JP4790422B2 - Electronic signature method with threshold, verification method, electronic signature system, verification device, signature device, duplicate signature copy signature detection device, signature verification system, signature verification method, electronic billing system, electronic cash payment system, and program - Google Patents

Description

  The present invention relates to information security technology, and to a digital signature technology with a threshold.

The digital signature technique with a threshold is an electronic signature that can be confirmed from only the signature so that it is not known who has cooperated in signature generation that the signature has been generated by the cooperation of some of a plurality of participants. An electronic signature method that can confirm from the signature alone that the signature has been generated by the cooperation of arbitrary t or more of the n participants without knowing who has cooperated in the signature generation (t, n) Called threshold electronic signature method. There is a method disclosed in Non-Patent Document 1 as a conventional method. First, symbols used in this description will be described. Let G be a cyclic group that is considered to be difficult to solve the discrete logarithm problem, g be the generation source, and q be the order of the group (G = <g>, # G = q). Z _q is a residue class {0, 1, 2,..., Q−1} modulo q. ∈ _U means that elements are extracted uniformly and randomly, {0, 1} ^* means a bit string in which 0 or 1 are arranged in an arbitrary length, and K means a finite field. H, I, and J are hash functions for conversion as H: {0, 1} ^* → Z _q . The method disclosed in Non-Patent Document 1 will be described below.

FIG. 1 shows a configuration example and a flow of an electronic signature system with a threshold. The total number of participants in this system is n, and n participating devices 910-i (i = 1,..., N) use a predetermined element g (gεG) of a cyclic group G. Thus, the secret key x _i and the public key y _{i of} each participating device are generated, and the public key y _i is made public. When creating a signature, any t or more of the n people generate a commitment a _i with the participating devices 910-i (i = 1,..., T), and transmit the commitment a _i to a device including the signature generation unit 920. Here, to simplify the explanation, i = 1,..., T is a number indicating the participating devices that used (cooperated) for signature generation, and i = t + 1,. The number of participating devices that did not cooperate) may be any of the n participating devices.

The signature generation unit 920 may be an independent device, or may be provided in any participating device. The signature generation unit 920 generates a dummy response e _i , a dummy challenge c _i , and a dummy commitment a _i for i = t + 1,..., N, and then an n−t degree polynomial f (x), i = 1,. , T, a challenge c _i and a response e _i are generated, and a signature σ (m) is generated. The signature σ (m) is a commitment a _i acquired from t participating devices 910-i (i = 1,..., T) and a commitment a _i (i = t + 1,...) Generated as a dummy by the signature generation unit 920. , N), etc., and not only the signature generation with which t people cooperated, but also the signature with which it is not known which t people cooperated.

The signature verification unit 930 may be provided in any apparatus that wishes to perform signature verification. The signature verification unit verifies that the degree of the polynomial f (x) is n−t and that the values of the challenges c _i (i = 1,..., N) and f (0) are correct.
FIG. 2 is a diagram illustrating a functional configuration example of the participation apparatus 910-i. Participating device 910-i includes key generation unit 911-i, random number generation unit 912-i, recording unit 913-i, and communication unit 914-i. FIG. 3 is a diagram illustrating a processing flow of the key generation unit 911-i, and FIG. 4 is a diagram illustrating a processing flow of the random number generation unit 912-i.

The key generation unit 911-i includes a secret key x _i generation unit 9111-i and a public key y _i generation unit 9112-i. An example of a specific key generation method in the key generation unit 911-i is shown below. In the secret key x _i generating means 9111-i, one element is randomly selected with equal probability from the remainder class Z _q modulo _q as a secret key x _i (x _i ∈ _U Z _q ) (S9111), the secret key _{x i} is recorded in the recording unit 913-i (S9112). The public key y _i generating means 9112-i uses the element g of the cyclic group G determined in advance,

により公開鍵ｙ_ｉ（ｙ_ｉ∈Ｇ＝{１，ｇ，ｇ^２，…，ｇ^ｑ−１}）を生成し（Ｓ９１１３）、公開鍵ｙ_ｉを記録部９１３−ｉに記録する（Ｓ９１１４）。ここで、巡回群Ｇは、離散対数問題が難しい群から選ばれているため、公開鍵ｙ_ｉと元ｇが分かっても、秘密鍵ｘ_ｉは分からない。このように生成された公開鍵ｙ_ｉは、元ｇの情報とともに通信部９１４−ｉを介して公開される。

To generate a public key y _i (y _i ∈ G = {1, g, g ² ,..., G ^q−1 }) (S9113), and records the public key y _i in the recording unit 913-i (S9114). . Here, since the cyclic group G is selected from a group in which the discrete logarithm problem is difficult, even if the public key y _i and the element g are known, the secret key x _i is not known. The public key y _i generated in this way is disclosed via the communication unit 914-i together with the information of the original g.

Random number generation unit 912-i is a component which operates when cooperating in signature generation, random number _{r i} generation means 9121-i, commitment _{a i} generation means 9122-i, challenge _{c i} acquisition unit 9123-i, and comprised in the response _{e i} generation means 9122-i. An example of a specific processing procedure in the random number generation unit 912-i is shown below. If the participants cooperate to signature, the random number r _i generation means 9121-i, a random number r _i selects one of the original randomly with equal probability from coset Z _q modulo q (r _i ∈ _U Z _q ) (S9121). Next, the commitment a _i generating means 9122-i uses the element g,

によりコミットメントａ_ｉ（∈Ｇ）を生成し（Ｓ９１２２）、コミットメントａ_ｉを記録部９１３−ｉに記録し、通信部９１４−ｉを介して署名生成部９２０を備える装置に送信する（Ｓ９１２３）。署名生成部９２０で署名生成処理が行われると、署名生成部９２０の計算部９２２の処理過程で生成されたチャレンジｃ_ｉが署名生成部９２０から、署名生成に協力している参加装置９１０−ｉ（ｉ＝１，…，ｔ）に送信される。このチャレンジｃ_ｉをチャレンジｃ_ｉ取得手段９１２３−ｉで取得し（Ｓ９１２４）、記録部９１３−ｉに記録する（Ｓ９１２５）。また、レスポンスｅ_ｉ生成手段９１２２−ｉで、ｅ_ｉ：＝ｒ_ｉ−ｃ_ｉｘ_ｉ（ｅ_ｉ∈Ｚ_ｑ）により、ｅ_ｉ（ｉ＝１，…，ｔ）を求め（Ｓ９１２６）、記録部９１３−ｉに記録するとともに署名生成部９２０に送信する（Ｓ９１２７）。

To generate a commitment a _i (∈G) (S9122), record the commitment a _i in the recording unit 913-i, and transmit it to the apparatus including the signature generation unit 920 via the communication unit 914-i (S9123). If the signature generation processing is performed in the signature generation unit 920, from the challenge c _i is the signature generation unit 920 generated in the process of calculating unit 922 of the signature generation unit 920, participants are collaborating in the signature generating apparatus 910-i (I = 1,..., T). Gets the challenge _{c i} a challenge _{c i} acquisition unit 9123-i (S9124), and records in the recording unit 913-i (S9125). Further, the response _{e i} generation means _9122-i, e _i: = the _{r i -c i x i (e} i ∈Z q), e i (i = 1, ..., t) and calculated (S9126), recording The information is recorded in the part 913-i and transmitted to the signature generation part 920 (S9127).

FIG. 5 shows a functional configuration example of the signature generation unit 920. The signature generation unit 920 includes a dummy generation unit 921, a calculation unit 922, an information acquisition unit 923, a recording unit 924, and a communication unit 925. FIG. 6 is a diagram showing a processing flow of the signature generation unit 920.
The signature generation unit 920 generates a signature σ (m) by the following procedure. Public key _{y i (i = 1, ...} , n) of the information acquisition unit 923 via the communication unit 925 by acquiring unit 9231, obtains the public key _{y i} participating device 910-i (i = 1, ..., n) (S9231). The dummy generation unit 921 generates a dummy response e _i , a dummy challenge c _i , and a dummy commitment a _i (i = t + 1,..., N) as follows. The dummy response e _i and the dummy challenge c _i (i = t + 1,..., N) generation means 9211 selects an element at random with equal probability from the remainder class Z _q modulo q, and the dummy response e _i and the dummy challenge c _i (i = t + 1,..., n) (e _i , c _i ∈ _U Z _q ) (S9211), and the result is recorded in the recording unit 924 (S9212). Further, the dummy commitment a _i (i = t + 1,..., N) generation unit 9213 uses the element g and the public key y _i ,

によりダミーコミットメントａ_ｉ（ｉ＝ｔ＋１，…，ｎ）を生成し（Ｓ９２１５）、記録部９２４に記録する（Ｓ９２１６）。
また、通信部９２５を介して情報取得部９２３のコミットメントａ_ｉ（ｉ＝１，…，ｔ）取得手段９２３２により、参加装置９１０−ｉ（ｉ＝１，…，ｔ）のコミットメントａ_ｉを取得する（Ｓ９２３２）。

The dummy commitment a _i (i = t + 1,..., N) is generated (S9215) and recorded in the recording unit 924 (S9216).
The commitment _{a i (i = 1, ...} , t) in the information acquisition unit 923 via the communication unit 925 by acquiring unit 9232, acquires the commitment _{a i} participating device 910-i (i = 1, ..., t) (S9232).

Next, the calculation unit 922 obtains the (t, n) threshold signature σ (m) of the message m as follows. The n-th order polynomial f (x) calculating means 9221 causes the n-th order polynomial f (x) (f (x) = α ₀ + α ₁ x + α ₂ x ² +... + α _n−t x ^n−t , α _j ∈ Z _q ), and f (0) = H (t, n, y ₁ ,..., y _n , a ₁ ,..., a _n , m) and f (i) = c _i (i = t + 1, .., N) is calculated from the condition of α _j (j = 0,..., Nt) to obtain an nt degree polynomial f (x) (S9221). Further, the obtained nt degree polynomial f (x) is recorded in the recording unit 924 (S9222). Challenge _{c i (i = 1, ...} , t) in the generator _9222, c i: = the f (i), the challenge _{c i (i = 1, ...} , t) and calculated (S9223), the recording unit 924 to with challenge _{c i} participating device corresponding to the 910-i (i = 1, ..., t) to send a challenge _{c i} (S9224). Each participant device 910-i (i = 1,..., T) generates the response e _i as described above using the transmitted challenge c _i and transmits it to the signature generation unit 920 (S9124 to S9127). . Therefore, the response e _i (i = 1,..., T) acquisition unit 9223 acquires the response e _i (i = 1,..., T) (S9225) and records it in the recording unit 924 (S9226). The signature σ (m) creating means 9223 obtains σ (m) from σ (m) = (t, n, f, c ₁ ,..., C _n , e ₁ ,..., E _n ) (S9227), Recording is performed in the recording unit 924 (S9228). In this way, the (t, n) threshold signature σ (m) for the message m is obtained.

FIG. 7 shows a functional configuration example of the signature verification unit 930. FIG. 8 shows a flow for verifying the signature σ (m) in the signature verification unit 930. The information acquisition unit 933 acquires the public key y _i (i = 1,..., N) and the signature σ (m) (S933), and the degree confirmation unit 931 of the polynomial f (x) determines the degree of the polynomial f (x). Is nt (S931), challenge c _i , polynomial f (0) confirmation means 932,

であることを確認する（Ｓ９３２）。
このように署名σ（ｍ）の生成と検証を行うことで、署名検証部９３０（署名検証をする人）は、少なくともｔ台の参加装置９１０−ｉ（ｔ人の参加者）が協力して署名を作成したことが確認できる。また、署名検証部９３０は、ｎ台の参加装置９１０−ｉ中のどのｔ台（ｎ人の参加者中のどのｔ人）が署名生成に協力したのかは分からない。
[CDS94] R. Cramer and I. Damgard and B. Schoen-makers, Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols, CRYPTO ’94, pp. 174-187, 1994.

(S932).
By generating and verifying the signature σ (m) in this way, the signature verification unit 930 (the person who performs the signature verification) cooperates with at least t participating devices 910-i (t participants). You can confirm that you have created a signature. In addition, the signature verification unit 930 does not know which t of the n participating devices 910-i (which t of the n participants) cooperated in generating the signature.
[CDS94] R. Cramer and I. Damgard and B. Schoen-makers, Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols, CRYPTO '94, pp. 174-187, 1994.

The prior art is characterized by the fact that it is not known which participant has cooperated in signature generation, but it has not been possible to prove that the participant has cooperated in signature generation (named out).
In addition, when it is possible to prove that the signature generation has been cooperated, it is also necessary to be able to confirm from the signature how many participants can be proved. Furthermore, since it is conceivable that secret key information may also be leaked when certifying cooperation in signature generation, there has been a problem that the conventional secret key and public key can no longer be used.

  An object of the present invention is to make it possible to use s number of participant devices (set S) included in n (n is an integer of 2 or more) participant devices (set N) without causing the private key and public key to become unusable. ) Provides a signature method by which it can be confirmed that the number of participant devices who have signed is not less than t (set T) and not more than t ′ (set T ′).

When the secret key and the public key are generated based on the discrete logarithm problem, the disposable public key and the public key are related by equalizing the discrete logarithm of the signer's disposable public key and public key.
Specifically, each participant device of the set S that performs signature generation generates the disposable public key σ _i (i∈S) so that the discrete logarithm is equal between the public key y _i and the disposable public key σ _i. To do. Further, the participant devices of the set S cooperate to generate the disposable public key σ _i (i∈T′-S) of the set T′-S. The disposable public key σ _i (i∈NT ′) of the set NT ′ is obtained by calculation using a t′-order polynomial determined from σ _i (i∈T ′). After generating the disposable public key in this way, a signature is created. Further, in some embodiments, it can be proved that each participant device is a signed participant by proving that the discrete logarithm is equal.

  According to the present invention, the public key and the disposable public key are related because they have the same discrete logarithm and cannot impersonate the signer. Further, there is provided a signature method capable of confirming that the number of participant devices that have signed is t or more and t ′ or less when s participant devices included in the n participant devices have signed. be able to.

Embodiments of the present invention will be described below with reference to the drawings, but portions having the same functions are denoted by the same reference numerals in each of the drawings, and redundant description is omitted. Further, in the following explanation, the cyclic group considered to be difficult to be a discrete logarithm is G, the generator of G is g, the order of R, the order of G is q, and the remainder class {0, 1, modulo q 2,..., Q-1} are Z _q , g and R are public parameters, H and H ′ are hash functions that map a bit string consisting of 0 and 1 to G, and H ″ is a bit string consisting of 0 and 1 Is a hash function that maps to Z _q , and m is a message, where a _N means {a _i } _i∈N .
[First Embodiment]
FIG. 9 shows a system configuration example of the present invention. The s participant devices 110-i (set S) included in the n (n is an integer of 2 or more) participant devices (set N) cooperate to sign. Signing in cooperation means that a signature cannot be determined by the allegedness of one participant device, and a signature is created using all information sent from each participant device 110-i in the set S. It is. Therefore, a device for gathering these pieces of information is necessary, and the signature generation unit 120 performs this in FIG. This signature generation unit 120 may be a single device or may be provided inside any participant device in set N. Alternatively, each of the participant devices may be provided and a different signature generation unit may collect information and create a signature each time a signature is applied. In addition, the present invention provides a signature method capable of confirming that the number of participant devices that have signed is t or more (set T) and t ′ (set T ′) or less. In this embodiment, each participant device in set N can prove whether it is a signed participant device or an unsigned participant device.

FIG. 10 shows a functional configuration example of the participant device 110-i. Participant devices 110-i is the private key _{x i} and a public key _{y i} and generating a key generation unit 911-i, the key generation unit 112-i for generating a disposable public key from the private key _{x i,} any _{Z q} of selecting the original _{w i w i} generation means 1131-i, _a i · _{b i} generation means 1132-i to generate a _{a i} and _{b i} from _{w i,} the original _{z i} of _{Z q,} the secret key _{x i} Z _i generating means 1134-i to be used for calculation, set selection information generating means 1135-i for generating set selection information for selecting sets T and T ′, and r which is a bit string of 0 and 1 is selected. R selection information generation means 1136-i for generating r selection information for generation, σ selection information generation means 1137-i for generating σ selection information for selecting disposable public keys of the set T′-S, arbitrary _z i · _{c i} selection information for selecting the original _{z i} and _{c i} of Z _q Generating means 1138-i of the generated _z i · _{c i} selection information, publish generating means 1139-i, the information of _{c i} selection information to generate a _{c i} selection information for selecting the original _{c i} of any _{Z q} Alternatively, it includes a communication / disclosure unit 115-i that transmits to other participant devices and the signature generation unit of the set S, and a recording unit 114-i that records information.

FIG. 11 shows a functional configuration example of the signature generation unit 120. Based on the set selection information from each participant device 110-i in the set S, the signature generation unit 120 sets the set T that satisfies T⊆S⊆T'⊆N and the participant device that is the origin of the set T ′. Based on the r selection information from the set T, T ′ selection means 1211 and the participant devices 110-i of the set S, the r selection means 1212 for selecting r and the participant devices 110 of the set S Based on the σ selection information from -i, σ _i selection means 1213 for selecting disposable public keys of the set T′-S, and z _i · c _i selection information from each participant device 110-i of the set S based, on the basis of _{c i} selection information from _{z i} and _z i · _{c i} selecting means 1214 for selecting a _{c i,} each participant device 110-i of the set S of the set N-S, the set S- C _i selection means 1215 for selecting c _i of T, generates a _i and b _i of set _NS from z _i and c _i a _i · b _i generating means 1216, σ _i calculating means 1222 for calculating the disposable public key σ _i of the set NT ′ from the disposable public key of the set T ′, an element of Z _q , and the order (n− beta calculating polynomial t) beta a (x) (x) calculation means 1223, a _{signature, r, a 1, ...,} a t ', β (x), z 1, ..., generated using _{z n} It comprises a signature output unit 124, a communication unit 123 that communicates with other devices, and a recording unit 125 that records information.

FIG. 12 shows a functional configuration example of the signature verification unit 130. The signature verification unit 130 is provided inside an arbitrary apparatus that wants to perform signature verification. Also, the signature verification unit 130, n, t, t ', the public key _{y N = {y 1, ...} , y n} of each participant device set N, the message m, the signature σ = _{(r, A 1,} .., A _{t ′} , β (x), z ₁ ,..., Z _n ) and output a verification result, h = H (n, t, t ′, y _N , m, r) _{, a 0 = H '(n} , t, t', y n, m, r) as it r is 0 and 1 of the bit string of k _{bits, h, a 0, ...,} a t ' is the group G , I, _i, (i = 1,..., N) are G elements, and z ₁ ,..., Z _n are Z _q elements. Value for money confirmation unit 1312 and _{a n} confirmation that _{a i '= {a 1'} , ..., a n '}, b n' = {b 1 ', ..., b n'} sought, β (x) is Z _q is an original, and it is n-t Next, beta (0) = "(N, t, t ' , y N, m, r, h, A 0, ..., A t', a N ', b N') proper confirmation means of β to make sure that it is a (x) 1313 It consists of.

FIG. 13 shows a processing flow of the electronic signature system. Hereinafter, the processing flow will be described with reference to FIG.
The key generation unit 911-i of each participant device 110-i (i = 1,..., N) of the set N generates a secret key x _i and a public key y _i and discloses the public key y _i ( S310). The set selection information generation means 1135-i of each participant device 110-i (set S, i = 1,..., S) participating in the signature has the sets T and T satisfying T⊆S⊆T′⊆N. The group selection information for selecting 'is generated, and the group selection information is transmitted to the other participant devices and the signature generation unit of the group S (S320). A set T, T ′ selection means 1211 of the signature generation unit 120 selects an arbitrary set T and a participant device that is a source of the set T ′ based on the set selection information from each participant device of the set S. And it transmits to the participant apparatus of the set S (S330). Here, “selecting an arbitrary set T and a participant apparatus that is a base of the set T ′ based on the set selection information” means that the participant apparatus 110-i of the set S (set S, i = 1). ,..., S) means that an arbitrary set is selected using all the s set selection information sent from. In other words, it means that the set T and the set T ′ are not selected by the allegory of the participant apparatus 110-i having the limited set S. Further, the set selection information may be an appropriate numerical value as long as it is not a fixed numerical value, and may be generated by a random number or the like. Hereinafter, the phrase “select using selection information” has the same meaning. Note that the original number of the set T is t, and the original number of the set T ′ is t ′. Further, let the elements of the set T ′ be k ₁ ,..., K _{t ′} . The r selection information generation means 1136-i of each participant device 110-i (i = 1,..., S) of the set S selects r selection information for selecting r that is a bit string of 0 and 1 of k bits. Is transmitted to the other participant devices 110-i and the signature generation unit 120 of the set S (S340). The r selection means 1212 of the signature generation unit 120 selects an arbitrary r that is a bit string of 0 and 1 of k bits based on the r selection information from each participant apparatus 110-i of the set S, and sets It transmits to the participant apparatus 110-i of S (S350). In the key generator 112-i of each participant device 110-i (i = 1,..., S) of the set S, the disposable public key σ _i (i = 1,.

により生成し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ３６０）。集合Ｓの各参加者装置１１０−ｉ（ｉ＝１，…，ｓ）のσ選定情報の生成手段１１３７−ｉで、集合Ｔ’−Ｓの使い捨て公開鍵σ_ｉ（ｉ∈Ｔ’−Ｓ）を選定するためのσ選定情報を生成し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ３７０）。署名生成部１２０のσ_ｉ選定手段１２１３で、集合Ｓの各参加者装置１１０−ｉからの前記σ選定情報をもとに、任意の集合Ｔ’−Ｓの使い捨て公開鍵σ_ｉ（ｉ∈Ｔ’−Ｓ）を選定し、集合Ｓの参加者装置１１０−ｉに送信する（Ｓ３８０）。署名生成部１２０のσ_ｉ計算手段１２２２で、集合Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｔ’、ｉ＝ｋ_１，…，ｋ_ｔ’）から、

And transmitted to the other participant devices 110-i and the signature generation unit 120 in the set S (S360). The disposable public key σ _i (i∈T′-S) of the set T′-S is generated by the generation means 1137-i of the σ selection information of each participant device 110-i (i = 1,..., S) of the set S. Is selected and transmitted to the other participant devices 110-i of the set S and the signature generation unit 120 (S370). Based on the σ selection information from each participant device 110-i in the set S, the σ _i selection unit 1213 of the signature generation unit 120 uses the disposable public key σ _i (i∈T) of any set T′-S. '-S) is selected and transmitted to the participant device 110-i in the set S (S380). From the σ _i calculation means 1222 of the signature generation unit 120, from the disposable public key σ _i (i∈T ′, i = k ₁ ,..., K _{t ′} ) of the set T ′,

として、Ａ_ｉ（ｉ＝０，…，ｔ'）を
Ａ_０＝Ｈ’（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｒ）

A _i (i = 0,..., T ′) A ₀ = H ′ (n, t, t ′, y _N , m, r)

と定め、

And

として集合Ｎ−Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｎ−Ｔ’）を計算し、集合Ｓの参加者装置１１０−ｉに送信する（Ｓ３９０）。ステップＳ３９０の処理内容について説明する。
Ａ_０＝ｈ^α（０）
ただし、Ａ_０＝Ｈ’（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｒ）
と、
σ_ｉ＝ｈ^α（ｉ）
ただし、ｉ＝ｋ_１，…，ｋ_ｔ’
が成り立つ次数ｔ’の多項式α（ｘ）を求める。そして、α（ｘ）から、集合Ｎ−Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｎ−Ｔ’）を、
σ_ｉ＝ｈ^α（ｉ）
により求める。このように使い捨て公開鍵σ_ｉ（ｉ∈Ｎ）求めることによって、集合Ｎの全ての参加者装置１１０−ｉの使い捨て公開鍵σ_ｉが、σ_ｉ＝ｈ^α（ｉ）を満たす。ところが、α（ｘ）の次数がｔ’であることから、署名に参加した参加者装置１１０−ｉはｔ’以下であることは分かる。しかし、全てのｉ（ｉ＝１，…，ｎ）に対してσ_ｉ＝ｈ^α（ｉ）が成り立つので、どの参加者装置１１０−ｉが署名に参加したのかは分からない。ただし、実際にはＡ_０はＨ’で生成されているから、離散対数α（０）が分からない。したがって、α（ｘ）を直接求めることはできない。そこで、ステップＳ３９０では、Ａ_ｉを用いて計算している。

The disposable public key σ _i (iεN−T ′) of the set NT ′ is calculated and transmitted to the participant device 110-i of the set S (S390). The processing content of step S390 will be described.
A ₀ = h ^{α (0)}
However, A ₀ = H ′ (n, t, t ′, y _N , m, r)
When,
σ _i = h ^{α (i)}
However, i = k ₁ ,..., K _{t ′}
A polynomial α (x) of the order t ′ that holds is obtained. Then, from α (x), the disposable public key σ _i (i∈NT ′) of the set NT ′ is obtained.
σ _i = h ^{α (i)}
Ask for. By obtaining such disposable public key σ _i (i∈N), disposable public key sigma _i of all participant devices 110-i of the set N satisfies the ^{_{σ i = h α (i)}} . However, since the degree of α (x) is t ′, it can be understood that the participant device 110-i participating in the signature is equal to or less than t ′. However, since σ _i = h ^{α (i)} holds for all i (i = 1,..., N), it is not known which participant device 110-i participated in the signature. However, since A ₀ is actually generated by H ′, the discrete logarithm α (0) is not known. Therefore, α (x) cannot be obtained directly. Therefore, in step S390, calculation is performed using A _i .

In the following step, "I know the secret key _{x i, log g y i =} x i = log h σ i is true i is equal to or greater than t." To prove that. First, in _{w i} generation means 1131-i of the respective participant devices 110-i of the set S, selects the original _{w i} for any _{Z q} (S400). In the a _i · b _i generation means 1132-i of each participant device 110-i of the set S

によってａ_ｉとｂ_ｉとを生成し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ４１０）。集合Ｓの各参加者装置１１０−ｉのｚ_ｉ・ｃ_ｉ選定情報の生成手段１１３８−ｉで、任意のＺ_ｑの元ｚ_ｉと元ｃ_ｉを選定するためのｚ_ｉ・ｃ_ｉ選定情報を生成し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ４２０）。署名生成部１２０のｚ_ｉ・ｃ_ｉ選定手段１２１４で、前記ｚ_ｉ・ｃ_ｉ選定情報をもとに、集合Ｎ−Ｓのｚ_ｉとｃ_ｉ（ｉ∈Ｎ−Ｓ）を選定し、ａ_ｉ・ｂ_ｉ生成手段１２１６で、

To generate a _i and b _i and transmit them to the other participant devices 110-i and the signature generation unit 120 of the set S (S410). Generating means 1138-i, _z i · _{c i} selection information for selecting the original _{z i} and the original _{c i} of any _{Z q} of _z i · _{c i} selection information for each participant device 110-i of the set S Is transmitted to the other participant devices 110-i and the signature generation unit 120 of the set S (S420). The z _i · c _i selection means 1214 of the signature generation unit 120 selects z _i and c _i (iεN−S) of the set NS based on the z _i · c _i selection information, and a _i · b _i generation means 1216

により集合Ｎ−Ｓのａ_ｉとｂ_ｉ（ｉ∈Ｎ−Ｓ）とを生成し、生成したａ_ｉとｂ_ｉとを集合Ｓの参加者装置１１０−ｉに送信する（Ｓ４３０）。集合Ｓの各参加者装置１１０−ｉのｃ_ｉ選定情報の生成手段１１３９−ｉで、任意のＺ_ｑの元ｃ_ｉを選定するためのｃ_ｉ選定
情報を生成し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ４４０）。署名生成部１２０のｃ_ｉ選定手段１２１５は、集合Ｓの各参加者装置の前記ｃ_ｉ選定情報生成ステップで生成されたｃ_ｉ選定情報をもとに、集合Ｓ−Ｔのｃ_ｉ（ｉ∈Ｓ−Ｔ）を選定し、集合Ｓの参加者装置１１０−ｉに送信する（Ｓ４５０）。署名生成部１２０のβ（ｘ）計算手段１２２３は、
β（０）＝Ｈ”（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｒ，ｈ，Ａ_０，…，Ａ_ｔ’，ａ_Ｎ，ｂ_Ｎ）
β（ｉ）＝ｃ_ｉ
ただし、ｉ∈Ｎ−Ｔ
を満足するＺ_ｑの元であって、次数（ｎ−ｔ）の多項式β（ｘ）を求め、集合Ｓの参加者装置１１０−ｉに送信する（Ｓ４６０）。集合Ｓの各参加者装置１１０−ｉのｚ_ｉ生成手段１１３４−ｉは、
ｚ_ｉ＝ｗ_ｉ−β（ｉ）ｘ_ｉ
によってＺ_ｑの元ｚ_ｉを計算し、集合Ｓの他の参加者装置１１０−ｉおよび署名生成部１２０に送信する（Ｓ４７０）。署名生成部１２０の署名出力部１２４で、署名を、ｒ，Ａ_１，…，Ａ_ｔ’，β（ｘ），ｚ_１，…，ｚ_ｎを用いて生成する（Ｓ４８０）。なお、説明が冗長となるため説明上は省略しているが、各ステップで生成、計算、受信された情報は、処理のたびに記録部１１４−ｉまたは１２５に記録され、利用される情報は記録部１１４−ｉまたは１２５から読み出される。このような処理によって、α（ｘ）がｔ’次であること、β（ｘ）が（ｎ−ｔ）次であることから、ｔ台以上ｔ’台以下の参加者装置が署名に参加したことを確認できる署名を生成できる。

To generate a _i and b _i (iεN−S) of the set NS, and transmit the generated a _i and b _i to the participant device 110-i of the set S (S430). In generating means 1139-i of _{c i} selection information for each participant device 110-i of the set S, and generates a _{c i} selection information for selecting the original _{c i} of any _{Z q,} other participants of the set S To the user device 110-i and the signature generation unit 120 (S440). _{C i} selecting means 1215 of the signature generation unit 120, based on the _{c i c i} selection information generated by the selection information generating step of the respective participant devices of the set S, _c i of the set S-T (i ∈ ST) is selected and transmitted to the participant device 110-i in the set S (S450). The β (x) calculation means 1223 of the signature generation unit 120 is
β (0) = H ″ (n, t, t ′, y _N , m, r, h, A ₀ ,..., A _{t ′} , a _N , b _N )
β (i) = c _i
However, i∈N−T
A _{Z q} of the original that satisfies the polynomial β seek (x) of degree (n-t), and transmits the participant device 110-i of the set S (S460). The z _i generating means 1134-i of each participant device 110-i of the set S is
z _i = w _i −β (i) x _i
To calculate the element z _{i of} Z _q and transmit it to the other participant devices 110-i of the set S and the signature generation unit 120 (S470). The signature output unit 124 of the signature generation unit 120 generates a signature using r, A ₁ ,..., A _{t ′} , β (x), z ₁ ,..., Z _n (S480). Although the explanation is redundant, it is omitted in the explanation, but the information generated, calculated, and received at each step is recorded in the recording unit 114-i or 125 every time processing is performed, and the information to be used is Read from the recording unit 114-i or 125. By such processing, since α (x) is t′-order and β (x) is (nt) order, participant devices from t to t ′ participants participated in the signature. You can generate a signature that can be confirmed.

Next, a processing flow in the signature verification unit 130 will be described. In the communication unit 132 of the signature verification unit 130, in the communication unit 132, n, t, t ′, the public key y _N = {y ₁ ,..., Y _n } of each participant device in the set N, the message m, the signature σ = (R, A ₁ ,..., A _{t ′} , β (x), z ₁ ,..., Z _n )
h = H (n, t, t ′, y _N , m, r)
A ₀ = H ′ (n, t, t ′, y _N , m, r)
, R is a bit string of 0 and 1 of k bits, h, A ₀ ,..., At _′ are elements of group G, z ₁ ,..., Z _n are _elements of Z _q It is confirmed that there is (S490). Proper confirmation section 1312 of A _i is,

で求められるσ_ｉ（ｉ＝１，…，ｎ）がＧの元であることを確認する（Ｓ５００）。このステップで、Ａ_ｉがｉ＝０，…，ｔ’の（ｔ’＋１）個しかないことから、署名に参加した参加者装置１１０−ｉがｔ’台以下であることも確認される。次に、β（ｘ）の適正確認部１３１３は、

It is confirmed that σ _i (i = 1,..., N) obtained in (1) is an element of G (S500). At this step, since there are only (t ′ + 1) A _i with i = 0,..., T ′, it is also confirmed that the number of participant devices 110-i participating in the signature is t ′ or less. Next, the appropriateness confirmation unit 1313 for β (x)

としてａ_Ｎ’＝｛ａ_１’，…，ａ_ｎ’｝，ｂ_Ｎ’＝｛ｂ_１’，…，ｂ_ｎ’｝を求め、β（ｘ）の係数がＺ_ｑの元であること、β（ｘ）がｎ−ｔ次であること、およびβ（０）＝Ｈ”（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｒ，ｈ，Ａ_０，…，Ａ_ｔ’ ，ａ_Ｎ’，ｂ_Ｎ’）であるこ
とを確認する（Ｓ５１０）。このステップで、β（ｘ）が（ｎ−ｔ）次であることから、
署名に参加した参加者装置１１０−ｉがｔ台以上であることが確認される。通信部１３２は、ステップＳ４９０からＳ５１０の確認結果がすべてＯＫであれば、署名が正しいことを出力し、そうでないときは署名は正しくないことを出力する（Ｓ５２０）。

A _N ′ = {a ₁ ′,..., A _n ′}, b _N ′ = {b ₁ ′,..., B _n ′}, and the coefficient of β (x) is an element of Z _q β (x) is nt order, and β (0) = H ″ (n, t, t ′, y _N , m, r, h, A ₀ ,..., A _{t ′} , a _N ′ , B _N ′) (S510) Since β (x) is (n−t) th order at this step,
It is confirmed that there are t or more participant devices 110-i participating in the signature. The communication unit 132 outputs that the signature is correct if all the confirmation results in steps S490 to S510 are OK, and otherwise outputs that the signature is not correct (S520).

In addition, each participant device 110-i (iεS) of the set S is
log _g (y _i ) = log _h (σ _i )
For example, reference ([Cha90] David Chaum, Zero-Knowledge Undeniable Signatures,
You can prove that you participated in the signature by proof by the method of EUROCRYPT 1990, pp.458-464, 1990. Each participant device 110-i (iεN-S) of the set NS is
log _g (y _i ) ≠ log _h (σ _i )
Can be proved not to participate in the signature (S530).

By such processing, when s participant devices included in n participant devices (n is an integer of 2 or more) have signed, there are t or more participant devices that have signed the signature. An electronic signature that can be confirmed as follows can be generated.
[Second Embodiment]
FIG. 14 shows a system configuration example of the present invention. The s participant devices 110-i (set S) included in the n (n is an integer of 2 or more) participant devices (set N) cooperate to sign. In addition, a signature method is provided by which it can be confirmed from the signature that there are t or more (set T) t ′ (set T ′) or less participant devices that have signed. The difference from the first embodiment is that in this embodiment, each participant device of the set N cannot prove whether it is a signed participant device or an unsigned participant device.

FIG. 15 shows a functional configuration example of the participant device 210-i. The participant apparatus 210-i includes a key generation unit 911-i that generates a secret key x _i and a public key y _i, and an h generation unit 2121-i and x _i ′.
A key generation unit 212-i that has a generation unit 2122-i and a disposable public key σ _i generation unit 2123-i, and generates a disposable public key from the secret keys x _i and x _i ′; an element w _{i of} any Z _q And w _i 'are selected w _i · w _i ' generating means 2131-i, a _i and b _i generating means 2133-i that generate a _i and b _i from w _i and w _i ', z _{q element} z 'the secret key _{x i} and _{x i' i} and _{z i} to produce a set selection information for selecting _z i · _{z i} 'generating unit 2135-i, the set T and T' calculated using the set Selection information generation means 1135-i, σ _i selection information generation means 1137-i for generating σ _i selection information for selecting a disposable public key of the set T′-S, an arbitrary z _q element z _i and generating a · _{c i} selection information _{'z i} · _z i for selecting the _{c i' z i z i ·} z i '· c i Generating means 2137-i of the selection information, other participants of any _{Z q} of the original _c generator 1139-i of _{c i} selection information to generate a _{c i} selection information _{for i} to select a public information or set S A communication / publication unit 215-i that transmits to the user device and the signature generation unit, and a recording unit 214-i that records information.

FIG. 16 shows a functional configuration example of the signature generation unit 220. Based on the set selection information from each participant device 210-i in the set S, the signature generation unit 220 sets the set T that satisfies T⊆S⊆T'⊆N and the participant device that is the origin of the set T ′. A set T, T ′ selection means 1211 for selecting a σ _i selection means 1213 for selecting a disposable public key of the set T′-S based on the σ selection information from each participant apparatus 210-i of the set S, 'based on · _{c i} selection information, _{z i} and _{z i} of the set N-S' _z i · _{z i} from each participant device set S _z i · _{z i} '· c to select a _{c i i} selecting means 2211, the _{c i} selection information from each participant devices 210-i of the set S based, _{c i} selecting means 2213 for selecting a _{c i} of the set S-T, _{z i} and _{z i} 'and c _{a i} · _b i generation means 2216 for generating a _{a i} and _{b i} of the set N-S from _i, the set T 'from disposable public key, set N-T' A disposable public key sigma sigma _i calculating unit _{2222 i} calculating a, _{Z q} of original order (n-t) of the polynomial beta (x) to calculate the beta (x) calculation means 2223, a signature, _{A 1 , ..., a t ', β} (x), z 1, ..., z n, z 1', ..., the signature output unit 224 generated using _{z n} ', the communication unit 223 for communicating with other devices, It comprises a recording unit 225 that records information.

FIG. 17 shows a functional configuration example of the signature verification unit 230. The signature verification unit 230 is provided inside an arbitrary apparatus that wishes to perform signature verification. The signature verification unit 230 also includes n, t, t ′, the public key y _N = {y ₁ ,..., Y _n } of each participant device in the set N, the message m, the signature σ = (r, A ₁ , .., A _{t ′} , β (x), z ₁ ,..., Z _n , z ₁ ′,..., Z _n ′) are received, and a communication unit 232 that outputs a verification result, h = H (n, t, t ′, y _N , m), A ₀ = H ′ (n, t, t ′, y _N , m), h, A ₀ ,..., A _{t ′} are elements of the group G, z ₁ ,..., Z _n , z ₁ ′,..., Z _n ′ are group _q validity checking means 2311 and σ _i (i = 1,..., N) are G elements. proper check means 2312 and _{a n} of _{a i} to ensure that _{'= {a 1', ...} , a n '}, b n' = {b 1 ', ..., b n'} sought, β (x) it There is the original _{Z q,} and a n-t Next, β (0) = H " (n, _{, T ', y N, m} , h, A 0, ..., A t', a N ', b N') to verify that the beta (x) proper check means 231
3.

FIG. 18 shows a processing flow of the electronic signature system in the second embodiment. Hereinafter, the processing flow will be described with reference to FIG.
Steps S310 to S330 are the same processing as in the first embodiment. Then each participant devices 210-i of the set S (i = 1, ..., s) ' in the generation unit 2122-i, based on _{x i} of any _{Z q' x i} of selecting (S610). In the key generation unit 212-i of each participant device 210-i of the set S, the disposable public key σ _i (i = 1,..., S) is

により生成し、集合Ｓの他の参加者装置２１０−ｉおよび署名生成部２２０に送信する（Ｓ６２０）。ステップＳ３７０とステップＳ３８０は、第１実施形態と同じである。次に、署名生成部２２０のσ_ｉ計算手段２２２２は、集合Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｔ’、ｉ＝ｋ_１，…，ｋ_ｔ’）から、

And transmitted to the other participant devices 210-i and the signature generation unit 220 in the set S (S620). Step S370 and step S380 are the same as in the first embodiment. Next, the σ _i calculating means 2222 of the signature generation unit 220 uses the disposable public key σ _i (i∈T ′, i = k ₁ ,..., K _{t ′} ) of the set T ′.

として、Ａ_ｉ（ｉ＝０，…，ｔ'）を
Ａ_０＝Ｈ’（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ）

A _i (i = 0,..., T ′) as A ₀ = H ′ (n, t, t ′, y _N , m)

と定め、

And

として集合Ｎ−Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｎ−Ｔ’）を計算し、集合Ｓの参加者装置２１０−ｉに送信する（Ｓ６３０）。ステップＳ６３０の処理内容について説明する。
Ａ_０＝ｈ^α（０）Ｒ^{α’（０）}
ただし、Ａ_０＝Ｈ’（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ）
と、
σ_ｉ＝ｈ^α（ｉ）Ｒ^{α’（ｉ）}
ただし、ｉ＝ｋ_１，…，ｋ_ｔ’
が成り立つ次数ｔ’の多項式α（ｘ）とα’（ｘ）を求める。そして、α（ｘ）とα’（ｘ）から、集合Ｎ−Ｔ’の使い捨て公開鍵σ_ｉ（ｉ∈Ｎ−Ｔ’）を、
σ_ｉ＝ｈ^α（ｉ）Ｒ^{α’（ｉ）}
により求める。このように使い捨て公開鍵σ_ｉ（ｉ∈Ｎ）求めることによって、集合Ｎの全ての参加者装置２１０−ｉの使い捨て公開鍵σ_ｉが、σ_ｉ＝ｈ^α（ｉ）Ｒ^{α’（ｉ）}を満たす。ところが、α（ｘ）とα’（ｘ）の次数がｔ’であることから、署名に参加した参加者装置２１０−ｉはｔ’以下であることは分かる。しかし、全てのｉ（ｉ＝１，…，ｎ）に対してσ_ｉ＝ｈ^α（ｉ）Ｒ^{α’（ｉ）}が成り立つので、どの参加者装置２１０−ｉが署名に参加したのかは分からない。ただし、実際にはＡ_０はＨ’で生成されているから、離散対数α（０）、α’（０）が分からない。したがって、α（ｘ）とα’（ｘ）を直接求めることはできない。そこで、ステップＳ３９０では、Ａ_ｉを用いて計算している。

The disposable public key σ _i (iεN−T ′) of the set NT ′ is calculated and transmitted to the participant device 210-i of the set S (S630). The processing content of step S630 will be described.
A ₀ = h ^{α (0)} R ^{α ′ (0)}
However, A ₀ = H ′ (n, t, t ′, y _N , m)
When,
σ _i = h ^{α (i)} R ^{α ′ (i)}
However, i = k ₁ ,..., K _{t ′}
The polynomials α (x) and α ′ (x) of the order t ′ that holds is obtained. Then, from α (x) and α ′ (x), the disposable public key σ _i (i∈NT ′) of the set NT ′ is obtained.
σ _i = h ^{α (i)} R ^{α ′ (i)}
Ask for. By obtaining such disposable public key σ _i (i∈N), disposable public key sigma _i of all participant devices 210-i of the set N ^{_{is, σ i = h α (i}} ) R α '(i) Meet. However, since the orders of α (x) and α ′ (x) are t ′, it is understood that the participant device 210-i that participates in the signature is equal to or less than t ′. However, since σ _i = h ^{α (i)} R ^{α ′ (i)} holds for all i (i = 1,..., N), it is not known which participant device 210-i participated in the signature. Absent. However, since A ₀ is actually generated by H ′, the discrete logarithms α (0) and α ′ (0) are not known. Therefore, α (x) and α ′ (x) cannot be obtained directly. Therefore, in step S390, calculation is performed using A _i .

Next, 'the generated unit 2131-i, based on _{w i} and _{w i} for any _{Z q' w} i · _{w i} for each participant device 210-i of the set S is selected (S640). In the a _i · b _i generation means 2133-i of each participant device 210-i of the set S,

によってａ_ｉとｂ_ｉとを生成し、集合Ｓの他の参加者装置２１０−ｉおよび署名生成部２２０に送信する（Ｓ６５０）。集合Ｓの各参加者装置２１０−ｉのｚ_ｉ・ｚ_ｉ’・ｃ_ｉ選定情報の生成手段２１３７−ｉで、任意のＺ_ｑの元ｚ_ｉとｚ_ｉ’とｃ_ｉを選定するためのｚ_ｉ・ｚ_ｉ’・ｃ_ｉ選定情報を生成し、集合Ｓの他の参加者装置２１０−ｉおよび署名生成部２２０に送信する（Ｓ６６０）。署名生成部２２０のｚ_ｉ・ｚ_ｉ’・ｃ_ｉ選定手段２２１１で、前記ｚ_ｉ・ｚ_ｉ’・ｃ_ｉ選定情報をもとに、集合Ｎ−Ｓのｚ_ｉ、ｚ_ｉ’、ｃ_ｉ（ｉ∈Ｎ−Ｓ）を選定し、ａ_ｉ・ｂ_ｉ生成手段２２１６で、

To generate a _i and b _i and transmit them to the other participant devices 210-i and the signature generation unit 220 of the set S (S650). 'In generating means 2137-i of · _{c i} selection information, based on _{z i} and _{z i} of any _{Z q' z} i · _{z i} for each participant device 210-i of the set S for selecting and _{c i} z _i · z _i '· c _i selection information is generated and transmitted to the other participant devices 210-i and the signature generation unit 220 of the set S (S660). The z _i · z _i ′ · c _i selection means 2211 of the signature generation unit 220 uses the z _i · z _i ′ · c _i selection information to set z _i , z _i ′, c _{i of the set NS.} (I∈N−S) is selected, and the a _i · b _i generating means 2216

により集合Ｎ−Ｓのａ_ｉとｂ_ｉ（ｉ∈Ｎ−Ｓ）とを生成し、生成されたａ_ｉとｂ_ｉとを集合Ｓの参加者装置２１０−ｉに送信する（Ｓ６７０）。次のステップＳ４４０とＳ４５０とは第１実施形態と同じである。次に、署名生成部２２０のβ（ｘ）計算手段２２２３は、
β（０）＝Ｈ”（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｈ，Ａ_０，…，Ａ_ｔ’，ａ_Ｎ，ｂ_Ｎ）
β（ｉ）＝ｃ_ｉ
ただし、ｉ∈Ｎ−Ｔ
を満足するＺ_ｑの元であって、次数（ｎ−ｔ）の多項式β（ｘ）を求め、集合Ｓの参加者装置２１０−ｉに送信する（Ｓ６８０）。集合Ｓの各参加者装置２１０−ｉのｚ_ｉ・ｚ_ｉ’生成手段２１３５−ｉは、
ｚ_ｉ＝ｗ_ｉ−β（ｉ）ｘ_ｉ
ｚ_ｉ’＝ｗ_ｉ’−β（ｉ）ｘ_ｉ’
によってＺ_ｑの元ｚ_ｉとｚ_ｉ’を計算し、集合Ｓの他の参加者装置２１０−ｉおよび署名生成部２２０に送信する（Ｓ６９０）。署名生成部２２０の署名出力部２２４で、署名を、Ａ_１，…，Ａ_ｔ’，β（ｘ），ｚ_１，…，ｚ_ｎ，ｚ_１’，…，ｚ_ｎ’を用いて生成する（Ｓ７００）。なお、説明が冗長となるため説明上は省略しているが、各ステップで生成、計算、受信された情報は、処理のたびに記録部２１４−ｉまたは２２５に記録され、利用される情報は記録部２１４−ｉまたは２２５から読み出される。このような処理によって、α（ｘ）とα’（ｘ）がｔ’次であること、β（ｘ）が（ｎ−ｔ）次であることから、ｔ台以上ｔ’台以下の参加者装置が署名に参加したことを確認できる署名を生成できる。

To generate a _i and b _i (iεN−S) of the set NS, and transmit the generated a _i and b _i to the participant device 210-i of the set S (S670). The next steps S440 and S450 are the same as in the first embodiment. Next, the β (x) calculation unit 2223 of the signature generation unit 220
β (0) = H ″ (n, t, t ′, y _N , m, h, A ₀ ,..., A _{t ′} , a _N , b _N )
β (i) = c _i
However, i∈N−T
A _{Z q} of the original that satisfies the polynomial β seek (x) of degree (n-t), and transmits the participant device 210-i of the set S (S680). The z _i · z _i 'generating means 2135-i of each participant device 210-i of the set S is:
z _i = w _i −β (i) x _i
z _i ′ = w _i ′ −β (i) x _i ′
To calculate the elements z _i and z _i ′ of Z _q and transmit them to the other participant devices 210-i and the signature generation unit 220 of the set S (S690). The signature output unit 224 of the signature generation unit 220, _{signature, A 1, ..., A t} ', β (x), z 1, ..., z n, z 1', ..., is generated using the _{z n} ' (S700). Although the description is omitted because it is redundant, the information generated, calculated, and received in each step is recorded in the recording unit 214-i or 225 every time processing is performed, and the information to be used is It is read from the recording unit 214-i or 225. By such processing, α (x) and α ′ (x) are t′-th order, and β (x) is (nt) order. A signature can be generated that confirms that the device has joined the signature.

Next, a processing flow in the signature verification unit 230 will be described. In the communication unit 232 of the signature verification unit 130, n, t, t ' , the public key _{y N = {y 1, ...} , y n} of each participant device set N, the message m, the signature σ = _(A 1, _{..., a t ', β (} x), z 1, ..., z n, z 1', ..., receives the _{z n} '), a proper check unit 2311 of the group,
h = H (n, t, t ′, y _N , m)
A ₀ = H ′ (n, t, t ′, y _N , m)
, And confirm that h, A ₀ ,..., At _′ are elements of the group G, and that z ₁ ,..., Z _n , z ₁ ′, ..., z _n ′ are _elements of Z _q (S710). Proper confirmation section 2312 of A _i is,

で求められるσ_ｉ（ｉ＝１，…，ｎ）がＧの元であることを確認する（Ｓ７２０）。このステップで、Ａ_ｉがｉ＝０，…，ｔ’の（ｔ’＋１）個しかないことから、署名に参加した参加者装置２１０−ｉがｔ’台以下であることも確認される。次に、β（ｘ）の適正確認部２３１３は、

It is confirmed that σ _i (i = 1,..., N) obtained in (1) is an element of G (S720). At this step, since there are only (t ′ + 1) A _i with i = 0,..., T ′, it is also confirmed that the number of participant devices 210-i participating in the signature is t ′ or less. Next, the appropriateness confirmation unit 2313 for β (x)

としてａ_Ｎ’＝｛ａ_１’，…，ａ_ｎ’｝，ｂ_Ｎ’＝｛ｂ_１’，…，ｂ_ｎ’｝を求め、β（ｘ）の係数がＺ_ｑの元であること、β（ｘ）がｎ−ｔ次であること、およびβ（０）＝Ｈ”（ｎ，ｔ，ｔ’，ｙ_Ｎ，ｍ，ｈ，Ａ_０，…，Ａ_ｔ’ ，ａ_Ｎ’，ｂ_Ｎ’）であることを
確認する（Ｓ７３０）。このステップで、β（ｘ）が（ｎ−ｔ）次であることから、署名に参加した参加者装置２１０−ｉがｔ台以上であることが確認される。通信部１３２は、ステップＳ７１０からＳ７３０の確認結果がすべてＯＫであれば、署名が正しいことを出力し、そうでないときは署名は正しくないことを出力する（Ｓ７４０）。

_{A N '= {a 1'} , ..., a n '} _{as, b N' = {b 1} ', ..., b n'} sought, the coefficient of beta (x) is the original _{Z q,} β (x) is nt order, and β (0) = H ″ (n, t, t ′, y _N , m, h, A ₀ ,..., A _{t ′} , a _N ′, b _N ′) is confirmed (S730) Since β (x) is (n−t) th order in this step, there are t or more participant devices 210-i participating in the signature. If all the confirmation results in steps S710 to S730 are OK, the communication unit 132 outputs that the signature is correct, and otherwise outputs that the signature is incorrect (S740).

In the first embodiment, each participant device 110-i (iεS) of the set S is
log _g (y _i ) = log _h (σ _i )
For example, reference ([Cha90] David Chaum, Zero-Knowledge Undeniable Signatures,
I proved that I participated in the signature by proof by the method of EUROCRYPT 1990, pp.458-464, 1990.). In addition, each participant device 110-i (iεN−S) of the set NS is
log _g (y _i ) ≠ log _h (σ _i )
By proving in the same way, I was able to prove that I did not participate in the signature. However, in the second embodiment, for all the participant devices 210-i (iεN) of the set N,

が成り立つｘ_ｉ’が存在するので、その式を証明できることが署名に参加したことを示していない。したがって、参加者装置２１０−ｉ（ｉ＝１，…，ｎ）は、署名に参加したか否かを証明することができない。
このような処理によって、ｎ台（ｎは２以上の整数）の参加者装置に含まれるｓ台の参加者装置が署名を行った場合に、署名をした参加者装置がｔ台以上ｔ’台以下であることが確認できる電子署名を生成できる。

Since there exists x _i 'that holds, the fact that the expression can be proved does not indicate that it participated in the signature. Therefore, the participant device 210-i (i = 1,..., N) cannot prove whether or not it has participated in the signature.
By such processing, when s participant devices included in n participant devices (n is an integer of 2 or more) have signed, there are t or more participant devices that have signed the signature. An electronic signature that can be confirmed as follows can be generated.

The present invention can be executed as a computer main body and a computer program, or can be realized by being mounted on a digital signal processor or a dedicated LSI.

Below, the case where said participant apparatus is limited to one is demonstrated. In this case, duplicate use of the signature key can be prevented. This is because it corresponds to the case of t = t ′ = 1 in the above, and it is possible to trace a duplicate user of a signature key (also called a duplicate signer).
Therefore, this duplicate user traceable signature scheme will be described based on the first embodiment for convenience of description.
In addition, this kind of duplicate user traceable signature method is required because the signer who has the signature key can sign anonymously any number of times, for example, electronic voting (reference: Atsushi Fujioka, Tatsuaki Okamoto, Kazuo ohta, "A Practical Secret Voting Scheme for Large Scale Elections", ASIACRYPT, pp.244-251, 1992., electronic cash (reference: Stefan Brands, "Untraceable Off-line Cash in Wallets with Observers (Extended Abstract) ", CRYPTO, pp.302-318, 1993.), it is possible to duplicate voting and duplicate use of electronic cash.
In addition, since this duplicate user traceable signature method can detect a signed message issued by the same signer a plurality of times with a signature attached to the same message, this point will also be described. In the following description, this will also be referred to as “copy signature detection”, “signature copy detection”, and the like.

In describing the duplicate user traceable signature scheme, the definition is shown again. Let G be a cyclic group of prime order q, which is difficult to solve the discrete logarithm problem, and let g be its generation source. Examples of the cyclic group G include a multiplicative group Z _p ^* [q = p−1], a group defined by points on an elliptic curve, and the like.

Further, H, H ′, and H ″ have the properties H: {0, 1} ^* → G, H ′: {0, 1} ^* → G, H ″: {0, 1} ^* → Z _q. This is a hash function. Here, {0, 1} ^* represents a binary sequence having an arbitrary bit length, and Z _q represents an additive group.

Further, it is assumed that there are n signers, and a set of these signers is N = {1,..., N}. Each signer signs using a signing device (corresponding to the participant device) described later. Here, the signer i's ID (identification) is i (i = 1,..., N).
Hereinafter, y _N = {y _i } _iεN is abbreviated.

[Information disclosure server device]
First, an information disclosure server device (hereinafter referred to as “information disclosure server”) will be described.
FIG. 19 is a configuration block diagram illustrating the hardware configuration of the information disclosure server (1000).

  As illustrated in FIG. 19, the information disclosure server (1000) communicates with an input unit (1100) to which a keyboard or the like can be connected, an output unit (1200) to which a liquid crystal display or the like can be connected, and the information disclosure server (1000). A communication unit (1300) to which a connectable communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (1400) [a cache memory or the like may be provided. ], A RAM (1500) as a memory, a ROM (1600), an external storage device (1700) as a hard disk, an input unit (1100), an output unit (1200), a communication unit (1300), a CPU (1400), The bus (1800) is connected so that data can be exchanged between the RAM (1500), the ROM (1600), and the external storage device (1700). If necessary, the information disclosure server (1000) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (1700) of the information disclosure server (1000) stores and stores a program for information disclosure and data necessary for processing of this program. Further, it is assumed that data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  More specifically, in the external storage device (1700) [or ROM etc.] of the information disclosure server (1000), the signature storage device accessing the information disclosure server (1000) is stored in the external storage means (1700). Necessary for a program for providing stored information, a program for acquiring information from a signature device that has accessed the information disclosure server (1000) and storing and storing it in the external storage means (1700), and processing of these programs Data such as is saved and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

  In the information disclosure server (1000), each program stored in the external storage device (1700) [or ROM, etc.] and data necessary for processing each program are read into the RAM (1500) as necessary, and the CPU Interpretation is executed and processed in (1400). As a result, the CPU (1400) realizes predetermined functions (information providing unit, information acquiring unit), thereby realizing information disclosure.

  The information disclosure server (1000) permits access from a signature device or the like, and provides predetermined information (such as a public key to be described later) in the information disclosure server to the device. Or to obtain information from the device.

[Signature device]
The signature device will be described.
FIG. 20 is a block diagram illustrating the hardware configuration of the signature device (2000).

  As illustrated in FIG. 20, the signature device (2000) can communicate with an input unit (2100) to which a keyboard or the like can be connected, an output unit (2200) to which a liquid crystal display or the like can be connected, and the outside of the signature device (2000). A communication unit (2300) to which a communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (2400) [a cache memory or the like may be provided. ], A RAM (2500) as a memory, a ROM (2600), an external storage device (2700) as a hard disk, an input unit (2100), an output unit (2200), a communication unit (2300), a CPU (2400), It has a bus (2800) connected so that data can be exchanged between the RAM (2500), ROM (2600), and external storage device (2700). If necessary, the signature device (2000) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (2700) of the signature device (2000) stores and stores a signature program, data necessary for processing of this program, and the like. Further, data obtained by the processing of these programs is appropriately stored and stored in a RAM or an external storage device.

More specifically, the external storage device (27) [or ROM, etc.] of the signature device (2) has values h, σ _i , σ _j , A ₀ , A ₁ , a _i , b _i , a described later. _j , b _j , z _i , a program for generating c _i , a program for arbitrarily selecting an element from a group, a program for generating a signature, and data necessary for processing of these programs ( For example, message m) is stored and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

In the signature device (2000), each program stored in the external storage device (2700) [or ROM, etc.] and data necessary for processing each program are read into the RAM (2500) as necessary, and the CPU ( 2400). As a result, the CPU (2400) has predetermined functions (h generator, σ _i generator, σ _j generator, A ₀ generator, A ₁ generator, a _i generator, b _i generator, a _j generator. , b _j generator, z _i generation unit, c _i generation unit, based on the selection unit, the signature generating unit, the control unit) to realize a signature is achieved.

[Verification equipment]
The verification apparatus will be described. Assume that the verification device is also used to track duplicate signers and detect signature copies. A physical actual state (apparatus) different from the verification apparatus may be used as a duplicate signer tracking / copy signature detection apparatus. It should be noted that the duplicate signer tracking / copy signature detection device may be configured as a separate physical entity (ie, a duplicate signer tracking device and a copy signature detection device), but will be apparent from the following description. As shown, since the substantial functions and processing do not change between the two, if it is functionally separated from the verification device, it will be a duplicate signer tracking and copy signature detection device that is recognized as functional integrity, but generally It is considered to be.
FIG. 21 is a configuration block diagram illustrating the hardware configuration of the verification apparatus (3000).

  As illustrated in FIG. 21, the verification device (3000) can communicate with an input unit (3100) to which a keyboard or the like can be connected, an output unit (3200) to which a liquid crystal display or the like can be connected, and the verification device (3000). A communication unit (3300) to which a communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (3400) [a cache memory or the like may be provided. ] RAM (3500), which is a memory, ROM (3600), external storage device (3700) which is a hard disk, input unit (3100), output unit (3200), communication unit (3300), CPU (3400), There is a bus (3800) connected so that data can be exchanged between the RAM (3500), ROM (3600), and external storage device (3700). If necessary, the verification device (3000) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (3700) of the verification device (3000) stores and stores a program for verification (and tracking of duplicate signers, detection of a copy signature), data necessary for processing of this program, and the like. . Further, data obtained by the processing of these programs is appropriately stored and stored in a RAM or an external storage device.

More specifically, the external storage device (3700) [or ROM, etc.] of the verification device (3000) has a program for extracting a predetermined value from a label L described later, values h, σ _N , A described later. A program for generating ₀ , a _N , b _N , a program for verifying the element z, a program for verifying the A ₁ , a program for verifying the element c, a program for verifying the public key, A program for determining a match between the sum of the elements c and a predetermined value, a program for verifying duplicate temporary public keys, data necessary for processing of these programs, and the like are stored and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

In the verification device (3000), each program stored in the external storage device (3700) [or ROM, etc.] and data necessary for processing each program are read into the RAM (3500) as necessary, and the CPU ( 3400) is executed and processed. As a result, the CPU (3400) performs predetermined functions (label extraction unit, h generation unit, σ _N generation unit, A ₀ generation unit, a _N generation unit, b _N generation unit, z verification unit, c verification unit, A _1. By implementing a verification unit, a public key verification unit, a determination unit, a duplicate temporary public key verification unit, and a control unit, signature verification, tracking of duplicate signers, and detection of copy signatures are realized.

[System configuration]
A system configuration in the duplicate user traceable signature scheme will be described.
FIG. 22 is a diagram showing a system configuration in the duplicate user traceable signature scheme.

The duplicate user traceable signature method described here assumes PKI (Public Key Infrastructure), which is an example of a public key infrastructure, for convenience of explanation. PKI is a well-known technology that has been in widespread use in Japan due to the enactment of the “Act on Electronic Signatures and Authentication Services (Act No. 102 of 2000)” in Japan (for example, see Reference 1). )), Detailed description thereof is omitted. The duplicate user traceable signature method is not limited to the premise of PKI in Japan. For example, a known electronic public bulletin board may be used. The size / characteristics of foreign countries and / or public key infrastructures (relatively large scales such as nations / regions / regions, comparatively small scales such as corporations, universities, local governments, organizations, etc. It can be applied regardless of the private nature of the company. Please refer to Reference Document 2 regarding the Government Public Key Infrastructure (GPKI) in Japan.
(Reference 1) Information-technology Promotion Agency, "PKI-related technical explanation", [Searched on January 16, 2006],
Internet <URL: http://www.ipa.go.jp/security/pki/>
(Reference 2) Administrative Administration Bureau, Ministry of Internal Affairs and Communications, “Government Authentication Infrastructure (GPKI)”, [Search January 16, 2006],
Internet <URL: http://www.gpki.go.jp/>

A CA (Certification Authority) (4000) shown in FIG. 22 represents a certificate authority in PKI.
The information disclosure server (1000), the one or more signature devices (2000-1), (2000-2),..., (2000-n), the verification device (3000), and the CA (4000) are connected to the network (5000). ) To communicate with each other.

[Key generation]
The preparation (key generation) for implementing the duplicate user traceable signature method will be described (see FIG. 4).
First, the signer i selects the secret key sk _i = x _i from the element of the group Z _q and generates the public key pk _i = y _i = g ^ x _i using the generator g of the cyclic group G. . The symbol ^ represents a power. The signer i transmits the public key y _i unique to the signer _i to the CA (4000) and registers the public key y _i in the CA (4000).

Next, the information disclosure server (1000) accesses the CA (4000) via the network (5000) and acquires the public keys y ₁ , y ₂ ,..., _N of each signer.

Information public server (1000) is a public key _y 1 in the signer _acquired, y 2, · · ·, stores store _{y n} in the external storage device (1700).

When there is an access from each signature device, the information disclosure server (1000) transmits these data (public keys y ₁ , y ₂ ,..., Y _n ) by the information providing unit (8000). The information is transmitted to the accessed signature device through the section (1300). After the signature generation processing, the signature stored in the external storage device (1700) is also transmitted by the information providing unit (8000) to the accessed verification device through the communication unit (1300). .

Incidentally, in the generation of which will be described later label L, such _y 1 public key for all _signers, y 2, · · ·, in the case of not using the _{y n} is the public information server (1000) and PKI as required, verification It is also possible to adopt a so-called server-client type system configuration in which a plurality of signature devices (1000) are connected to the device (3000) so that they can communicate with each other.

Hereinafter, with reference to FIG. 23 to FIG. 30, the process of the duplicate user traceable signature method is described.
FIG. 23 is a diagram showing a processing flow in the information disclosure server (1000).
FIG. 24 is a diagram illustrating a functional configuration example of the signature device (2000).
FIG. 25 is a diagram showing a processing flow in the signature device (2000) (No. 1).
FIG. 26 is a diagram showing a processing flow in the signature device (2000) (No. 2).
FIG. 27 is a diagram illustrating a state after the signature.
FIG. 28 is a diagram illustrating a functional configuration example of the verification apparatus (3000).
FIG. 29 is a diagram showing a processing flow in the verification apparatus (3000) (No. 1).
FIG. 30 is a diagram showing a processing flow in the verification apparatus (3000) (No. 2).

[signature]
First, the signature by the signature device will be described.
In the following, it is assumed that the signer i performs a signature with the signature device i (2000).
In the external storage device (2700) of the signature device i (2000), the ID i of the signature device i (2000), the generator g of the cyclic group G, the secret key x _i unique to the voter _i , all signatures It is assumed that the public key y _N , the label L, the message m, and the number n of the public keys {y ₁ ,..., Y _n } of all the signers are stored and stored in advance.

The signature device i (2000) accesses the information disclosure server (1000) through the communication unit (2300) and is transmitted through the communication unit (1300) of the information disclosure server (1000) under the control of the control unit (6130). (Step S1s), public keys {y ₁ ,..., Y _n } of all signers stored in the external storage device (1700) of the information disclosure server (1000) [hereinafter, public keys of all signers { y ₁ ,..., y _n } is abbreviated as y _N. ] Is stored in the external storage device (2700) of the signature device i (2000). In addition, the number n of the public keys y _N (hereinafter also referred to as “list y _N ”) of all the voters is stored and stored in the external storage device (27) of the signature device i. Also, the signature device i (2000) controls the control unit (6130) to store its own character string L ₀ = {0, 1} ^* and label L = (L ₀ , y _N ) is stored (step S2). Here, the label L is a value linked list _{y N} of the string _{L 0} and a public key in binary sequence _{L 0 ‖y N (= L 0} ‖y 1 ‖y 2 ‖ ··· ‖y _n) [Symbols ‖ Represents a combination of binary sequences. ]. Hereinafter, unless otherwise specified, the notation (X, Y) represents the combination of X and Y binary sequences. Note that the character string L ₀ and the label L are common to all the signature devices. Therefore, a signature device that does not correctly use the character string L ₀ and the label L is not a regular signature device. Incidentally, it is also possible to publish the string L ₀ and the label L by the information publishing server (1000). In this case, the label generation unit of the information disclosure server [realized by a predetermined program being interpreted and executed by the CPU (1400). ] It is, to generate a label L from the string _{L 0} and list _{y N,} Save stores the string _{L 0} and list _{y N} in the external storage device (1700).

In advance, the signature device i (2000) is unique from the external storage device (2700) to the signature device i ID i, the generation group g of the cyclic group G, and the voter i under the control of the control unit (6130). Private key x _i , public key y _{N of} all signers, label L, message m, and number n of public keys y _N of all signers, and stores them in a predetermined storage area of RAM (2500). Keep it. Hereinafter, the description “read XX from RAM” means “read XX from a predetermined storage area in which XX is stored in the RAM”.

  First, the h generation unit (6000) of the signature device i (2000) reads L from the RAM (2500), calculates h = H (L), and stores the calculation result h in a predetermined storage area of the RAM (2500). (Step S3). Note that h is an element of the cyclic group G, that is, hεG. This h corresponds to a unique temporary public key generation factor.

Next, the σ _i generation unit (6010) of the signature device i (2000) reads h and x _i from the RAM (2500), calculates σ _i = h ^ x _i, and calculates the calculation result σ _i to the RAM. (2500) is stored in a predetermined storage area (step S4). Note that σ _i is an element of the cyclic group G, that is, σ _i εG. This σ _i corresponds to the unique temporary public key of the signature device i.

Subsequently, the A ₀ generation unit (6020) of the signature device i (2000) reads L and m from the RAM (2500), calculates A ₀ = H ′ (L, m), and calculates the result A _0. Is stored in a predetermined storage area of the RAM (2500) (step S5). Note that A ₀ is an _element of the cyclic group G, that is, A ₀ ∈G. The A ₀ corresponds to the disturbance factor generation factor.

Next, the A ₁ generation unit (6030) of the signature device i (2000) reads i, A ₀ , and σ _i from the RAM (2500), respectively, and A ₁ = (σ _i / A ₀ ) ^ (1 / i ) is calculated, and stores the calculation result _{a 1} in a predetermined storage area of the RAM (2500) (step S6). Note that A ₁ is an element of the cyclic group G, ie A ₁ ∈G. The _{A 1} corresponds to the disturbance factor.

Next, the σ _j generation unit (6040) of the signature device i (2000) reads A ₀ , A ₁ , n, i from the RAM (2500), and calculates σ _j = A ₀ (A ₁ ^ j). Then, the calculation result σ _j is stored in a predetermined storage area of the RAM (2500) (step S7). Here, j is jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. Note that σ _j is an element of the cyclic group G, that is, σ _j εG. This σ _j corresponds to a disturbing temporary public key of a signature device other than the signature device i created by the signature device i.

Further, there is a degree 1 polynomial α (x) ∈Z _q [x] that satisfies A ₀ = hｈα (0) and σ _f = hｈα (f) [where f∈N]. You have to be careful. Note that the symbol α (x) εZ _q [x] represents that the polynomial α (x) is a polynomial having an element of the group Z _q as a coefficient.
In other words, it means that log _h (σ _j ) exists on a straight line determined by log _h (A ₀ ) and x _i = log _h (σ _i ).

Subsequently, the label L, the unique temporary public key generation factor h, the temporary public key σ _N (the temporary public key σ _N is a combination of the unique temporary public key and the disturbing temporary public key. That is, σ _N = { σ ₁ , σ ₂ ,..., σ _i−1 , σ _i , σ _{i + 1} ,..., σ _n }), log _g (y _{i ′} ) = log _h (σ _{i ′} ) Non-interactive zero-knowledge proof that can generate non-interactive zero-knowledge proof information to prove that there exists i'∈N satisfying by non-interactive zero-knowledge proof of knowledge (NIZK method) Information generation factors c _N and z _N are obtained. More specifically, the signing device i (2000) has generated the unique temporary public key σ _i using the secret key x _i , that is, log _g (y _i ) = log _h (σ _i ) Information that can be proved to the verification device by non-dialog zero knowledge proof is obtained.
The non-interactive zero knowledge proof may be a known method and is not limited to the following non-interactive zero knowledge proof.

Original selection of the signature device i (2000) (6050) may select any one Tsunomoto _{w i} from the original group _{Z q,} stores the original _{w i} in a predetermined storage area of the RAM (2500) (Step S8).

Next, the a _i generation unit (6060) of the signature device i (2000) reads g and w _i from the RAM (2500), calculates a _i = g ^ w _i, and calculates the calculation result a _i to the RAM. (2500) is stored in a predetermined storage area (step S9). Note that a _i is an element of the cyclic group G, that is, a _i εG.

Next, the b _i generation unit (6070) of the signature device i (2000) reads h and w _i from the RAM (2500), calculates b _i = h ^ w _i, and calculates the calculation result b _i to the RAM. (2500) is stored in a predetermined storage area (step S10). Note that b _i is an element of the cyclic group G, that is, b _i εG.

Subsequently, the original selection unit (6050) of the signature device i (2000) reads i and n from the RAM (2500), respectively, and jεN− {i}, that is, j = 1, 2,. −1, i + 1,..., N, arbitrarily select two elements z _j and c _j from the elements of the group Z _q , and select these elements z _j and c _j in the RAM (2500). Store in the storage area (step S11).

Next, the a _j generation unit (6080) of the signature device i (2000) performs jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. , RAM (2500), g, z _j , c _j , y _j are read respectively (y _j is y _N minus y _i ), a _j = (g ^ z _j ) × (y _j ^ _cj ) is calculated, and the calculation result _aj is stored in a predetermined storage area of the RAM (2500) (step S12). Note that a _j is an element of the cyclic group G, that is, a _j εG.

Next, the b _j generation unit (6090) of the signature device i (2000) performs jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. , RAM (2500), h, z _j , c _j , and σ _j are read, b _j = (h ^ z _j ) × (σ _j ^ c _j ) is calculated, and the calculation result b _j is _stored in the RAM (2500). ) In a predetermined storage area (step S13). Note that b _j is an element of the cyclic group G, that is, b _j εG.

Generated in the above _{processing, a N = {a 1,} a 2, ···, a n}, b N = {b 1, b 2, ···, b n} are non-interactive zero-knowledge proof Information.

Then, _{c i} generation unit of the signature device i (2000) (6100) is, RAM _m from _{(2500), L, A 0} , A 1, a N, b N, c j [j∈N- {i} ], And c _i = H ″ (L, m, A ₀ , A ₁ , a _N , b _N ) −Σ _{j∈N− {i}} c _j (mod q) = H ″ (L, m, A ₀ , A ₁ , a _N , b _N ) − (c ₁ + c ₂ +... + C _i−1 + c _{i + 1} +... + C _n ) (mod q), and this operation result c _i is stored in the RAM ( 2500) in a predetermined storage area (step S14). Note that c _i is an element of the group Z _q .
The input of the hash function H ″ includes the label L and the message m, but may include either or both of them. The input of the hash function H ″ may also be included. Is not intended to be limited to this embodiment, and other non-interactive zero knowledge proof information may be included in the input. In this specification, the input of the hash function H ″ is L, m, A ₀ , A ₁ , a _N , b _N.

Subsequently, the z _i generation unit (6110) of the signature device i (2000) reads n, i, w _i , x _i , and c _i from the RAM (2500), respectively, and z _i = w _i −c _i × x _i (mod q) is calculated, and the calculation result z _i is stored in a predetermined storage area of the RAM (2500) (step S15). Note that z _i is an element of the group Z _q , that is, z _i εZ _q .

C _N = {c ₁ , c ₂ ,..., C _n } and z _N = {z ₁ , z ₂ ,..., Z _n } generated by the above processes are non-interactive zero knowledge proofs. Information generation factor.

Subsequently, the signature generation unit (6120) of the signature device i (2000) reads A ₁ , c _i , c _j , z _i , and z _j from the RAM (2500), and among these, A ₁ , c _i , A combination of c _j , z _i , and z _j is set as a signature ξ _i for the set of the label L and the message m in the signature device i (step S16). That is, ξ _i = {A ₁ , c _N , z _N }. Where _{c N is, c N = {c 1,} c 2, ···, c n}, z N _{is, z N = {z 1,} z 2, ···, z n} is.

Subsequently, the signature device i (2000) controls the signature ξ _i = {A ₁ , c _N , z _N } and the label L generated in step S16 through the communication unit (2300) under the control of the control unit (6130). And a set of messages m are transmitted to the information disclosure server (1000) via the anonymous communication path (step S17).

The information disclosure server (1000) uses the information acquisition unit (8010) through the communication unit (1300) to send the signature ξ _i = {A ₁ , c _N , z _N }, the label L, and the message m transmitted in step S17. And stores the signature ξ _i = {A ₁ , c _N , z _N }, the label L, and the message m in association with each other in the external storage device (1700) (step S2s).

[Verification]
Next, signature verification processing by the verification apparatus (3000) will be described.
It is assumed that the generation source g of the cyclic group G is stored and stored in advance in the external storage device (3700) of the verification device (3000). Also, the number n of the public key _{y N} of all the signer, and is stored in the external storage device of the verification device (3000) (3700).

The verification device (3000) accesses the information disclosure server (1000) through the communication unit (3300) and is transmitted through the communication unit (1300) of the information disclosure server (1000) under the control of the control unit (7110). (Step S3s), a signature ξ = {A ₁ , c _N , z _N } created by a certain signature device stored in the external storage device (1700) of the information disclosure server (1000), corresponding to this signature ξ The label L and the message m are received and stored in the external storage device (3700) of the verification device (3000) (step S18). In this case, “signature ξ... Message m created by a certain signature device” means that the signature and the label L and message m corresponding to this signature ξ do not include information for identifying the signature device. Therefore, from the standpoint of the verification device, it is impossible to know which signature device is used for the signature. Hereinafter, a process for verifying one signature acquired from the information disclosure server (1000) and the label L and the message m corresponding to the signature ξ will be described.

The verification device (3000) controls the generation unit g of the cyclic group G, the signature ξ = {A ₁ , c _N , z _N } and the signature ξ from the external storage device (3700) under the control of the control unit (7110). corresponding label L and a set of message m, it reads the number n of the public key y _n of all signers, and stores each in a predetermined storage area of the RAM (3500).

Next, the label extracting unit of the verification device (3000) (7150) reads the label L from the RAM (3500), and extracts a character string _{L 0} and list _{y N,} extracted string _{L 0} and list _{y N} The data is stored in a predetermined storage area of the RAM (3500) (step S19).

Next, the A ₁ verification unit (7020) of the verification device (3000) reads A ₁ from the RAM (3500) and verifies whether A ₁ is an element of the cyclic group G (step S20). If the verification fails, the signature ξ = {A ₁ , c _N , z _N } is found to be an illegal signature, and the verification process ends (step S50). If this verification is passed, the control unit (7110) controls to execute the following processing.

Subsequently, the c verification unit (7040) of the verification device (3000) reads c _N (= {c ₁ , c ₂ ,..., C _n }) from the RAM (3500), and each c _f (f = 1, 2,..., N) is verified whether or not they are _elements of the group Zq (step S21). If this verification does not pass, the signature ξ is found to be an illegal signature, and the verification process is terminated (step S50). If this verification is passed, the control unit (7110) controls to execute the following processing.

Subsequently, the z verification unit (7060) of the verification device (3000) reads z _N (= {z ₁ , z ₂ ,..., Z _n }) from the RAM (3500), and each z _f (f = 1, 2,..., N) is verified whether or not they are _elements of the group Zq (step S22). If this verification does not pass, the signature ξ is found to be an illegal signature, and the verification process is terminated (step S50). If this verification is passed, the control unit (7110) controls to execute the following processing.

Subsequently, the public key verification unit (7050) of the verification device (3000) reads the list y _N (= {y ₁ , y ₂ ,..., Y _n }) from the RAM (3500), and each y _f It is verified whether (f = 1, 2,..., N) is an element of the group G (step S23). If this verification does not pass, the signature ξ is found to be an illegal signature, and the verification process is terminated (step S50). If this verification is passed, the control unit (711) controls to execute the following processing.

  The termination process of step S50 that shifts to each process of steps S20, S21, S22, and S23 is caused by the fact that the signature ξ does not use an appropriate group element in the first place. Therefore, the duplicate signer tracking process described later is not performed.

  Next, the h generation unit (7000) of the verification device (3000) reads the label L from the RAM (3500), calculates h = H (L), and stores the calculation result h in the RAM (3500) in a predetermined manner. Store in the area (step S24). Note that h is an element of the cyclic group G, that is, hεG. This h is equal to a unique temporary public key generation factor generated by the signature device.

Next, the A ₀ generation unit (7010) of the verification device (3000) reads the label L and the message m from the RAM (3500), calculates A ₀ = H ′ (L, m), and calculates the calculation result A ₀ is stored in a predetermined storage area of the RAM (3500) (step S25). Note that A ₀ is an _element of the cyclic group G, that is, A ₀ ∈G. The A ₀ equals the disturbance factor generation factor generated by the signature apparatus.

Next, the σ _N generation unit (7030) of the verification device (3000) reads A ₀ , A ₁ , and n from the RAM (3500), respectively, and σ _f = A ₀ (A ₁ ^ f) [where f = 1 , 2,..., N. ], And the calculation result σ _N (= {σ ₁ , σ ₂ ,..., Σ _n }) is stored in a predetermined storage area of the RAM (3500) (step S26). Note that σ _N (= {σ ₁ , σ ₂ ,..., Σ _n }) is an element of the cyclic group G, that is, σ _f εG. This σ _N is a temporary public key that is a combination of the unique temporary public key of the signature device and the disruptive temporary public key generated by the signature device.

Subsequently, the a _N generation unit (7070) of the verification device (3000) reads n, g, c _N , z _N , and y _N from the RAM (3500), respectively, and a _f = (g ^ z _f ) × ( y _f ^ c _f ) [where f = 1, 2,..., n. ], And the calculation result a _N (= {a ₁ , a ₂ ,..., A _n }) is stored in a predetermined storage area of the RAM (3500) (step S27). Note that a _N (= {a ₁ , a ₂ ,..., A _n }) is an element of the cyclic group G, that is, a _f ∈G.

Subsequently, the b _N generation unit (7080) of the verification apparatus (3000) reads n, h, c _N , z _N , and σ _N from the RAM (3500), respectively, and b _f = (h ^ z _f ) × ( σ _f ^ c _f ) [where f = 1, 2,..., n. ], And the result b _N (= {b ₁ , b ₂ ,..., B _n }) is stored in a predetermined storage area of the RAM (3500) (step S28). Note that b _N (= {b ₁ , b ₂ ,..., B _n }) is an element of the cyclic group G, that is, b _f εG.

Subsequently, the determination unit of the verification device (3000) (7090) is, RAM (3500) from _{L, m, A 0, A} 1, a N, b N, reads the _{c N respectively,} Σ f∈N c _f ( mod q) = H ″ (L, m, A ₀ , A ₁ , a _N , b _N ) (mod q) is determined to hold or not, and the determination result R is stored in the RAM (3500) in a predetermined manner. (Step S29) The input of the hash function H ″ is the same as the input of the hash function H ″ in the process of step S14.
If this determination is not established (determination is not established), the signature ξ is found to be an invalid signature and the verification process is terminated (step S51). The termination processing in step S51 is termination resulting from successful detection of an illegal signature.
When this determination is established (determination is established), the control unit (711) controls to execute the following signer tracking process. In the following signer tracking process, not only a duplicate signer is tracked, but also a process of detecting a copy of a signature for the same message created by the same signing device. For convenience of explanation, it is assumed that there is one duplicate signature or copy signature (that is, a case where there is a double signature or one copy signature).

[Signer Tracking]
The verification device (3000) accesses the information disclosure server (1000) through the communication unit (3300) and is transmitted through the communication unit (1300) of the information disclosure server (1000) under the control of the control unit (7110). (Step S4s), all signatures ξ stored in the external storage device (1700) of the information disclosure server (1000), the label L and the message m corresponding to each signature are received, and these are received from the verification device (3000). The data is stored in the storage device (3700) (step S30).

Next, the verification device (3000) controls two signatures (corresponding to each signature) among the signatures read from the external storage device (3700) and stored in the RAM (3500) under the control of the control unit (7110). The label L and the message m are also included (the pair that has not yet been subjected to the duplicate signer tracking and copy signature detection described later). ] Is selected and the following processing is performed. Here, in order to distinguish one signature and the label L and the message m corresponding to the signature, and the other signature and the label L and the message m corresponding to the signature, which constitute the selected pair, <L, m, ξ = {A ₁ , c _N , z _N }>, <L, m ′, ξ ′ = {A ₁ ′, c _N ′, z _N ′}> [label L is common pay attention to. (Step S31).

First, the A ₀ generation unit (7010) of the verification device (3000) reads the label L and the messages m and m ′ from the RAM (3500), respectively, and A ₀ = H ′ (L, m) and A ₀ ′ = H. '(L, m') is calculated, and the calculation results A ₀ and A ₀ 'are stored in a predetermined storage area of the RAM (3500) (step S32).

Next, the σ _N generation unit (7030) of the verification device (3000) reads A ₀ , A ₁ , A ₀ ′, A ₁ ′, and n from the RAM (3500), respectively, and σ _f = A ₀ (A ₁ ^ F) [where f = 1, 2,..., N. ] And σ _f ′ = A ₀ ′ (A ₁ ′ ^ f), where f = 1, 2,..., N. ], And the calculation results σ _N (= (σ ₁ , σ ₂ ,..., Σ _n )) and σ _N ′ (= (σ ₁ ′, σ ₂ ′,..., Σ _n ′) ) Is stored in a predetermined storage area of the RAM (3500) (step S33).

Next, the duplicate temporary public key verification unit (7160) of the verification device (3000) reads σ _f = A ₀ (A ₁ ^ f) [where f = 1, 2,..., N from the RAM (3500). To do. ] And σ _f ′ = A ₀ ′ (A ₁ ′ ^ f), where f = 1, 2,..., N. ] Are compared for f = 1, 2,..., N to determine whether or not σ _f = σ _f ′ is satisfied (step S34).
If σ _f = σ _f ′ holds for all of f = 1, 2,..., n, the two signatures selected in step S31 are generated for the same message m by the same signature device. And at least one of them is identified as a copy of the signature that should have been one. Therefore, the duplicate temporary public key verification unit (7160) stores information Ω indicating that the copy signature has been detected in a predetermined storage area of the RAM (3500) (detection of copy signature; step S35).
Further, when σ _p = σ _p ′ holds for a certain p, the signer p corresponding to this p is specified as a duplicate user. Therefore, the duplicate temporary public key verification unit (7160) stores p indicating the duplicate signer in a predetermined storage area of the RAM (3500) (duplicate user tracking; step S36).
If σ _f = σ _f ′ does not hold for all of f = 1, 2,..., And σ _p = σ _p ′ does not hold for a certain _p , the verification device ( 3000) repeats the processing after step S31 under the control of the control unit (7110) (step S37).

As described above, since there is a case where there is a double signature or one copy signature, σ _f = σ _f ′ holds for all of f = 1, 2,. If σ _p = σ _p ′ holds for one p, the signer tracking process can be terminated. Of course, when such a limitation is not made, the signer tracking process may be performed for all pairs.

Thus, the temporary public key σ _f [f = 1, 2,..., N] obtained from the signature ξ includes the temporary public key σ _p unique to the signature device p. If σ _p matches the p-th temporary public key σ _p ′ of the temporary public key obtained from a different signature ξ ′, the signer who generated this temporary public key σ _p is identified as a duplicate user Can do. This makes it possible to prevent duplicate use of signatures.

The disturbing temporary public key is expressed as a function using the message m and the unique temporary public key as variables, so that the temporary public key σ _f obtained from the signature ξ and the temporary public key obtained from the signature ξ ′. If σ _f ′ is the same for all f = 1, 2,..., n, it can be said that the signature ξ and the signature ξ ′ are generated for the same message by the same signature device. Therefore, although it cannot be determined by which signature device the signature is generated, a plurality of signatures having a relationship in which σ _f = σ _f ′ holds for all f = 1, 2,. Can be handled as a single signature.

  The overlapping user traceable signature method described above can be applied to, for example, electronic voting and electronic cash methods. For detailed information processing (for example, the subject of information processing such as specific computing means, transmission means, storage means, and the specific contents of information processing performed by each subject), the duplicate user traceable signature method described above is used. Since it should be referred to, an application example of the above-described duplicate user traceable signature scheme will be briefly described below.

<Application example 1: Electronic voting>
A signer (signature device) in the duplicate user traceable signature method becomes a voter (electronic voting device; hereinafter simply referred to as a voting device), and a verifier (verification device) becomes a totalizer (voting device). Let N = {1, 2,..., N} be a set of voters.

[Key generation]
First, in the information disclosure server (1000), the name of the election (for example, “Heisei XX year ×× month mayor recall election”), the contents of the vote (for example, “agree” or “disagree” for the recall of the mayor) The information L ₀ specifying the above is disclosed.

The voter i of the voter i generates a key as described in the duplicate user traceable signature method, registers the public key y _i in the PKI, and the public key y _i is released by the information disclosure server (1000). The

The label generation unit of the information disclosure server (1000) generates and publishes a label L = (L ₀ , y _N ) from the information L ₀ and the voter's public key list y _N. This label L is provided to each voting device.

[Voting]
The voter i determines the content of the vote m and votes using the voting device i. Here, the voting apparatus i generates the signature ξ _i described in the duplicate user traceable signature scheme from the label L and the voting content m acquired from the information disclosure server (1000), and the label L, the voting content m, the signature ξ _i is transmitted to the information disclosure server (1000) through the anonymous communication path (without authentication).

[Voting]
The vote counting device acquires all signatures of certain voting contents (for example, voting contents indicating “agree”) from the information disclosure server (1000), and each signature is verified by signature verification described in the duplicate user traceable signature method. To verify. All votes that fail validation are discarded as fraud (does not count votes with illegal signatures).

  Next, the vote counting device detects the duplicate signer by the signer tracking described in the duplicate user traceable signature method. If a duplicate signer is detected, the signed vote voted from this voting device is discarded (votes with illegal duplicate signatures are not counted), and the ID of this duplicate signer is assigned to the information disclosure server ( 1000), and the ID and public key of the duplicate signer are disclosed in the information disclosure server (1000). In addition, if a copy of a vote is detected (ie, the same voter has voted the same vote content multiple times), and if a copy is detected, the remaining ones are excluded. Discard the copy. Detection of a copy of the vote is realized by performing the process of step S35 on the signature attached to the vote.

  Then, the vote-tapping device performs the above-described processing for each vote content m, and implements the counting means [a predetermined program is interpreted and executed by the CPU. ] Counts the number of votes for each vote content m, transmits it to the information disclosure server (1000), and releases the number of votes for each vote content m in the information disclosure server (1000).

<Application example 2: Electronic cash method>
The signer (signature device) in the duplicate user traceable signature method becomes a user (user device), the verifier (verification device) becomes a store (store device) and a bank (bank verification device), and the PKI The operator becomes a bank. Further, it is assumed that the bank manages the information disclosure server, and the duplicate user detection is performed by the bank verification device.
Let N = {1, 2,..., N} be a set of users.

[Key generation: Open account]
The user device i of the user i generates a key as described in the duplicate user traceable signature method, registers the public key y _{i in,} for example, the public key registration server device of the bank, and the information disclosure server (1000) The public key y _i is released.

[Drawer]
Hereinafter, it is assumed that withdrawal, transfer, and withdrawal are performed by a bank account management device. Detailed processing of withdrawals, transfers, and withdrawals and the configuration of the account management device are realized by a known electronic cash system, etc., so these detailed explanations will be omitted, and the electronic cash method of the double user traceable signature method will be omitted. The explanation will focus on the application.

The bank account management device determines the information L ₀ that specifies the bank name, the amount used by the user i as electronic cash (the face value of electronic cash), the expiration date, etc., and the information L ₀ and all users The label L = (L ₀ , y _N ) is determined from the public key y _N.

Bank of account management device shall be determined from the account of the user i of the label L (more specifically, is the amount of money that make up the information L _0.) Withdraw the amount. This deduction may also be based on a known electronic cash system (instead of actually deducting cash, for example, data indicating the balance may be rewritten with the amount after deduction).

  The bank account management apparatus publishes the label L and the bank signature Sig (L) for the label L on the information disclosure server.

[payment]
The store apparatus that receives payment by electronic cash from the user i determines and uses transaction information m including information specifying the store and information specifying the transaction (for example, transaction amount, transaction date and time). To the user device i.

  User device i receives label L and signature Sig (L) for label L from the information disclosure server, receives transaction information m from the store device, and can track duplicate users from label L and transaction information m The signature ξ described in the signature method is generated. Then, the user device i uses the combination of the label L, the transaction information m, and the signature ξ as electronic cash, and transmits the electronic cash (L, m, ξ) and the bank signature Sig (L) to the store device.

  The store apparatus verifies the electronic cash (L, m, ξ) by the signature verification described in the duplicate user traceable signature method. Further, the store apparatus verifies the signature Sig (L) of the bank by a known signature verification method (for example, assuming that the public key of the bank is disclosed to the information disclosure server, the public key of the bank is used as the information disclosure server). And verify the signature Sig (L) with the bank's public key.)

  When both of the above verifications are established, the store apparatus transmits electronic cash (L, m, ξ) to the bank verification apparatus.

  When receiving the electronic cash (L, m, ξ) from the store device, the bank verification device verifies the electronic cash (L, m, ξ) by the signature verification described in the duplicate user traceable signature method. When the verification of the electronic cash (L, m, ξ) is established, the bank verification device transfers the cash determined by the label L to the store account.

[Duplicate use of electronic cash, copy detection of electronic cash]
If the verification of the electronic cash (L, m, ξ) is not established, the bank verification device uses the electronic cash for the duplicate use and the electronic cash by the signer tracking described in the duplicate user traceable signature method. Detect copy. Here, the overlapping use of electronic cash means that the user has used electronic cash repeatedly in different transactions. That is, it is an unauthorized use of electronic cash by a user. Moreover, the copy of electronic cash means that the store (apparatus) transmitted the electronic cash received from the user (apparatus) to the bank a plurality of times. That is, it is illegal use of electronic cash by a store.
Therefore, if it can be determined that the electronic cash has been duplicated by this detection, the ID of the user who has used the duplicated cash is disclosed on the information disclosure server and the bank transaction is stopped. When a copy of electronic cash is detected, the name of the store that generated the copy (this store name is included in the transaction information m) may be disclosed on the information disclosure server, and the bank transaction may be stopped.

[Refund]
When the user holds unused electronic cash whose expiration date stipulated by the label L has passed, the user transmits the unused electronic cash to the bank verification device and presents it for refund. I do.

A bank verification device that has received electronic cash for refund by receiving unused electronic cash from a user device receives duplicate electronic cash (L, m, ξ) from the user device. The electronic cash (L, m, ξ) is verified by the signature verification, signer tracking, and copy signature detection described in the person traceable signature method. If the verification device of the bank succeeds in verifying any of the electronic cash (L, m, ξ), the bank account management device transfers the cash determined by the transaction information m to the user's account (actually cash (For example, the data indicating the balance may be rewritten to the amount after the transfer).
The payout by transfer may be based on a publicly known electronic cash system, so a detailed description will be omitted and only a brief description will be given.

  A conventional election manager that issues a blind signature to attach to the contents of a vote, for example, by applying a duplicate user traceable signature method that can identify the person who has signed a duplicate to electronic voting and electronic cash This eliminates the need for a reliable server device.

The figure which shows the structural example and flow of an electronic signature system with a threshold value. The figure which shows the function structural example of participation apparatus 910-i. The figure which shows the processing flow of the key generation part 911-i. The figure which shows the processing flow of the random number generation part 912-i. The figure which shows the function structural example of the signature production | generation part 920. FIG. The figure which shows the processing flow of the signature production | generation part 920. The figure which shows the function structural example of the signature verification part 930. FIG. The figure which shows the flow which verifies signature (sigma) (m) in the signature verification part 930. FIG. The figure which shows the structural example and flow of a digital signature system with a threshold value of 1st Embodiment. The figure which shows the function structural example of participant apparatus 110-i. The figure which shows the function structural example of the signature production | generation part 120. FIG. The figure which shows the function structural example of the signature verification part 130. FIG. The figure which shows the processing flow of the electronic signature system in 1st Embodiment. The figure which shows the structural example and flow of a digital signature system with a threshold value of 2nd Embodiment. The figure which shows the function structural example of participant apparatus 210-i. The figure which shows the function structural example of the signature production | generation part 220. FIG. FIG. 3 is a diagram illustrating an example of a functional configuration of a signature verification unit 230. The figure which shows the processing flow of the electronic signature system in 2nd Embodiment. The figure which shows the hardware structural example of an information disclosure server (1000). The figure which shows the hardware structural example of a signature apparatus (2000). The figure which shows the hardware structural example of a verification apparatus (3000). The figure which shows the system structural example in a duplication user traceable system. The figure which shows the processing flow in an information disclosure server (1000). The figure which shows the function structural example of a signature apparatus (2000). The figure which shows the processing flow in a signature apparatus (2000) (the 1). The figure which shows the processing flow in a signature apparatus (2000) (the 2). The figure which shows the state after signature. The figure which shows the function structural example of a verification apparatus (3000). The figure which shows the processing flow in a verification apparatus (3000) (the 1). The figure which shows the processing flow in a verification apparatus (3000) (the 2).

Claims (21)

G is a cyclic group of order q where the discrete logarithm problem is difficult,
g is the generator of the cyclic group G,
Z _q Is an additive group of order q,
A hash function in which H is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
A hash function in which H ′ is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
Addition group Z with H ″ as a domain defined by a set of bit strings of arbitrary length consisting of 0 and 1 _q A hash function whose range is
Let m be a message,
s number of participant devices (hereinafter, s number of devices) included in n number of participant devices (n is a predetermined integer of 2 or more) (hereinafter, a set of n number of participant devices is referred to as a set N) A set of participant devices is a set S) is an electronic signature method for performing an electronic signature,
The key generation unit of each participant device i (i = 1,..., N) belonging to the set N receives the secret key x _i ∈Z _q Select the public key y _i = G ^ x _i Generating ∈G;
The set selection unit of the signature generation device has participant devices belonging to the set T satisfying T⊆S⊆T'⊆N (provided that t participant devices belong to the set T) and participations belonging to the set T ′. Selecting each participant device (however, the participant devices belonging to the set T ′ are t ′ units) from the set N;
A step of selecting a k-bit bit string r consisting of 0 and 1 by a selection unit of the signature generation device;
The key generation unit of each participant device i (i = 1,..., S) belonging to the set S performs the secret key x _i , The disposable public key σ _i = H ^ x _i (Where h = H (n, t, t ', y ₁ , ..., y _n , M, r) ∈ G);
The disposable public key selection unit of the signature generation device uses the disposable public key σ of each participant device i (i = s + 1,..., T ′) belonging to the set T′-S. _i Arbitrarily selecting from the cyclic group G;
The calculation unit of the signature generation device uses the disposable public key σ of each participant device i (i = 1,..., T ′) belonging to the set T ′. _i (I = 1,..., T ′)

age,
A ₀ = H '(n, t, t', y ₁ , ..., y _n , M, r) ∈ G,

(J = 1,..., T ′) and the disposable public key of each participant device (i = t ′ + 1,..., N) belonging to the set N-T ′

A step of calculating
The calculation unit of each participant device i (i = 1,..., S) belonging to the set S is an arbitrary element w _i ∈Z _q Select the source w _i Using a _i = G ^ w _i ∈G and b _i = H ^ w _i Generating ∈G;
An arbitrary generation unit corresponding to each participant apparatus i (i = s + 1,..., N) belonging to the set NS is generated by the original generation unit of the signature generation apparatus. _i ∈Z _q And any c _i ∈Z _q And select a _i = (G ^ z _i ) (Y _i ^ C _i ) ∈G and b _i = (H ^ z _i ) (Σ _i ^ C _i ) ΕG, and
An element c corresponding to each participant apparatus i (i = t + 1,..., S) belonging to the set ST by the element selection unit of the signature generation apparatus _i ∈Z _q A step of selecting
The polynomial calculation unit of the signature generation device
β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, r, h, A ₀ , ..., A _{t ’} , a ₁ , ..., a _n , b ₁ , ..., b _n ) ∈Z _q
β (i) = c _i ∈Z _q (Where i = t + 1,..., N)
A polynomial β (x) ∈Z of degree (nt) satisfying _q Obtaining [x];
The calculation unit of each participant device i (i = 1,..., S) belonging to the set S performs the secret key x _i To use z _i = W _i -Β (i) x _i ∈Z _q A step of seeking
The signature generation unit of the signature generation apparatus receives the electronic signature σ = (r, A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n ) And output step
An electronic signature method comprising: A method for verifying the electronic signature σ generated by the electronic signature method according to claim 1,
The verification unit of the signature verification device
The cyclic group G, the generator g of the cyclic group G, and the additive group Z used in the electronic signature method according to claim 1 _q , Hash function H, hash function H ′, hash function H ″, n, t, t ′, public key y of each participant device i (i = 1,..., N) belonging to set N ₁ , ..., y _n , Message m, electronic signature σ = (r, A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n )Using,
R included in the electronic signature σ is a bit string of 0 and 1, h = H (n, t, t ′, y ₁ , ..., y _n , M, r) is an element of the cyclic group G, A ₀ = H '(n, t, t', y ₁ , ..., y _n , M, r) is an element of the cyclic group G, A included in the electronic signature σ ₁ , ..., A _{t ’} Are elements of the cyclic group G, z included in the electronic signature σ ₁ , ..., z _n Are additive groups Z _q A step of confirming that

Calculated by _i Confirming that (i = 1,..., N) is an element of the cyclic group G;
Polynomial β (x), z included in electronic signature σ ₁ , ..., z _n Using,

(I = 1,..., N) is obtained, and each coefficient of the polynomial β (x) included in the electronic signature σ is added to the additive group Z. _q , The degree of the polynomial β (x) is n−t, β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, r, h, A ₀ , ..., A _{t ’} , a ₁ ’, ..., a _n ’, B ₁ ’,…, B _n ’) And confirming that
A verification method. G is a cyclic group of order q where the discrete logarithm problem is difficult,
g and R are generators of the cyclic group G,
Z _q Is an additive group of order q,
A hash function in which H is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
A hash function in which H ′ is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
Addition group Z with H ″ as a domain defined by a set of bit strings of arbitrary length consisting of 0 and 1 _q A hash function whose range is
Let m be a message,
s number of participant devices (hereinafter, s number of devices) included in n number of participant devices (n is a predetermined integer of 2 or more) (hereinafter, a set of n number of participant devices is referred to as a set N) A set of participant devices is a set S) is an electronic signature method for performing an electronic signature,
The key generation unit of each participant device i (i = 1,..., N) belonging to the set N receives the secret key x _i ∈Z _q Select the public key y _i = G ^ x _i Generating ∈G;
The set selection unit of the signature generation device has participant devices belonging to the set T satisfying T⊆S⊆T'⊆N (provided that t participant devices belong to the set T) and participations belonging to the set T ′. Selecting each participant device (however, the participant devices belonging to the set T ′ are t ′ units) from the set N;
The key generation unit of each participant device i (i = 1,..., S) belonging to the set S performs an arbitrary element x _i ′ ∈Z _q Select the secret key x _i ∈Z _q , The disposable public key σ _i = (H ^ x _i ) (R ^ x _i ′) (Where h = H (n, t, t ′, y ₁ , ..., y _n , M) εG);
The disposable public key selection unit of the signature generation device uses the disposable public key σ of each participant device i (i = s + 1,..., T ′) belonging to the set T′-S. _i Arbitrarily selecting from the cyclic group G;
The calculation unit of the signature generation device uses the disposable public key σ of each participant device i (i = 1,..., T ′) belonging to the set T ′. _i (I = 1,..., T ′)

age,
A ₀ = H '(n, t, t', y ₁ , ..., y _n , M) ∈ G,

(J = 1,..., T ′) and the disposable public key of each participant device (i = t ′ + 1,..., N) belonging to the set N-T ′

A step of calculating
The calculation unit of each participant device i (i = 1,..., S) belonging to the set S is an arbitrary element w _i , W _i ′ ∈Z _q Select the source w _i , W _i ' _i = G ^ w _i ∈G and b _i = (H ^ w _i ) (R ^ w _i ′) Generating ∈G;
An arbitrary generation unit corresponding to each participant apparatus i (i = s + 1,..., N) belonging to the set NS is generated by the original generation unit of the signature generation apparatus. _i , Z _i ', C _i ∈Z _q And select a _i = (G ^ z _i ) (Y _i ^ C _i ) ∈G and b _i = (H ^ z _i ) (R ^ z _i ’) (Σ _i ^ C _i ) ΕG, and
An element c corresponding to each participant apparatus i (i = t + 1,..., S) belonging to the set ST by the element selection unit of the signature generation apparatus _i ∈Z _q A step of selecting
The polynomial calculation unit of the signature generation device
β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, h, A ₀ , ..., A _{t ’} , a ₁ , ..., a _n , b ₁ , ..., b _n ) ∈Z _q
β (i) = c _i ∈Z _q (Where i = t + 1,..., N)
A polynomial β (x) ∈Z of degree (nt) satisfying _q Obtaining [x];
The calculation unit of each participant device i (i = 1,..., S) belonging to the set S performs the secret key x _i , X _i 'To use z _i = W _i -Β (i) x _i ∈Z _q , Z _i ’= W _i '-Β (i) x _i ′ ∈Z _q A step of seeking
The signature generation unit of the signature generation apparatus receives the electronic signature σ = (A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n , Z ₁ ', ..., z _n ′) Output step;
An electronic signature method comprising: A method for verifying the electronic signature σ generated by the electronic signature method according to claim 3,
The verification unit of the signature verification device
A cyclic group G, generators g and R of the cyclic group G used in the electronic signature method according to claim 3, and an additive group Z _q , Hash function H, hash function H ′, hash function H ″, n, t, t ′, public key y of each participant device i (i = 1,..., N) belonging to set N ₁ , ..., y _n , Message m, electronic signature σ = (A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n , Z ₁ ', ..., z _n ')Using,
h = H (n, t, t ', y ₁ , ..., y _n , M) is an element of the cyclic group G, A ₀ = H '(n, t, t', y ₁ , ..., y _n , M) is an element of the cyclic group G, A included in the electronic signature σ ₁ , ..., A _{t ’} Are elements of the cyclic group G, z included in the electronic signature σ ₁ , ..., z _n , Z ₁ ', ..., z _n 'Is the additive group Z _q A step of confirming that

Calculated by _i Confirming that (i = 1,..., N) is an element of the cyclic group G;
Polynomial β (x), z included in electronic signature σ ₁ , ..., z _n , Z ₁ ', ..., z _n 'Using,

(I = 1,..., N) is obtained, and each coefficient of the polynomial β (x) included in the electronic signature σ is added to the additive group Z. _q , The degree of the polynomial β (x) is n−t, β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, h, A ₀ , ..., A _{t ’} , a ₁ ’, ..., a _n ’, B ₁ ’,…, B _n ’) And confirming that
A verification method. G is a cyclic group of order q where the discrete logarithm problem is difficult,
g is the generator of the cyclic group G,
Z _q Is an additive group of order q,
A hash function in which H is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
A hash function in which H ′ is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
Addition group Z with H ″ as a domain defined by a set of bit strings of arbitrary length consisting of 0 and 1 _q A hash function whose range is
Let m be a message,
s number of participant devices (hereinafter, s number of devices) included in n number of participant devices (n is a predetermined integer of 2 or more) (hereinafter, a set of n number of participant devices is referred to as a set N) A set of participant devices is a set S) is an electronic signature system for performing an electronic signature,
The electronic signature system includes n participant devices i (i = 1,..., N) and a signature generation device.
Secret key x _i ∈Z _q Select the public key y _i = G ^ x _i Means A for generating ∈G;
Participant devices belonging to the set T satisfying T⊆S⊆T′⊆N (provided that t participant devices belong to the set T) and participant devices belonging to the set T ′ (provided that the set T ′ Means B for selecting each participant device from the set N;
Means C for selecting a k-bit bit string r consisting of 0 and 1;
Secret key x _i , The disposable public key σ _i = H ^ x _i (Where h = H (n, t, t ', y ₁ , ..., y _n , M, r) ∈ G), means D,
The disposable public key σ of each participant device i (i = s + 1,..., T ′) belonging to the set T′-S. _i Means E for arbitrarily selecting from the cyclic group G;
The disposable public key σ of each participant device i (i = 1,..., T ′) belonging to the set T ′ _i (I = 1,..., T ′)

age,
A ₀ = H '(n, t, t', y ₁ , ..., y _n , M, r) ∈ G,

(J = 1,..., T ′) and the disposable public key of each participant device (i = t ′ + 1,..., N) belonging to the set N-T ′

Means F for calculating
Arbitrary source w _i ∈Z _q Select the source w _i Using a _i = G ^ w _i ∈G and b _i = H ^ w _i Means G for generating ∈ G;
Arbitrary z corresponding to each participant device i (i = s + 1,..., N) belonging to the set NS _i ∈Z _q And any c _i ∈Z _q And select a _i = (G ^ z _i ) (Y _i ^ C _i ) ∈G and b _i = (H ^ z _i ) (Σ _i ^ C _i ) Means H for generating ∈ G;
An arbitrary element c corresponding to each participant device i (i = t + 1,..., S) belonging to the set ST _i ∈Z _q Means I for selecting
β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, r, h, A ₀ , ..., A _{t ’} , a ₁ , ..., a _n , b ₁ , ..., b _n ) ∈Z _q
β (i) = c _i ∈Z _q (Where i = t + 1,..., N)
A polynomial β (x) ∈Z of degree (nt) satisfying _q Means J for determining [x];
Secret key x _i To use z _i = W _i -Β (i) x _i ∈Z _q Means K for obtaining
Electronic signature σ = (r, A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n ) For outputting L
Out of
The signature generation apparatus includes at least means B, means C, means E, means F, means H, means I, means J, and means L.
Each participant device i includes at least means A, means D, means G, and means K,
If the signature generation device matches any one of the n participant devices i (i = 1,..., N), the participant device has means A, means B, means C, means D, means E, means F, means G, means H, means I, means J, means K, means L
Electronic signature system. A verification device for verifying the electronic signature σ generated by the electronic signature method according to claim 1,
The cyclic group G, the generator g of the cyclic group G, and the additive group Z used in the electronic signature method according to claim 1 _q , Hash function H, hash function H ′, hash function H ″, n, t, t ′, public key y of each participant device i (i = 1,..., N) belonging to set N ₁ , ..., y _n , Message m, electronic signature σ = (r, A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n )Using,
R included in the electronic signature σ is a bit string of 0 and 1, h = H (n, t, t ′, y ₁ , ..., y _n , M, r) is an element of the cyclic group G, A ₀ = H '(n, t, t', y ₁ , ..., y _n , M, r) is an element of the cyclic group G, A included in the electronic signature σ ₁ , ..., A _{t ’} Are elements of the cyclic group G, z included in the electronic signature σ ₁ , ..., z _n Are additive groups Z _q A means of confirming that

Calculated by _i Means for confirming that (i = 1,..., N) is an element of the cyclic group G;
Polynomial β (x), z included in electronic signature σ ₁ , ..., z _n Using,

(I = 1,..., N) is obtained, and each coefficient of the polynomial β (x) included in the electronic signature σ is added to the additive group Z. _q , The degree of the polynomial β (x) is n−t, β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, r, h, A ₀ , ..., A _{t ’} , a ₁ ’, ..., a _n ’, B ₁ ’,…, B _n ’) Means to confirm that
Verification device including G is a cyclic group of order q where the discrete logarithm problem is difficult,
g and R are generators of the cyclic group G,
Z _q Is an additive group of order q,
A hash function in which H is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
A hash function in which H ′ is a set of bit strings of arbitrary lengths consisting of 0 and 1, and a cyclic group G is a range;
Addition group Z with H ″ as a domain defined by a set of bit strings of arbitrary length consisting of 0 and 1 _q A hash function whose range is
Let m be a message,
s number of participant devices (hereinafter, s number of devices) included in n number of participant devices (n is a predetermined integer of 2 or more) (hereinafter, a set of n number of participant devices is referred to as a set N) A set of participant devices is a set S) is an electronic signature system for performing an electronic signature,
The electronic signature system includes n participant devices i (i = 1,..., N) and a signature generation device.
Secret key x _i ∈Z _q Select the public key y _i = G ^ x _i Means A for generating ∈G;
Participant devices belonging to the set T satisfying T⊆S⊆T′⊆N (provided that t participant devices belong to the set T) and participant devices belonging to the set T ′ (provided that the set T ′ Means B for selecting each participant device from the set N;
Any element x _i ′ ∈Z _q Select the secret key x _i ∈Z _q , The disposable public key σ _i = (H ^ x _i ) (R ^ x _i ′) (Where h = H (n, t, t ′, y ₁ , ..., y _n , M) ∈ G) generating means C;
The disposable public key σ of each participant device i (i = s + 1,..., T ′) belonging to the set T′-S. _i Means D for arbitrarily selecting from the cyclic group G;
The disposable public key σ of each participant device i (i = 1,..., T ′) belonging to the set T ′ _i (I = 1,..., T ′)

age,
A ₀ = H '(n, t, t', y ₁ , ..., y _n , M) ∈ G,

(J = 1,..., T ′) and the disposable public key of each participant device (i = t ′ + 1,..., N) belonging to the set N-T ′

Means E for calculating
Arbitrary source w _i , W _i ′ ∈Z _q Select the source w _i , W _i ' _i = G ^ w _i ∈G and b _i = (H ^ w _i ) (R ^ w _i ′) Means F for generating ∈G;
Arbitrary z corresponding to each participant device i (i = s + 1,..., N) belonging to the set NS _i , Z _i ', C _i ∈Z _q And select a _i = (G ^ z _i ) (Y _i ^ C _i ) ∈G and b _i = (H ^ z _i ) (R ^ z _i ’) (Σ _i ^ C _i ) Means G for generating ∈ G;
An arbitrary element c corresponding to each participant device i (i = t + 1,..., S) belonging to the set ST _i ∈Z _q Means H for selecting
β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, h, A ₀ , ..., A _{t ’} , a ₁ , ..., a _n , b ₁ , ..., b _n ) ∈Z _q
β (i) = c _i ∈Z _q (Where i = t + 1,..., N)
A polynomial β (x) ∈Z of degree (nt) satisfying _q Means I for determining [x];
Secret key x _i , X _i 'To use z _i = W _i -Β (i) x _i ∈Z _q , Z _i ’= W _i '-Β (i) x _i ′ ∈Z _q Means J for obtaining
Electronic signature σ = (A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n , Z ₁ ', ..., z _n ′) Output means K
Out of
The signature generation apparatus includes at least means B, means D, means E, means G, means H, means I, and means K.
Each participant device i includes at least means A, means C, means F, means J,
If the signature generation device matches any one of the n participant devices i (i = 1,..., N), the participant device has means A, means B, means C, means D, means E, means F, means G, means H, means I, means J, means K
Electronic signature system. A verification device for verifying the electronic signature σ generated by the electronic signature method according to claim 3,
A cyclic group G, generators g and R of the cyclic group G used in the electronic signature method according to claim 3, and an additive group Z _q , Hash function H, hash function H ′, hash function H ″, n, t, t ′, public key y of each participant device i (i = 1,..., N) belonging to set N ₁ , ..., y _n , Message m, electronic signature σ = (A ₁ , ..., A _{t ’} , Β (x), z ₁ , ..., z _n , Z ₁ ', ..., z _n ')Using,
h = H (n, t, t ', y ₁ , ..., y _n , M) is an element of the cyclic group G, A ₀ = H '(n, t, t', y ₁ , ..., y _n , M) is an element of the cyclic group G, A included in the electronic signature σ ₁ , ..., A _{t ’} Are elements of the cyclic group G, z included in the electronic signature σ ₁ , ..., z _n , Z ₁ ', ..., z _n 'Is the additive group Z _q A means of confirming that

Calculated by _i Means for confirming that (i = 1,..., N) is an element of the cyclic group G;
Polynomial β (x), z included in electronic signature σ ₁ , ..., z _n , Z ₁ ', ..., z _n 'Using,

(I = 1,..., N) is obtained, and each coefficient of the polynomial β (x) included in the electronic signature σ is added to the additive group Z. _q , The degree of the polynomial β (x) is n−t, β (0) = H ″ (n, t, t ′, y ₁ , ..., y _n , m, h, A ₀ , ..., A _{t ’} , a ₁ ’, ..., a _n ’, B ₁ ’,…, B _n ’) Means to confirm that
Verification device including Storage means for storing a secret key x _i unique to the signer i, an identification number i unique to the signer i, a message m, and a label L common to all signers;
A unique temporary public key for generating a unique temporary public key generation factor h used to generate a unique temporary public key σ _i unique to the signer i by inputting the label L stored in the storage means into the hash function H Generating factor generating means;
Specific temporary public key generation factor specific unique temporary public key to the signer i from generated by the generating means unique temporary public key generation factor h signer and unique secret key x _i to i stored in the storage means sigma _i A unique temporary public key generating means for generating
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ and generating the disturbing factor generating factor A ₀ used for generating the disturbing factor A ₁ ;
The disturbance factor A ₁ = the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the unique temporary public key σ _i generated by the unique temporary public key generation means, and the identification number i stored in the storage means. A disturbance factor generating means for generating (σ _i / A ₀ ) ^ (1 / i);
The number of temporary temporary public keys σ _j = A that is obtained by subtracting 1 from the total number of signers n from the disturbance factor A ₁ generated by the disturbance factor generation unit and the disturbance factor generation factor A ₀ generated by the disturbance factor generation unit ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non-interactive zero-knowledge proof information for generating a non-interactive zero-knowledge proof information used to prove the non-interactive zero-knowledge proof that generates a unique temporary public key sigma _i using a unique secret key x _i to the signer i Generating means;
Non-interactive zero knowledge proof information generating factor generating means for generating non-interactive zero knowledge proof information generating factor capable of generating non-interactive zero knowledge proof information generated by non-interactive zero knowledge proof information generating means;
The disturbing factor A ₁ generated by the disturbing factor generating means and the non-interactive zero knowledge proof information generating factor generated by the non-interactive zero knowledge proof information generating factor are used to sign the label L and the message m stored in the storing means. And signature generation means
The unique temporary public key σ _i generated by the unique temporary public key generating means and the disturbing temporary public key σ _j generated by the disturbing temporary public key generating means [j = 1, 2,..., I−1, i + 1, .., N] is the disturbance generated by the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means and the disturbance generated by the disturbance factor generation means, so that the distinctive temporary public key and the disturbance temporary public key cannot be distinguished. A signature device that can be generated from the factor A ₁ . Storage means for storing message m and label L, label L and signature for message m common to all signers;
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ;
N temporary public keys σ _f = A ₀ corresponding to the total number of signers from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means. Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means And a verification means for verifying zero knowledge proof between the verification devices. Storage means for storing a signature generated by each signature device and a message m corresponding to each signature, and a label L common to all signers;
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ;
N temporary public keys σ _f = A ₀ corresponding to the total number of signers from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means. Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means A determination means for verifying zero knowledge proof between
Selection control means for selecting two different signatures ξ, ξ ′ and messages m, m ′ corresponding to these signatures from the signatures generated by each signature device stored in the storage means;
About the temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for two different signatures ξ, ξ ′ selected by the selection control unit generated by the temporary public key generation unit A verification apparatus comprising: a duplicate temporary public key verification unit that determines whether or not σ _f = σ _f ′ holds for each f. The duplicate temporary public key verification means is
With _{respect to} temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for two different signatures ξ, ξ ′ selected by the selection control means, σ _f = σ for each f. determine whether _f 'is true,
When σ _f = σ _f ′ holds for all of f = 1, 2,..., n, the two signatures ξ and ξ ′ are signatures (copy signatures) for the same message by the same signature device. Identify,
If σ _p = σ _p ′ holds for one p [where p∈ {1, 2,..., N}], the two signatures ξ and ξ ′ are signatures for different messages by the same signature device. The verification apparatus according to claim 11 , wherein the verification apparatus specifies that the signature is a duplicate signature. Storage means for storing a signature generated by each signature device and a message m corresponding to each signature, and a label L common to all signers;
Selection control means for selecting two different signatures ξ, ξ ′ and messages m, m ′ corresponding to these signatures from the signatures generated by each signature device stored in the storage means;
For each of two different signatures ξ and ξ ′ selected by the selection control means, the message m, m ′ and label L corresponding to each signature are input to the hash function H ′, and the disturbance factor generation factors A ₀ and A ₀ are input. A disturbing factor generating factor generating means for generating ',
For each of two different signatures ξ and ξ ′ selected by the selection control means, the disturbance factors A ₁ and A ₁ ′ and the disturbance factor generation factor generation included in the two different signatures ξ and ξ ′ selected by the selection control means N temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] corresponding to the total number of signers are generated from the disturbance factor generation factors A ₀ , A ₀ ′ generated by the means. A temporary public key generating means for
With _{respect to} temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for each of two different signatures ξ, ξ ′ generated by the temporary public key generation means, σ f for each _f. A duplicate signature copy signature detection apparatus comprising: a duplicate temporary public key verification unit that determines whether or not σ _f ′ holds. The duplicate temporary public key verification means is
With _{respect to} temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for two different signatures ξ, ξ ′ selected by the selection control means, σ _f = σ for each f. determine whether _f 'is true,
When σ _f = σ _f ′ holds for all of f = 1, 2,..., n, the two signatures ξ and ξ ′ are signatures (copy signatures) for the same message by the same signature device. Identify,
If σ _p = σ _p ′ holds for one p [where p∈ {1, 2,..., N}], the two signatures ξ and ξ ′ are signatures for different messages by the same signature device. The duplicate signature copy signature detection apparatus according to claim 13 , wherein the duplicate signature is specified as (duplicate signature). One or more signature devices and a verification device are communicatively connected to each other;
The signing device
Storage means for storing a secret key x _i unique to the signer i, an identification number i unique to the signer i, a message m, and a label L common to all signers;
A unique temporary public key for generating a unique temporary public key generation factor h used to generate a unique temporary public key σ _i unique to the signer i by inputting the label L stored in the storage means into the hash function H Generating factor generating means;
Specific temporary public key generation factor specific unique temporary public key to the signer i from generated by the generating means unique temporary public key generation factor h signer and unique secret key x _i to i stored in the storage means sigma _i A unique temporary public key generating means for generating
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ and generating the disturbing factor generating factor A ₀ used for generating the disturbing factor A ₁ ;
The disturbance factor A ₁ = the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the unique temporary public key σ _i generated by the unique temporary public key generation means, and the identification number i stored in the storage means. A disturbance factor generating means for generating (σ _i / A ₀ ) ^ (1 / i);
The number of temporary temporary public keys σ _j = A that is obtained by subtracting 1 from the total number of signers n from the disturbance factor A ₁ generated by the disturbance factor generation unit and the disturbance factor generation factor A ₀ generated by the disturbance factor generation unit ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non-interactive zero-knowledge proof information for generating a non-interactive zero-knowledge proof information used to prove the non-interactive zero-knowledge proof that generates a unique temporary public key sigma _i using a unique secret key x _i to the signer i Generating means;
Non-interactive zero knowledge proof information generating factor generating means for generating non-interactive zero knowledge proof information generating factor capable of generating non-interactive zero knowledge proof information generated by non-interactive zero knowledge proof information generating means;
The disturbing factor A ₁ generated by the disturbing factor generating means and the non-interactive zero knowledge proof information generating factor generated by the non-interactive zero knowledge proof information generating factor are used to sign the label L and the message m stored in the storing means. A signature generation means and a verification apparatus capable of transmitting a label L, a message m, a label L, and a signature for the message m to the verification apparatus,
The unique temporary public key σ _i generated by the unique temporary public key generating means and the disturbing temporary public key σ _j generated by the disturbing temporary public key generating means [j = 1, 2,..., I−1, i + 1, .., N] is the disturbance generated by the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means and the disturbance generated by the disturbance factor generation means, so that the distinctive temporary public key and the disturbance temporary public key cannot be distinguished. Can be generated from factor A ₁ ,
The verification device is
A signature device receiving means capable of receiving a signature for the label L, the message m, the label L, and the message m from the signature device;
Storage means for storing a signature for the message m, label L, label L and message m received by the signature receiving means;
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ;
N temporary public keys σ _f = A ₀ corresponding to the total number of signers from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means. Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means A signature verification system comprising: a determination means for verifying a zero knowledge proof between the two. One or more signature devices and a verification device are communicatively connected to each other;
The signing device
Storage means for storing a secret key x _i unique to the signer i, an identification number i unique to the signer i, a message m, and a label L common to all signers;
A unique temporary public key for generating a unique temporary public key generation factor h used to generate a unique temporary public key σ _i unique to the signer i by inputting the label L stored in the storage means into the hash function H Generating factor generating means;
Specific temporary public key generation factor specific unique temporary public key to the signer i from generated by the generating means unique temporary public key generation factor h signer and unique secret key x _i to i stored in the storage means sigma _i A unique temporary public key generating means for generating
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ and generating the disturbing factor generating factor A ₀ used for generating the disturbing factor A ₁ ;
The disturbance factor A ₁ = the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the unique temporary public key σ _i generated by the unique temporary public key generation means, and the identification number i stored in the storage means. A disturbance factor generating means for generating (σ _i / A ₀ ) ^ (1 / i);
The number of temporary temporary public keys σ _j = A that is obtained by subtracting 1 from the total number of signers n from the disturbance factor A ₁ generated by the disturbance factor generation unit and the disturbance factor generation factor A ₀ generated by the disturbance factor generation unit ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non-interactive zero-knowledge proof information for generating a non-interactive zero-knowledge proof information used to prove the non-interactive zero-knowledge proof that generates a unique temporary public key sigma _i using a unique secret key x _i to the signer i Generating means;
Non-interactive zero knowledge proof information generating factor generating means for generating non-interactive zero knowledge proof information generating factor capable of generating non-interactive zero knowledge proof information generated by non-interactive zero knowledge proof information generating means;
The disturbing factor A ₁ generated by the disturbing factor generating means and the non-interactive zero knowledge proof information generating factor generated by the non-interactive zero knowledge proof information generating factor are used to sign the label L and the message m stored in the storing means. A signature generation means and a verification apparatus capable of transmitting a label L, a message m, a label L, and a signature for the message m to the verification apparatus,
The unique temporary public key σ _i generated by the unique temporary public key generating means and the disturbing temporary public key σ _j generated by the disturbing temporary public key generating means [j = 1, 2,..., I−1, i + 1, .., N] is the disturbance generated by the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means and the disturbance generated by the disturbance factor generation means, so that the distinctive temporary public key and the disturbance temporary public key cannot be distinguished. Can be generated from factor A ₁ ,
The verification device is
A signature device receiving means capable of receiving a signature generated by each signature device and a message m corresponding to each signature, and a label L common to all the signers, from each signature device;
Storage means for storing the signature generated by each signature device, the message m and the label L corresponding to each signature received by the signature device reception means;
Disturbing factor generating factor generating means for inputting the label L and the message m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ;
N temporary public keys σ _f = A ₀ corresponding to the total number of signers from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means. Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means A determination means for verifying zero knowledge proof between
Selection control means for selecting two different signatures ξ, ξ ′ and messages corresponding to these signatures from the signatures generated by the respective signature devices stored in the storage means when the zero knowledge proof is successfully verified by the determination means When,
About the temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for two different signatures ξ, ξ ′ selected by the selection control unit generated by the temporary public key generation unit A signature verification system for detecting a duplicate signature and / or a copy signature, comprising: a duplicate temporary public key verification unit that determines whether or not σ _f = σ _f ′ holds for each f. One or more signature devices and a verification device are communicatively connected to each other;
And a unique secret key x _i to the signer i, signer i a unique identification number i, and the message m, a common label L is stored in the storage means of the signing device to all signers,
In order for the unique temporary public key generation factor generating unit of the signature device to input the label L stored in the storage unit of the signature device to the hash function H and generate the unique temporary public key σ _i unique to the signer i A unique temporary public key generation factor generation step for generating a unique temporary public key generation factor h to be used;
The unique temporary public key generation means of the signature device generates the unique temporary public key generation factor h generated in the unique temporary public key generation factor generation step and the secret key x _i unique to the signer i stored in the storage means of the signature device. A unique temporary public key generation step for generating a unique temporary public key σ _i unique to the signer i from
The disturbance factor generating factor generating means of the signature device inputs the label L and the message m stored in the storage means of the signature device into the hash function H ′, and is used to generate the disturbance factor A ₁ a disturbance factor generation factor generation step of generating a a _0,
The disturbance factor generation means of the signature device stores the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step, the unique temporary public key σ _i generated in the unique temporary public key generation step, and the storage means of the signature device. A disturbance factor generating step for generating a disturbance factor A ₁ = (σ _i / A ₀ ) ^ (1 / i) from the identification number i
The disturbance temporary public key generation means of the signature device subtracts 1 from the total number of signers n from the disturbance factor A ₁ generated in the disturbance factor generation step and the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step. A disturbing temporary public key generating step for generating a predetermined number of disturbing temporary public keys σ _j = A ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non dialogue non-interactive zero-knowledge proof information generation means of the signature device, used to prove the non-interactive zero-knowledge proof that generates a unique temporary public key sigma _i using a unique secret key x _i to the signer i A non-interactive zero knowledge proof information generation step for generating zero knowledge proof information;
Non-interactive zero-knowledge proof information generating factor generating means for generating a non-interactive zero-knowledge proof information generating factor capable of generating non-interactive zero-knowledge proof information generated in the non-interactive zero-knowledge proof information generating step Zero knowledge proof information generation factor generation step,
The signature generation means of the signature device stores the disturbance factor A ₁ generated in the disturbance factor generation step and the non-interaction zero knowledge proof information generation factor generated in the non-interaction zero knowledge proof information generation factor in the storage means. Generating a signature for the label L and the message m.
A pair verification device transmission means for transmitting a signature for the label L, the message m, the label L, and the message m to the verification device;
A signature-signing-device receiving unit in which a signature-signing-device receiving unit of the verification device receives a signature for the label L, the message m, the label L, and the message m from the signature device;
A storage step in which the storage means of the verification device stores the message m, the label L, the label L, and the signature for the message m received in the signature device reception step;
A second disturbance factor generating factor for generating a disturbance factor generating factor A ₀ by inputting the label L and the message m stored in the storage unit of the verification device to the hash function H ′ by the disturbance factor generating factor generating unit of the verification device Generation step;
Temporary public key generating means of the verification apparatus, the total signature from disturbance factor generation factor A ₀ generated by the disturbance factor A ₁ and the second disturbance factor generation factor generation step includes a signature that is stored in the storage means of the verification device's A temporary public key generation step for generating n temporary public keys σ _f = A ₀ A ₁ ^f [f = 1, 2,..., N] corresponding to the number;
Second non-interaction in which the non-interactive zero knowledge proof information generating means of the verification device generates non-interactive zero knowledge proof information using the non-interactive zero knowledge proof information generation factor included in the signature stored in the storage means of the verification device Zero knowledge proof information generation step,
The verification means of the verification device includes the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step, the disturbance factor A ₁ included in the signature stored in the storage means of the verification device, and second non-interactive zero knowledge proof information And a determination step for verifying zero knowledge proof between the non-interactive zero knowledge proof information generated in the generation step. One or more signature devices and a verification device are communicatively connected to each other;
And a unique secret key x _i to the signer i, signer i a unique identification number i, and the message m, a common label L is stored in the storage means of the signing device to all signers,
In order for the unique temporary public key generation factor generating unit of the signature device to input the label L stored in the storage unit of the signature device to the hash function H and generate the unique temporary public key σ _i unique to the signer i A unique temporary public key generation factor generation step for generating a unique temporary public key generation factor h to be used;
The unique temporary public key generation means of the signature device generates the unique temporary public key generation factor h generated in the unique temporary public key generation factor generation step and the secret key x _i unique to the signer i stored in the storage means of the signature device. A unique temporary public key generation step for generating a unique temporary public key σ _i unique to the signer i from
The disturbance factor generating factor generating means of the signature device inputs the label L and the message m stored in the storage means of the signature device into the hash function H ′, and is used to generate the disturbance factor A ₁ a disturbance factor generation factor generation step of generating a a _0,
The disturbance factor generation means of the signature device stores the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step, the unique temporary public key σ _i generated in the unique temporary public key generation step, and the storage means of the signature device. A disturbance factor generating step for generating a disturbance factor A ₁ = (σ _i / A ₀ ) ^ (1 / i) from the identification number i
The disturbance temporary public key generation means of the signature device subtracts 1 from the total number of signers n from the disturbance factor A ₁ generated in the disturbance factor generation step and the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step. A disturbing temporary public key generating step for generating a predetermined number of disturbing temporary public keys σ _j = A ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non dialogue non-interactive zero-knowledge proof information generation means of the signature device, used to prove the non-interactive zero-knowledge proof that generates a unique temporary public key sigma _i using a unique secret key x _i to the signer i A non-interactive zero knowledge proof information generation step for generating zero knowledge proof information;
Non-interactive zero-knowledge proof information generating factor generating means for generating a non-interactive zero-knowledge proof information generating factor capable of generating non-interactive zero-knowledge proof information generated in the non-interactive zero-knowledge proof information generating step Zero knowledge proof information generation factor generation step,
The signature generation means of the signature device stores the disturbance factor A ₁ generated in the disturbance factor generation step and the non-interaction zero knowledge proof information generation factor generated in the non-interaction zero knowledge proof information generation factor in the storage means. Generating a signature for the label L and the message m.
A pair verification device transmission means for transmitting a signature for the label L, the message m, the label L, and the message m to the verification device;
A signature-signing-device receiving unit for receiving a signature generated by each signature device, a message m corresponding to each signature, and a label L from each signature device;
A storage step in which the storage means of the verification device stores the signature generated by each signature device, the message m and the label L corresponding to each signature received in the signature receiving device reception step;
A second disturbance factor generating factor for generating a disturbance factor generating factor A ₀ by inputting the label L and the message m stored in the storage unit of the verification device to the hash function H ′ by the disturbance factor generating factor generating unit of the verification device Generation step;
Temporary public key generating means of the verification apparatus, the total signature from disturbance factor generation factor A ₀ generated by the disturbance factor A ₁ and the second disturbance factor generation factor generation step includes a signature that is stored in the storage means of the verification device's A temporary public key generation step for generating n temporary public keys σ _f = A ₀ A ₁ ^f [f = 1, 2,..., N] corresponding to the number;
Second non-interaction in which the non-interactive zero knowledge proof information generating means of the verification device generates non-interactive zero knowledge proof information using the non-interactive zero knowledge proof information generation factor included in the signature stored in the storage means of the verification device Zero knowledge proof information generation step,
The verification means of the verification device includes the disturbance factor generation factor A ₀ generated in the disturbance factor generation factor generation step, the disturbance factor A ₁ included in the signature stored in the storage means of the verification device, and second non-interactive zero knowledge proof information A determination step for verifying zero knowledge proof between the non-interactive zero knowledge proof information generated in the generation step;
When the selection control unit of the verification device succeeds in verifying the zero knowledge proof in the determination step, two signatures ξ, ξ ′ different from the signatures generated by the signature devices stored in the storage unit of the verification device and these A selection control step for selecting a message corresponding to the signature;
The duplicate temporary public key verification means of the verification device generates temporary public keys σ _f and σ _f ′ [f = for each of two different signatures ξ and ξ ′ selected in the selection control step generated in the temporary public key generation step. 1, 2,..., N], and a duplicate temporary public key verification step for determining whether or not σ _f = σ _f ′ holds for each f. Or a signature verification method that detects copy signatures. One or more electronic voting devices, a voting device, and an information disclosure server device are connected to be able to communicate with each other,
The information disclosure server device
A storage means capable of storing a label L including information for specifying an election, a vote content m, a signature (voting signature) for the vote content m,
An electronic voting apparatus transmitting means capable of transmitting a label L and voting content m stored in the storage means to the electronic voting apparatus;
An electronic voting device receiving means capable of receiving the label L, the voting content m and the voting signature transmitted by the electronic information disclosure server device transmitting means of the electronic voting device;
A labeling device stored in the storage means, a vote content m, and a counter-voting device transmitting means capable of transmitting a vote signature for the vote content m,
The electronic voting device is
A counter information disclosure server apparatus receiving means for receiving the label L and the voting content m transmitted by the electronic voting apparatus transmission means of the information disclosure server apparatus;
And a unique secret key x _i to vote content m and the label L and voter i received by the pair information publishing server device receiving means, storage means for storing a unique identification number i to the voter i,
A unique temporary public key for generating a unique temporary public key generation factor h used to generate a unique temporary public key σ _i unique to the voter i by inputting the label L stored in the storage means into the hash function H Generating factor generating means;
Specific temporary public key-specific temporary public key specific to the voter i to voter i to be stored in the unique temporary public key generation factor h and a storage means which is generated by the generating factor generating means from a unique secret key x _i σ _i A unique temporary public key generating means for generating
Disturbing factor generating factor generating means for inputting a label L and voting content m stored in the storing means to the hash function H ′ to generate a disturbing factor generating factor A ₀ used for generating the disturbing factor A ₁ ;
The disturbance factor A ₁ = the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the unique temporary public key σ _i generated by the unique temporary public key generation means, and the identification number i stored in the storage means. A disturbance factor generating means for generating (σ _i / A ₀ ) ^ (1 / i);
The number of temporary disturbance public keys σ _j = A that is obtained by subtracting 1 from the total number of votes n from the disturbance factor A ₁ generated by the disturbance factor generation unit and the disturbance factor generation factor A ₀ generated by the disturbance factor generation unit ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non-interactive zero-knowledge proof information to generate a non-interactive zero-knowledge proof information to be used for voter i in order to prove by non-interactive zero-knowledge proof that generates a unique temporary public key σ _i by using a unique secret key x _i Generating means;
Non-interactive zero knowledge proof information generating factor generating means for generating non-interactive zero knowledge proof information generating factor capable of generating non-interactive zero knowledge proof information generated by non-interactive zero knowledge proof information generating means;
The disturbing factor A ₁ generated by the disturbing factor generating means and the non-interactive zero knowledge proof information generating factor generated by the non-interactive zero knowledge proof information generating factor are assigned to the label L and the vote contents m stored in the storing means. A signature generation means for making a signature (voting signature);
An information disclosure server device transmitting means capable of transmitting a label L, a vote content m, a label L and a vote signature for the vote content m to the information disclosure server device,
The unique temporary public key σ _i generated by the unique temporary public key generating means and the disturbing temporary public key σ _j generated by the disturbing temporary public key generating means [j = 1, 2,..., I−1, i + 1, .., N] is the disturbance generated by the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means and the disturbance generated by the disturbance factor generation means, so that the distinctive temporary public key and the disturbance temporary public key cannot be distinguished. Can be generated from factor A ₁ ,
The above counting device is
Anti-information disclosure server device receiving means capable of receiving a voting signature generated by each electronic voting device, voting content m and label L corresponding to each voting signature from the information disclosure server device;
Storage means for storing the voting signature generated by each electronic voting device, the voting content m and the label L corresponding to each voting signature received by the information disclosure server device receiving means;
Disturbing factor generating factor generating means for inputting the label L and the vote content m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ;
N temporary public keys σ _f = A corresponding to the total number of voters from the disturbance factor A ₁ included in the voting signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means Temporary public key generation means for generating ₀ A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the voting signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the voting signature stored in the storage means, and the non-interaction zero knowledge proof generated by the non-interaction zero knowledge proof information generation means A determination means for verifying zero knowledge proof between information;
When the zero-knowledge proof is successfully verified by the judging means, two different voting signatures ξ, ξ ′ and voting contents corresponding to these voting signatures are obtained from the voting signatures generated by each electronic voting device stored in the storage means Selection control means to select;
Temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for each of two different voting signatures ξ, ξ ′ selected by the selection control unit, generated by the temporary public key generation unit. For each f, a duplicate temporary public key verification means for determining whether or not σ _f = σ _f ′ is satisfied, a verification of zero knowledge proof by the determination means, a duplicate vote signature by the duplicate temporary public key verification means, and / or When the copy vote signature is successfully detected, all the vote contents corresponding to the duplicate vote signature are excluded, and the vote contents corresponding to the copy vote signature are excluded from the total number minus 1. An electronic voting vote system for detecting duplicate voting signatures and / or copy voting signatures, characterized in that it comprises a counting means for counting the number of votes voted for the voting contents. One or more user devices, one or more store devices, and a bank verification device are connected to be able to communicate with each other,
The user device is
An anti-store device receiving means for receiving transaction information m which is information for identifying a transaction from the store device;
And transaction information received by the pair shop device receiving unit m, stores a unique secret key x _i to the user i, and a unique identification number i to the user i, a label L which contains information amount of electronic cash Storage means;
A unique temporary public key for generating a unique temporary public key generation factor h used for generating a unique temporary public key σ _i unique to the user i by inputting the label L stored in the storage means into the hash function H Generating factor generating means;
Specific temporary public key-specific temporary public key specific to the user i to user i that is stored in the specific temporary public key generation factor h and a storage means which is generated by the generating factor generating means from a unique secret key x _i σ _i A unique temporary public key generating means for generating
Disturbing factor generation factor generating means for inputting the label L and the transaction information m stored in the storage means to the hash function H ′ and generating the disturbance factor generating factor A ₀ used for generating the disturbance factor A ₁ ;
The disturbance factor A ₁ = the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the unique temporary public key σ _i generated by the unique temporary public key generation means, and the identification number i stored in the storage means. A disturbance factor generating means for generating (σ _i / A ₀ ) ^ (1 / i);
The number of temporary disturbance public keys σ _j = A that is obtained by subtracting 1 from the total number of users n from the disturbance factor A ₁ generated by the disturbance factor generation unit and the disturbance factor generation factor A ₀ generated by the disturbance factor generation unit ₀ A ₁ ^j [j = 1, 2,..., I−1, i + 1,.
Non-interactive zero-knowledge proof information for generating non-interactive zero-knowledge proof information used to prove by using non-interactive zero-knowledge proof that a unique temporary public key σ _i is generated using a secret key x _i unique to user i Generating means;
Non-interactive zero knowledge proof information generating factor generating means for generating non-interactive zero knowledge proof information generating factor capable of generating non-interactive zero knowledge proof information generated by non-interactive zero knowledge proof information generating means;
The disturbance factor A ₁ generated by the disturbance factor generation means and the non-interaction zero knowledge proof information generation factor generated by the non-interaction zero knowledge proof information generation factor are stored in the label L and the transaction information m stored in the storage means. A signature generating means for making a signature, and a store apparatus transmitting means for transmitting a label for the label L, transaction information m, label L and transaction information m as electronic cash to the store apparatus,
The unique temporary public key σ _i generated by the unique temporary public key generating means and the disturbing temporary public key σ _j generated by the disturbing temporary public key generating means [j = 1, 2,..., I−1, i + 1, .., N] is the disturbance generated by the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means and the disturbance generated by the disturbance factor generation means, so that the distinctive temporary public key and the disturbance temporary public key cannot be distinguished. Can be generated from factor A ₁ ,
The store device is
A user device transmission means for transmitting the transaction information m to the user device;
A user device receiving means for receiving a label for the label L, the transaction information m, the label L, and the transaction information m from the user device;
Storage means for storing the signature generated by the user device, the transaction information m and the label L corresponding to each signature received by the user device reception means;
Disturbing factor generating factor generating means for inputting the label L and the transaction information m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ,
N temporary public keys σ _f = A ₀ corresponding to the total number of users from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means A determination means for verifying zero knowledge proof between
When the zero-knowledge proof is successful by the judging means, the anti-bank verification apparatus transmitting means for transmitting the label L, the transaction information m, the label L and the signature for the transaction information m received by the anti-user apparatus receiving means to the bank verification apparatus And
The bank verification device
To store device receiving means for receiving a label for each label L, transaction information m, label L and transaction information m from each store device;
Storage means for storing the signature generated by each user device, the voting content m and the label L corresponding to each signature received by the store device receiving means;
Disturbing factor generating factor generating means for inputting the label L and the transaction information m stored in the storing means to the hash function H ′ to generate the disturbing factor generating factor A ₀ ,
N temporary public keys σ _f = A ₀ corresponding to the total number of users from the disturbance factor A ₁ included in the signature stored in the storage means and the disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means Temporary public key generation means for generating A ₁ ^f [f = 1, 2,..., N];
Non-interactive zero knowledge proof information generating means for generating non-interactive zero knowledge proof information using a non-interactive zero knowledge proof information generating factor included in the signature stored in the storage means;
The disturbance factor generation factor A ₀ generated by the disturbance factor generation factor generation means, the disturbance factor A ₁ included in the signature stored in the storage means, and the non-interaction zero knowledge proof information generated by the non-interaction zero knowledge proof information generation means A determination means for verifying zero knowledge proof between
Selection control means for selecting two different signatures ξ, ξ ′ and transaction information m, m ′ corresponding to these signatures from the signatures generated by each user device stored in the storage means;
About the temporary public keys σ _f , σ _f ′ [f = 1, 2,..., N] for two different signatures ξ, ξ ′ selected by the selection control unit generated by the temporary public key generation unit Duplicate temporary public key verification means for determining whether or not σ _f = σ _f ′ holds for each f;
Account management means for transferring the amount determined in the label L to the bank account of the store when the verification of the zero knowledge proof by the determination means and the detection of the duplicate signature and / or the copy signature by the duplicate temporary public key verification means are successful;
An electronic cash payment system comprising: The program which performs each step of the method in any one of Claim 1, 2, 3, 4, 17 , 18 with a computer.

Images