JP5058654B2 - Electronic signature apparatus, method, and program - Google Patents

Description

  The present invention relates to a resignature technique for providing an electronic signature to an electronic document, and for reassigning an electronic signature with another function when a cryptographic function used for the electronic signature is compromised.

Conventionally, encryption technology for enhancing the security of information systems has been widely used, and digital signature technology is one of them. An electronic signature is electronic information given to an electronic document. A recipient of an electronic document verifies the electronic signature, and confirms the origin of the electronic document, such as a mark or signature on a paper document. Can prevent counterfeiting and tampering.
In general, in order to improve the processing efficiency while maintaining the reliability of an electronic signature, an electronic signature is obtained by performing a first arithmetic processing that performs a power-residue operation on a random number, and then calculating a result of the first arithmetic processing. Using a hash function that calculates the digest value of an electronic document (hereinafter referred to as a message) using a one-way function and a private key based on a public key cryptosystem to prove that the signer himself has signed. This is realized in combination with the second arithmetic processing. As these signature methods, there are electronic signature methods such as RSA signature and DSA (Digital Signature Algorithm).

However, the security of electronic signatures using cryptographic techniques may decrease due to improvements in computational capabilities and the discovery of new attack methods for cryptographic techniques. For example, the encryption technique is compromised by finding an attack that finds a collision of hash values of hash functions used in the electronic signature processing.
In general, a guarantee period is determined for an electronic signature in accordance with the necessity of the electronic signature and the strength of a cryptographic function to be used. That is, the electronic signer guarantees the validity of the electronic signature only during the guarantee period. For this reason, for example, when an electronic signature is applied to a message relating to a contract and the contract period is extended, it is necessary to extend the guarantee period of the electronic signature.
In this way, in the case where it is necessary to extend the warranty period of the electronic signature, the already distributed electronic signature is collected, resigned (re-typed) using a different hash function, and redistributed. An electronic signature scheme that realizes long-term guarantee can be considered.

With reference to FIGS. 9 and 10, an example of re-signature processing according to the prior art will be described.
The electronic signature device generates a signature key (secret key) (x) and a public key (p, q, g, y (y = g ^x )) in advance. Then, the electronic signature device stores in advance the message (M) that is the signature processing target. Electronic signature apparatus generates a random number (k _1), performs a first calculation process for calculating equation (1) by the first operation result (R ₁₎ below.

The function F in the equation (1) is a one-way function, and generally a hash function is used for the electronic signature processing. A hash function is a function that has a one-way property in which a value before calculation cannot be calculated backward from a value after calculation of a certain value and a non-collision property in which a value after calculation of a certain value does not match a value after calculation of another value.
Then, using the signature key (x) generated in advance, a second calculation process for calculating a second calculation result (t ₁ ) is performed on the message by the following expression (2).

h ₁ is the first hash function determined in advance.
The electronic signature device uses a combination of the first calculation result (R ₁ ) and the second calculation result (t ₁ ) as an electronic signature (σ ₁ ).
When it is necessary to generate the electronic signature document for a plurality of (m) verifiers, the electronic signature device performs the random number generation processing, the first arithmetic processing, and the second arithmetic processing described above. It may be repeated m times. The electronic signature apparatus includes a message (M), an electronic signature (sigma ₁₎ and which is a combination electronic signature document (M, sigma _1), and transmits to the verifier.
The verifier verifies the electronic signature (σ ₁ (σ ₁ = (R ₁ , t ₁ ))) by the following expression (3) by the verification device.

When the guarantee period of the electronic signature (σ ₁ ) expires or the encryption function is compromised and re-signing is performed, the verifier transmits the electronic signature document (M, σ ₁ ) to the electronic signature device. . At this time, if m digital signatures are generated in advance, n (n <m) digital signatures are re-signed. The electronic signature device verifies the received electronic signature (M, σ ₁ ) by the above equation (3), and performs resignature processing when the left side and the right side of the equation (3) match. That is, the electronic signature apparatus generates a random number _{(k 2),} providing a different hash function _{(h 2)} and _{h 1.} Then, the first calculation result (R ₂ ) is calculated by the following equation (4).

Formula (4) is the same structure as Formula (1). Then, the electronic signature device calculates a _second calculation result (t ₂ ) for the message by the following equation (5).

Formula (5) is the same structure as Formula (2).
The combination of the first calculation result (R ₂ ) and the second calculation result (t ₂ ) is the electronic signature (σ ₂ ) of the resignature, and the combination of the message (M) and the electronic signature (σ ₂ ) The electronic signature document (M, σ ₂ ) is transmitted to the verifier.
The verifier verifies the electronic signature by the following equation (6) using the verification device.

By performing resignaturing in this way, it is possible to extend the guarantee period of the electronic signature.
In addition, in the electronic signature disclosed in Patent Document 1, when the need for re-signing occurs, the private key and the public key are re-generated and re-signed, and the operation log is further signed. Therefore, it is proposed to extend the signature for long-term guarantee. In Patent Document 2, when re-signing using a new key, the update process of the electronic signature is performed by including the update history of the expiration date in the electronic signature information.
JP 2004-320494 A JP-A-2005-204126

  The case where such re-signature is necessary is, for example, when the guarantee period of the electronic signature has expired, or when the hash function is compromised due to improvement of the calculation function or discovery of a new attack method. An electronic signature guarantee period expires for each individual electronic signature, but when a hash function is compromised, all of the electronic signatures signed by the hash function are subject to re-signing. In other words, if the hash function used in the electronic signature processing is compromised, the signature document may be forged. For documents that require verification of the validity of the electronic signature even after the compromise, the hash function When compromise occurs, re-signing (re-signing) is indispensable. In this case, it is assumed that requests for resignature processing are concentrated at one time, and a huge burden is imposed on the signer.

  Furthermore, the modular multiplication process to be used in the above formulas (1) and (4) is generally performed as a mathematical process that is the core of the public key cryptosystem, but it is a heavy processing for the computer. . In other words, when the computer performs a power-residue operation as used in Equation (1), a calculation method is used in which the remainder operation is sequentially performed for each power, so that complicated calculations must be repeated. Rather, it is a heavy processing. When resignature requests are concentrated due to compromise of the cryptographic function, the digital signature device must perform a large number of exponentiation operations at a time.

  The present invention has been made in view of such a situation, and provides an electronic signature device that reduces the load on the electronic signature device in resignature processing when a cryptographic function is compromised.

In order to solve the above problem, the present invention provides a signature key (for example, the present embodiment) corresponding to a public key (for example, the public key (p, q, g, y (y = g ^x ) in the present embodiment)). In each of the plurality of electronic documents (for example, message (M) in the present embodiment) using the signature key (for example, the electronic signature (σ _j in the present embodiment)). (Σ ′ _j )) is assigned to an electronic signature device (for example, the electronic signature device 100 in the present embodiment), and a result of performing a modular exponentiation of a random number (for example, k _i in the present embodiment) one-way function with the same type (for example, function F in the embodiment) first calculation result of the calculation by (e.g., r _i in this _embodiment) first calculating means for calculating a (e.g., the embodiment Signing in 111), a first operation result, an electronic document is signed, the signature key and the first hash function (e.g., h ₁ in this _embodiment) and the second calculation result using the (e.g., calculating a t _i) of the present embodiment, the first operation result and the electronic signature and a second calculation result (e.g., .sigma.i = (r i in this embodiment, _{t i))} signature means for generating a (e.g. , The signature assigning unit 111 in the present embodiment, and storage means (for example, the resignature information storage unit 124 in the present embodiment) that stores the random number and the first calculation result in association with each other as resignature information, When resignature processing is performed on an electronic document, a plurality of resignature information is read from the storage unit, and based on a plurality of random numbers (for example, k ₂ and k ₃ in the present embodiment) included in the read resignature information. First combination Broadcast (e.g., k _resign in this _embodiment) is calculated, read again signature information a plurality of first arithmetic operation results included in (e.g., r ₂ and r ₃ in this _embodiment) second combination based on A first recalculation unit (for example, a resignature assigning unit 112 in the present embodiment) for calculating information (for example, r _{design in} the present embodiment), a second combination information, an electronic document, a signature key, a second A second recalculation result is calculated based on the calculation result using the hash function (for example, h ₂ in the present embodiment) and the first combination information, and the first recalculation result and the second recalculation are calculated. An electronic signature apparatus comprising: a resignature unit (for example, the resignature adding unit 112 in the present embodiment) that generates a result as a redigital signature.

  The present invention provides re-signature information registration means (for example, the re-signature in this embodiment) that stores re-signature information in the storage means when the guarantee period of the input electronic signature is shorter than a predetermined period. The electronic signature device according to claim 1, further comprising a signature information registration unit (160).

  According to the present invention, the storage means stores a resignature use flag that is information indicating whether or not the resignature processing is used in association with the resignature information, and the resignature means uses the resignature use flag. The re-signature information indicating that the re-signature is not read out from the storage means as the second re-signature information, and the re-signature use flag corresponding to the read second re-signature information is used The electronic signature device according to claim 1, further comprising: a storage unit configured to store the electronic signature.

  The present invention provides an electronic signature method for assigning an electronic signature to each of a plurality of electronic documents using a signature key corresponding to a public key, wherein the first computing means performs a result of a modular exponentiation operation on a random number. A step of calculating a first calculation result calculated by a one-way function having homomorphism, a signature means, a first calculation result, an electronic document to be signed, a signature key, a first key The step of calculating the second calculation result using the hash function and generating the first calculation result and the second calculation result as an electronic signature, and the storage means correspond to the random number and the first calculation result And when the electronic document is re-signed, the first recalculation unit reads a plurality of re-signature information from the storage unit, and reads the re-signature information into the read re-signature information. First combination information based on a plurality of included random numbers A step of calculating second combination information based on a plurality of first calculation results included in the read-out reread signature information, and the resignature means include the second combination information, the electronic document, the signature key, the second The second recalculation result is calculated based on the calculation result using the hash function and the first combination information, and the first recalculation result and the second recalculation result are generated as a re-digital signature. A digital signature method comprising the steps of:

  According to the present invention, the result of the first arithmetic unit performing a power-residue calculation of a random number on a computer that assigns an electronic signature to each of a plurality of electronic documents using a signature key corresponding to a public key is obtained as a homomorphism. A step of calculating a first calculation result calculated by a one-way function having: a signature means: a first calculation result; an electronic document to be signed; a signature key; and a first hash function. And calculating the second calculation result using the second calculation result and generating the first calculation result and the second calculation result as an electronic signature, and the storage means re-signatures the random number and the first calculation result in association with each other. A first recalculation unit reads a plurality of resignature information from the storage unit and stores a plurality of resignature information included in the read resignature information. Calculate the first combination information based on random numbers A step of calculating second combination information based on a plurality of first calculation results included in the read resignature information, and the resignature means includes second combination information, an electronic document, a signature key, and a second hash. Calculating a second recalculation result based on the calculation result using the function and the first combination information, and generating the first recalculation result and the second recalculation result as a re-digital signature; , Is an electronic signature program.

  As described above, according to the present invention, electronic signature processing is performed using a one-way function having homomorphism, and a power residue calculation result calculated at this time is stored and used for resignature processing. Provided is an electronic signature device that efficiently re-signs by not performing a power-residue calculation process during signature processing.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
In the description of the present embodiment, a message refers to plain text that is subject to cryptographic processing to prevent forgery and tampering, and is electronic document information.
The electronic signature process is a first calculation process that generates a random number, performs a power-residue calculation based on the random number, and obtains a first calculation result, a first calculation result, a message, and a signature key. A digest related to the message is calculated, a second calculation process is performed, a digital signature that is information combining the first calculation result and the second calculation result is calculated, and the message And a process for generating an electronic signature document that is information combining the electronic signature. A hash function is a function having unidirectional and non-collision properties.

FIG. 1 is a diagram showing an outline of operation of resignature processing according to the present embodiment.
In the present embodiment, the electronic signature device uses a function having one-way property and homomorphism as the one-way function used for the first arithmetic processing for the electronic signature. The homomorphism will be described later. The electronic signature device performs a power-residue operation on the generated random number, further calculates the operation result by the function to obtain a first operation result, and based on the combination information of the first operation result and the message The second calculation result is calculated. The present invention stores the random number used at this time and the first calculation result, and uses the combination of the first calculation result for resignature processing when the hash function is compromised, thereby reducing the load. Processing efficiency is improved by generating an electronic signature without performing a high power modular calculation process. That is, conventionally, it is necessary to perform the exponentiation remainder operation again at the time of re-signing, but by using the homomorphism, it is only necessary to calculate the product of a plurality of first operation results.

FIG. 2 is a block diagram illustrating a configuration of the electronic signature device 100 according to the present embodiment.
The electronic signature device 100 includes a signature processing unit 110, a storage unit 120, a communication unit 130, a signature verification unit 140, a random number generation unit 150, a resignature information registration unit 160, and an input unit 170. Yes.
The signature processing unit 110 has a function of adding an electronic signature to an electronic document and outputting the electronic signature document, and includes a signature adding unit 111 and a resignature adding unit 112.
The signature assigning unit 111 generates a digital signature by performing a first calculation process that performs a power-residue calculation based on a random number and a second calculation process that performs a calculation using a hash function. The resignature giving unit 112 reads the resignature information stored in the resignature information storage unit 124 and performs a resignature process for the electronic document.

The storage unit 120 stores information necessary for electronic signature processing, and includes, for example, a message storage unit 121, a distribution destination storage unit 122, a signature key storage unit 123, and a resignature information storage unit 124.
The message storage unit 121 stores a message to which an electronic signature is attached and information indicating a guarantee period of the message. The distribution destination storage unit 122 stores position information of the verification apparatus 200 that distributes the generated electronic signature document. The key storage unit 123 stores a signature key (x) and a public key (p, q, g, y (y = g ^x )) used for electronic signature processing.

The resignature information storage unit 124 uses resignature information including a random number used for resignature and the first calculation result, and whether or not the resignature information is used for resignature processing. The flag is stored. The random number is random information generated for performing an electronic signature, and the first calculation result is a result of performing a power-residue calculation using the random number and the public key. For example, if the resignature use flag is ON, it indicates that it has been used for resignature, and if it is OFF, it indicates that it has not been used for resignature. FIG. 4 is a diagram illustrating a configuration of the resignature information storage unit 124. In FIG. 4, for example, the resignature use flag “ON” is stored in the resignature information of the random number “K ₁ ” and the first calculation result “r ₁ ”.

The communication unit 130 performs information communication with the verification device 200 via a network. The signature verification unit 140 verifies whether the electronic signature of the electronic signature document corresponds to the message. The random number generation unit 150 generates a random number. The input unit 170 receives an input from the signer and includes, for example, a guarantee period input unit 171 and a distribution destination input unit 172.
FIG. 3 is a block diagram showing a configuration of the verification apparatus 200 to which the electronic signature document is distributed. The verification apparatus 200 includes a communication unit 210, a storage unit 220, and a signature verification unit 230. The communication unit 210 performs information communication with the electronic signature device 100 via a network. The storage unit 220 stores information such as an electronic signature document. The signature verification unit 230 has the same function as the signature verification unit 140, and verifies the electronic signature document.

Next, an operation example of the resignature processing according to the present embodiment will be described with reference to FIG. 5, FIG. 6, and FIG.
The key storage unit 123 of the electronic signature device 100 stores in advance a signature key (secret key) (x) and a public key (p, q, g, y (y = g ^x )). Each key may be generated as the electronic signature device 100 has a key generation unit, or may be stored in advance, or the key generation unit is provided in an external device, so that the key is generated via a network. The key may be obtained by reading from an electronic medium in which the key is stored.

Further, the message storage unit 121 stores in advance a message that is a processing target of the electronic signature processing. The random number generation unit 150 generates a random number (k ₁ ) (step S101). Here, i takes the value of (i = 1,..., M), and m is the number of verifiers who distribute the electronic signature document. That is, in this embodiment, the signature assigning unit 111 generates an electronic signature document for each verifier (m people). Then, using the random number (k ₁ ), the public key (g), and the public key (p), the signature assigning unit 111 calculates the first calculation result (r _i ) according to the following equation (7) (Step 1) S102).

Here, the function F is a function having unidirectionality used in a normal electronic signature and a function having homomorphism. Homomorphism is similarity with respect to a specific mathematical structure. For example, without knowing the values of a certain value (m1) and a certain value (m2), only F (m1) and F (m2) are obtained. The property of the function F that can obtain an operation result such as F (m1 + m2), F (m1 × m2), etc. by applying some processing. For example, even if R ₁ = F (m1), R ₂ = (m2) and only R ₁ and R ₂ are given, and the values of m 1 and m ₂ are not clear, R ₁ × R ₂ The calculation result matches the calculation result of F (m1 + m2).

  For example, when a one-way function with trapdoors such as public key cryptography is used, it is necessary to decrypt m1 and m2 once in order to obtain the ciphertext of the calculation result of (m1, m2). There arises a problem that the decryption processing amount increases and the confidentiality is impaired. Here, by using a function having homomorphism, the ciphertext of (m1, m2) can be calculated only from the ciphertext of m1 and ciphertext of m2, and the information is kept secret efficiently. An operation result can be obtained.

In particular, the homomorphism of the function F used in this embodiment is characterized by the following properties. That is, the first random number (for example, k _i in the present embodiment), the second random number, the first public key (for example, g in the present embodiment), and the second public key (for example, the present embodiment). P) in the first public key and the power of the first random number as the exponent, the result of performing the power-residue operation with the second public key, and the first public key The result of performing the power-residue calculation with the second public key and the power of the second random number with the key as the base, and the result of performing the power-residue operation with the second public key as the base between the first random number and the second random number The result of performing the power-residue operation with the second public key on the power that uses the sum as the exponent is a property that matches the result of multiplying the first power-residue operation result and the second power-residue operation result .

In the present embodiment example, the first power residue calculation result and the second power residue calculation result when the electronic signature is performed are stored, and these values are used at the time of re-signing, so that the power residue is obtained. A new power residue calculation result is obtained by calculating the product of the stored first power residue calculation result and the second power residue calculation result without newly performing the calculation process.
Next, the second calculation result (t _i ) is calculated by the following equation (8) using the first calculation result (r _i ) and the hash function (h ₁ ) (step S103).

Then, a combination of the first calculation result (r _i ) and the second calculation result (t _i ) is taken as an electronic signature (σ _i (σ _i = (r _i , t _i ))).
The user inputs the guarantee period to the guarantee period input unit 171 that receives the guarantee period input for the electronic signature. The guarantee period input unit 171 stores the guarantee period in the message storage unit 121 in association with the message. Here, the guarantee period is the number of guarantee days input, but it may be a guarantee expiration date or the like as long as it represents the period. The re-signature information registration unit 160 performs a guarantee period determination process whether or not the input guarantee period is shorter than a predetermined period (step S104). If it is determined that the guarantee period is short, the resignature information registration unit 160 stores the random number (k ₁ ) and the first calculation result (r _i ) in the resignature information storage unit 124 as resignature information. (Step S105).

In other words, re-signature information registering unit 160, an electronic signature of the random number warranty has used the electronic signature processing of short duration (k ₁₎ and the first calculation result (r _i) and the for preferentially resignaturing The information is stored in the information storage unit 124. This is because if the guarantee period is short, the probability of performing re-signature processing by compromising the cryptographic function can be considered low, and a digital signature with a long guarantee period also has a long attack time. It is desirable to use the random number (k ₁ ) and the first calculation result (r _i ) used for the electronic signature processing with a short guarantee period.

As described above, the resignature information storage unit 124 is configured to preferentially store the resignature information with a short guarantee period, so that the digital signature by the resignature process can be more secure. It can be. Note that the resignature information registration unit 160 does not perform such a guarantee period determination process, and uses all the random numbers (k ₁ ) and the first calculation result (r _i ) as resignature information. The information may be stored in the information storage unit 124. When the resignature information is stored in the resignature information storage unit 124 in step S105, the reuse flag is stored as OFF.

Then, the user inputs distribution destination information to the distribution destination input unit 172. The distribution destination information is information for specifying the distribution destination of the generated electronic signature document, and is, for example, an e-mail address. Then, the signature processing unit 110 generates identification information corresponding to the generated electronic signature (σ _i ), and stores it in the distribution destination storage unit 122 in association with the input distribution destination information (step S106).

The signature processing unit 110 then transmits an electronic signature document (M, σ _i ) that is information of the message (M) and the electronic signature (σ _i ) generated corresponding to the message (M) via the communication unit 130. ) Is transmitted to the verification apparatus 200 based on the distribution destination information. (Step S107).
When the communication unit 210 of the verification apparatus 200 receives the electronic signature document (M, σ _i ), the signature verification unit 230 performs verification processing of the electronic signature document (step S108). The verification process can be performed by the following equation (9) using the public key (g), the public key (y), the public key (p), and the hash function (h ₁ ).

Next, the resignature processing when the hash function (h ₁ ) is compromised will be described. When the compromise occurs, the communication unit 130 transmits the compromise notification information to the verification device 200 that is the distribution destination of the electronic signature that has been subjected to the electronic signature processing using the compromised hash function (step S201). The compromise notification information may include information such as a signer name, a resignature implementation period, and an electronic signature document that needs to be resigned.

Upon receiving the compromise notification information, the verification device 200 reads out the electronic signature document (M, σ _i ) generated using the notified compromised hash function from the storage unit 220 and transmits the electronic signature document to the electronic signature device 100. (Step S202).
When the electronic signature device 100 receives the electronic signature document (M, σ _i ) to be resigned, the signature verification unit 140 performs verification processing of the electronic signature document according to the above equation (9) (step S203).

If the left side and the right side of the above formula (9) match, the resignature giving unit 112 uses the resignature information for which the reuse flag is OFF in the resignature information stored in the resignature information storage unit 124. Information is read (step S204, step S206). At this time, the resignature information read out by the resignature giving unit 112 in step S206 is a plurality of resignature information other than the resignature information used for the electronic signature document (M, σ _i ) to be resigned. Read information randomly. Here, there are at least two pieces of resignature information to be read out, and the greater the number, the stronger the collusion attack and the higher the security. At this time, the resignature adding unit 112 sets the resignature use flag corresponding to the read resignature information to the ON state and stores it in the resignature information storage unit 124 (step S205).
Then, the resignature assigning unit 112 performs a random number combination process included in the resignature information according to the following equation (10) (step S207).

Here, S _i is a subset of the re-signature information stored in the re-signature information storage unit 124, and k _{i_subset} is a plurality of re-signatures selected at random from the re-signature information storage unit 124. Indicates that the information contains random numbers.
In FIG. 8, when an electronic signature is distributed to three verifiers (verifier A, verifier B, and verifier C), and resignature processing is performed for one verifier (verifier A). Specific examples of each formula are shown. In the example of FIG. 8, random numbers k ₁ , k ₂ , and k ₃ are generated for the verifier A, verifier B, and verifier C, respectively. Equation (10), in the example of FIG. 8 _can be calculated as _{k resign = k 2 + k 3} .
Then, the re-signature giving unit 112 calculates combination information (r ′ _j ) by the following equation (11).

That is, in the case shown in FIG. 8, the result of r ₂ × r ₃ matches F (g ^{k2 + k3} ) due to homomorphism, and therefore r ₂ × r ₃ may be calculated.
Here, since the function F having homomorphism is used for the first calculation result calculated by Expression (7), a result obtained by multiplying the plurality of first calculation results is represented by a plurality of random numbers (ki ^). public key (g) for) to the base random number (k _i) as the base, it is possible to match the result obtained by multiplying the remainder operation result of the exponent. That is, the resignature giving unit 112 multiplies a plurality of first calculation results using functions having homomorphism, so that the power residue calculation is performed without performing a new power residue calculation at the time of resignature. An operation result similar to that performed can be generated.
Then, the re-signature giving unit 112 calculates the second calculation result (t _j ) using the combination information (r ′ _j ) according to the following equation (12) (step S208).

For example, in the example illustrated in FIG. 8, the second calculation result (t _design ) is calculated using the following equation (13).

Then, the signature processing unit 110, re-signature generated by the _{(σ'j = (r'j,} t'j)) is granted electronic signature document (M, _σ'j) a, the verification apparatus 200 Transmit (step S209). The verification device 200, an electronic signature document (M, _σ'j) receives and performs verification processing of the electronic signature document (M, _σ'j) by the following equation (14) (step S210).

  As described above, the present invention uses a one-way function having homomorphism in order to solve the problem of deterioration in signature security that occurs when a hash function is compromised. The remainder calculation result is stored, and if re-signing is necessary, the re-signing is performed more efficiently by re-signing using the stored combination of the random number / power residue calculation result.

  Note that a program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and re-signed by executing it. May be. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a figure which shows the operation example of the re-signature by one Embodiment of this invention. It is a block diagram which shows the structure of the electronic signature apparatus by one Embodiment of this invention. It is a block diagram which shows the structure of the verification apparatus by one Embodiment of this invention. It is a figure which shows the structure of the information storage part 124 for re-signings by one Embodiment of this invention. It is a sequence diagram which shows the operation example of the re-signature by one Embodiment of this invention. It is a sequence diagram which shows the operation example of the re-signature by one Embodiment of this invention. It is a figure which shows the calculation formula by one Embodiment of this invention. It is a figure which shows the calculation formula by one Embodiment of this invention. It is a figure which shows the operation example of the re-signature by a prior art. It is a figure which shows the calculation formula of the re-signature by a prior art.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Electronic signature apparatus 110 Signature processing part 111 Signature provision part 112 Resignature provision part 120 Storage part 121 Message storage part 122 Destination storage part 123 Key storage part 124 Resignature information storage part 130 Communication part 140 Signature verification part 150 Random number generation Unit 160 re-signing information registration unit 170 input unit 171 warranty period input unit 172 distribution destination input unit 200 verification device 210 communication unit 220 storage unit 230 signature verification unit

Claims (5)

An electronic signature device that has a signature key corresponding to a public key and assigns an electronic signature to each of a plurality of electronic documents using the signature key,
First calculation means for calculating a first calculation result obtained by calculating a result of performing a power-residue calculation of a random number by a one-way function having homomorphism;
The second calculation result is calculated using the first calculation result, the electronic document to be signed, the signature key, and the first hash function, and the first calculation result and the second calculation are calculated. A signing means for generating the result as an electronic signature;
Storage means for associating and storing the random number and the first calculation result as resignature information;
When performing re-signature processing on the electronic document, a plurality of re-signature information is read from the storage unit, first combination information based on a plurality of random numbers included in the read re-signature information is calculated and read First recalculation means for calculating second combination information based on a plurality of first calculation results included in the resignature information;
A second recalculation result is calculated based on the calculation result using the second combination information, the electronic document, the signature key, and the second hash function, and the first combination information. Re-signing means for generating the re-computation result and the second re-computation result as a re-digital signature;
An electronic signature device comprising: The digital signature further comprises a re-signature information registration means for storing the re-signature information in the storage means when the guarantee period of the inputted electronic signature is shorter than a predetermined period. Item 2. The electronic signature device according to Item 1. The storage means stores a resignature use flag that is information indicating whether or not the resignature process is used in association with the resignature information;
The resignature means reads out the resignature information indicating that the resignature use flag is not used from the storage means as the second resignature information, and the read out second resignature The electronic signature device according to claim 1, further comprising: storing a re-signature use flag corresponding to the use information in a state indicating use, in the storage unit. An electronic signature method for giving an electronic signature to each of a plurality of electronic documents using a signature key corresponding to a public key,
A first calculating means calculating a first calculation result obtained by calculating a result obtained by performing a power-residue calculation of a random number by a one-way function having homomorphism;
The signing means calculates a second calculation result using the first calculation result, the electronic document to be signed, the signature key, and the first hash function, and the first calculation result and the Generating a second calculation result as an electronic signature;
A storage unit associating and storing the random number and the first calculation result as resignature information;
When performing re-signature processing on the electronic document, the first re-calculation unit reads a plurality of re-signature information from the storage unit, and the first recalculation unit is based on a plurality of random numbers included in the read re-signature information. Calculating combination information and calculating second combination information based on a plurality of first calculation results included in the read resignature information;
The re-signature means calculates a second recalculation result based on the calculation result using the second combination information, the electronic document, the signature key, and the second hash function, and the first combination information. And generating the first recalculation result and the second recalculation result as a re-digital signature;
An electronic signature method comprising: A computer that assigns an electronic signature to each of a plurality of electronic documents using a signature key corresponding to the public key,
A first calculating means calculating a first calculation result obtained by calculating a result obtained by performing a power-residue calculation of a random number by a one-way function having homomorphism;
The signing means calculates a second calculation result using the first calculation result, the electronic document to be signed, the signature key, and the first hash function, and the first calculation result and the first calculation result are calculated. Generating a calculation result of 2 as an electronic signature;
A storage unit associating and storing the random number and the first calculation result as resignature information;
When performing re-signature processing on the electronic document, the first re-calculation unit reads a plurality of re-signature information from the storage unit, and the first recalculation unit is based on a plurality of random numbers included in the read re-signature information. Calculating combination information and calculating second combination information based on a plurality of first calculation results included in the read resignature information;
The re-signature means calculates a second recalculation result based on the calculation result using the second combination information, the electronic document, the signature key, and the second hash function, and the first combination information. And generating the first recalculation result and the second recalculation result as a re-digital signature;
An electronic signature program for running

Images