of the signature generator and the public key of the specific signature verifier;
A hash calculation unit for calculating a hash value of information including the secret value;
Using at least the hash value, the signature generator's private key and the public key of the specific signature verifier, including the hash value or a function value obtained by using the hash value, and the specific signature verifier A signature generation unit that generates a verifier-designated signature that can be verified without using the secret value ;
A signature transmitter that transmits the verifier-designated signature;
A secret value transmission unit that transmits the secret value when proving to a person other than the specific signature verifier that the verifier-designated signature is generated by the verifier-designated signature generation device. And
The above third party terminal device
A signature receiver that receives at least a verifier-designated signature; and
A secret value receiving unit for receiving the secret value;
Using the hash value of the information including the secret value received by the secret value receiving unit and the hash value included in the verifier-designated signature received by the signature receiving unit or the function value obtained using the hash value , A self-certification unit that determines whether or not the creator of the verifier-designated signature is valid,
A verifier-designated signature system characterized by that. A verifier-designated signature system that performs a verifier-designated signature process in which a specific signature verifier is designated ,
A verifier-designated signature generation device that generates a verifier-designated signature that can be verified only by a specific signature verifier, and a third-party terminal device used by a person other than the specific signature verifier,
The verifier-designated signature generation device is
A secret value storage memory for storing the secret value of the signature generator;
A parameter storage memory for storing parameters as, cc, sc, g;
A key storage memory for storing the secret key xs of the signature generator and the public key yc of the specific signature verifier;
A message storage memory for storing the message m to be signed;
A first hash calculator that calculates a hash value of information including the secret value;
a remainder multiplier for calculating rc = g ^sc · yc ^cc ;
an exponent calculation unit for calculating a rs ^{= g as,}
A second hash calculator that calculates a hash value C = H (rs, rc, m) of the bit combination value of rs, rc, and m,
a first subtraction unit for calculating cs = C-cc;
a multiplier for calculating cs · xs;
a second subtraction unit for calculating ss = as−cs · xs;
A signature generation unit that generates a verifier-designated signature σ = (C, cc, sc, cs, ss) that can be verified only by the specific signature verifier without using the secret value ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
A secret value transmission unit that transmits the secret value when proving to a person other than the specific signature verifier that the verifier-designated signature is generated by the verifier-designated signature generation device. And
At least one of the parameters as, cc, and sc is a hash value of information including the secret value calculated by the first hash calculation unit,
The above third party terminal device
A signature receiver that receives at least a verifier-designated signature σ = (C, cc, sc, cs, ss);
A secret value receiving unit for receiving the secret value;
Using at least a part of cc, sc, ss of the verifier-designated signature σ received by the signature receiver and a hash value of information including the secret value received by the secret value receiver, the verifier-designated A self-certifying part that determines whether or not the generator of the signature σ is valid,
A verifier-designated signature system characterized by that. The verifier-designated signature system according to claim 8,
Only one of the parameters cc and sc is a hash value of information including the secret value calculated by the first hash calculator of the verifier-designated signature generation device,
The self-certification part of the third-party terminal device is
When the cc of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiver is equal to the hash value of the information including the secret value received by the secret value receiver Whether the verifier-designated signature σ is determined to be valid,
When the sc of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiver is equal to the hash value of the information including the secret value received by the secret value receiver It is determined that the creator of the verifier-designated signature σ is valid.
A verifier-designated signature system characterized by that. The verifier-designated signature generation device according to claim 8,
The first hash calculator of the verifier-designated signature generation apparatus calculates a hash value of information including the secret value and the parameter sc as the parameter cc, or information including the secret value and the parameter cc Is calculated as the parameter sc, and
The self-certification part of the third-party terminal device is
A hash value of information including cs of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiving unit and the secret value received by the secret value receiving unit, and the verification Whether the creator of the verifier-designated signature σ is valid when the cc of the verifier-designated signature σ is equal,
A hash value of information including cc of the verifier-designated signature σ = (C, cc, sc, cs, ss) received by the signature receiving unit and the secret value received by the secret value receiving unit, and the verification The verifier-designated signature σ is determined to be valid when cs of the verifier-designated signature σ is equal,
A verifier-designated signature system characterized by that. A verifier-designated signature system that performs a verifier-designated signature process in which a specific signature verifier is designated ,
A verifier-designated signature generation device that generates a verifier-designated signature that can be verified only by a specific signature verifier, and a third-party terminal device used by a person other than the specific signature verifier,
The verifier-designated signature generation device is
A secret value storage memory for storing the secret value seed of the signature generator;
A key storage memory for storing the signature generator's private key xs and public key ys, n and the specific signature verifier's public key yc;
A message storage memory for storing the message m to be signed;
A hash calculation unit for calculating a hash value cc of information including the secret value seed;
an exponent operation unit for calculating ac = cc ^ys mod n;
A first ciphertext generation unit that calculates a ciphertext e0 = E _yc (cc) obtained by encrypting the hash value cc by a public key cryptosystem using the public key yc of the signature verifier;
a first modular multiplication unit for calculating cc · m ^xs ;
A second ciphertext generation unit that calculates a ciphertext e1 = E _yc (cc · m ^xs ) obtained by encrypting the cc · m ^xs by a public key cryptosystem using the public key yc of the specific signature verifier;
A ciphertext transmission unit that transmits (ac, e0, e1) to the terminal device of the specific signature verifier;
A challenge receiver that receives bε {0, 1} transmitted from the terminal device of the specific signature verifier after transmitting (ac, e0, e1);
a second modular multiplication unit for calculating c = cc · (m ^xs ) ^b mod n;
A signature generation unit that generates a verifier-designated signature σ = (ac, c, b) that can be verified only by the specific signature verifier without using the secret value seed ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
A secret value transmission unit that transmits the secret value seed when proving to a person other than the specific signature verifier that the verifier-designated signature is generated by the verifier-designated signature generation device; Have
The above third party terminal device
A key storage memory for storing the signature generator's public key ys;
A signature receiver that receives at least a verifier-designated signature σ = (ac, c, b);
Private value receiving section for receiving the secret value seed,
Determined that creator of the verifier specified signature σ when are equal and ys multiplication values for the hash value of information including ac and the secret value seed of the verifier designation signature σ to the signature receiving unit receives is legitimate Having a self-certifying part,
A verifier-designated signature system characterized by that. A verifier-designated signature system that performs a verifier-designated signature process in which a specific signature verifier is designated ,
A verifier-designated signature generation device that generates a verifier-designated signature that can be verified only by a specific signature verifier, and a third-party terminal device used by a person other than the specific signature verifier,
The verifier-designated signature generation device is
A secret value storage memory for storing the secret value seed of the signature generator;
A key storage memory for storing the secret key xs of the signature generator and the public key yc of the specific signature verifier;
A message storage memory for storing the message m to be signed;
A hash calculation unit for calculating a hash value cc of information including the secret value seed;
a first division unit for calculating ac = cc / yc;
a first exponent operation unit for calculating sc = ^mac ;
a subtraction unit for calculating cs = xs−cc;
a second division unit for calculating as = cs / yc;
a second exponent calculation unit for calculating ss = ^mas ;
A signature generation unit that generates a verifier-designated signature σ = (sc, ss) that can be verified only by the specific signature verifier without using the secret value seed ;
A signature transmission unit that transmits the verifier-designated signature σ together with the message m;
A secret value transmission unit that transmits the secret value seed when proving to a person other than the specific signature verifier that the verifier-designated signature is generated by the verifier-designated signature generation device; Have
The above third party terminal device
A key storage memory for storing the public key yc of the specific signature verifier;
A signature receiver that receives the verifier-designated signature σ = (sc, ss) and the message m;
Private value receiving section for receiving the secret value seed,
And sc of the signature reception section above verifier specified received signature sigma, generation of m ^A [A is (hash value of information including the secret seed) / yc] and the verifier specified signature sigma when equal A self-certifying part that the person judges to be legitimate,
A verifier-designated signature system characterized by that.   The program for functioning a computer as a verifier designation | designated signature production | generation apparatus in any one of Claim 1 to 6.   A computer-readable recording medium storing the program according to claim 13.

Images