JP5438697B2 - Commitment system, commitment generation device, commitment reception device, method and program thereof - Google Patents

Description

  The present invention relates to a commitment generation device that commits confidential information and generates commitment information, a commitment reception device that receives commitment information, a commitment system that includes a commitment device and a commitment reception device, a method, and a program thereof.

  A cryptographic commitment is an electronic “sealing hand”. The commitment is divided into a sender and a receiver. The sender “commits” the information m while keeping it secret from the receiver. The entrusted information m will be disclosed later, but cannot be changed from the value m determined at the time of entrusting. This property is referred to as “hiding” and “binding”. For example, using commitment, you can do electronic janken and coin throwing (of course, you can also use a shogi or a spear sealer).

  Since commitment is the most basic cryptographic primitive, it is frequently used in many cryptographic protocols. In recent years, in order to bring a cryptographic protocol closer to a real environment, security when used in a complex combination is also required. In such a complex combination, the commitment defined by the classical safety model cannot satisfy confidentiality and restraint.

  A robust commitment scheme is needed to use in complex combinations. A certain commitment method is non-malleable when confidentiality and restraint are satisfied no matter how the commitment method is executed at the same time.

  Some general-purpose combined commitments have a greater level of security than robust commitment schemes. General connectivity is not limited to commitment, but can be defined on many cryptosystems. If the encryption method is a general-purpose combination, even if it is executed in combination with other general-purpose combination encryption methods, safety that is satisfied independently of each other is ensured. That is, the encryption method that is general-purpose combination becomes a general-purpose combination encryption method when combined with any general-purpose combination encryption method (see Non-Patent Documents 1 and 2).

  Some commitment schemes require common reference string (crs) that is accessible to both sender and receiver (created correctly by a third party that is neither the sender nor the receiver) There are also things. Due to technical issues, this common information can be divided into cases where it must be disposable for each commitment and cases where the same common information can be used without being disposable. However, the commitment method that can always use common information is more practical.

  Furthermore, if the trap-door commitment method knows the trap-door, the commitment information can be opened with secret information different from the point of commit. Thus, in a commitment scheme with a trapdoor, the trapdoor is secret to the sender.

  There is also a non-malleable trap-door com-mitment method that is a commitment with trapdoors. The robustness of commitment with trapdoors is defined by the name non-malleability with respect to opening (see Non-Patent Documents 3, 4, 5, 6, and 7).

  Furthermore, there is a commitment system with trapdoors that satisfies the definition of simulation-sound (see Non-Patent Documents 4 and 6). A simulation-sound commitment with trap doors (hereinafter referred to as “SSTC”) is a non-malleability with respect to open commitment scheme, that is, a robust trap door commitment. Simulation-sound trapdoor commitment can greatly increase the security of a standard authentication protocol called Σ-Protocol (see Non-Patent Document 8). You can configure combinable commitments.

R. Canetti, "Universally composable security: A new paradigm for cryptographic protocols", In Proceedings of the 42th IEEE Annual Symposium on Foundations of Computer Science (FOCS'01), Oct 2001, p.136-145 Ran Canetti, "Universally composable security: A new paradigm for cryptograpic protocols", Technical report, Cryptology ePrint Archive, Report 2000/067, 2005, Preliminary version appeared in FOCS'01 Ivan Damgard and Jens Groth, "Non-interactive and reusable non-malleable commitment schemes", In STOC03, 2003, p.426-437 J. Groth, "Honest verifier Zero-Knowledge Arguments Applied", PhD thesis, Basic Resarch in Computer Science, University of Aarhus, 2004 J. A. Garay, P. Mackenzie, and K. Yang, "Strengthening zero-knowledge protocols using signatures", In Advances in Cryptology-EUROCRYPT 2003, Springer-Verlag, 2003, volume 2656 of Lecture Notes in Computer Science, p.177-194 PD MacKenzie and K. Yang, "On simulation-sound trapdoor commitments", In C. Cachin and J. Camenisch, editors, Advances in Cryptology-EUROCRYPT 2004, Springer-Verlag, 2004, volume 3027 of Lecture Notes in Computer Science, p .382-400 R. Gennaro, "Multi-trapdoor commitments and their applications to proofs of knowledge secure under concurrent man-in-the-middle attacks", In Advances in Cryptology-CRYPTO'04, 2004, volume 3152 of Lecture Notes in Computer Science, p .220-236 R. Cramer, I. Damgard, and B. Schoenmakers, "Proofs of partial knowledge and simplied design of witness hiding protocols", In YG Desmedt, editor, Advances in Cryptology-CRYPTO'94, Springer-Verlag, 1994, volume 839 of Lecture Notes in Computer Science, p.174-187 I. Damgard and J. Nielsen, "Perfect hiding and perfect binding universally composable commitment schemes with constant expansion factor", In Advances in Cryptology-CRYPTO2002, 2002, p.581-596

  However, the prior arts described in Non-Patent Documents 3, 4, 5, 6, and 7 constitute a simulation-sound trapdoor commitment (SSTC) based on a common conversion method from a non-disposable signature. Therefore, when the conventional signature is broken, the commitment scheme of the prior art may be broken at the same time.

  An object of the present invention is to provide a new SSTC-type commitment system, commitment generation apparatus, commitment reception apparatus, method and program thereof using a publicly verifiable tag-based key encapsulation mechanism.

In order to solve the above problem, according to a first aspect of the present invention, a commitment system includes a commitment generation device and a commitment reception device. A tag-based key encapsulation mechanism that can be publicly verified is Π = (Gen, Enc, Dec), a public key generated using the key generation algorithm Gen is pk, and both the commitment generation device and the commitment reception device know The tag information is tag, r is a random number, the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc is C, the first key is K, and the relationship R defined by Π ^priv _{pk, tag}

And The commitment receiving device gives the public key pk and tag information tag to the encryption algorithm Enc, generates a pair (C, K) of the first ciphertext C and the first key K, and generates a commitment for the first ciphertext C Send to device. A part of the evidence when opening the commit is z, the confidential information to be committed is m, the commitment generation device receives the first ciphertext C, and uses the public key pk and the tag information tag to generate the first ciphertext. C verifies whether the true ciphertext, if it is true ciphertext calculating a relation R ^priv _pk, for Σ- protocol _{tag (a, z) ← simΣ} (C, m) The commitment information a is transmitted to the commitment receiving device. The commitment receiving apparatus receives the commitment information a, stores (tag, C, a), receives (tag, m, z), and receives Σ _vrfy (C for the Σ-protocol of the relation R ^priv _{pk, tag.} , A, m, z), it is determined whether the confidential information m has been changed.

In order to solve the above problems, according to the second aspect of the present invention, the commitment generation device commits the confidential information m and generates the commitment information a. Commit that receives the commitment generation device and the commitment information a, where タ グ = (Gen, Enc, Dec) is a publicly verifiable tag-based key encapsulation mechanism, pk is a public key generated using the key generation algorithm Gen Tag information that the receiving device knows together is tag, r is a random number, the first ciphertext obtained by giving the public key pk and tag information tag to the encryption algorithm Enc is C, and the first key is K And the relationship R ^priv _{pk, tag} defined by Π

Let z be part of the evidence when opening the commit. When the first ciphertext C is received, the public key pk and the tag information tag are used to verify whether or not the received first ciphertext C is a true ciphertext. the relationship _{^{R priv pk, (a, z}} ) for the Σ- protocol _tag ← _simΣ a (C, m) are calculated, and transmits the commitment information a commitment receiver.

In order to solve the above problem, according to the third aspect of the present invention, the commitment receiving device receives the commitment information a. The tag-based key encapsulation mechanism that can be publicly verified is Π = (Gen, Enc, Dec), the public key generated using the key generation algorithm Gen is pk, the confidential information m is committed, and the commitment information a is generated. Tag information known by both the commitment generating device and the commitment receiving device is tag, r is a random number, and the public key pk and tag information tag are given to the encryption algorithm Enc as the first ciphertext C And the first key is K, and the relationship R ^priv _{pk, tag} defined by Π

And A public key pk and tag information tag are given to the encryption algorithm Enc, a pair (C, K) of the first ciphertext C and the first key K is generated, and the first ciphertext C is transmitted to the commitment receiving device. , A part of the evidence when opening the commit is z, the commitment information a is received from the commitment generation device, (tag, C, a) is stored, and (tag, m, z) is received. Using Σ _vrfy (C, a, m, z) for the Σ-protocol, it is determined whether the confidential information m has been changed.

In order to solve the above problem, according to a fourth aspect of the present invention, a commitment method uses a commitment generation device and a commitment reception device. A tag-based key encapsulation mechanism that can be publicly verified is Π = (Gen, Enc, Dec), a public key generated using the key generation algorithm Gen is pk, and both the commitment generation device and the commitment reception device know The tag information is tag, r is a random number, the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc is C, the first key is K, and the relationship R defined by Π ^priv _{pk, tag}

And In the commitment receiver, the public key pk and the tag information tag are given to the encryption algorithm Enc, a pair (C, K) of the first ciphertext C and the first key K is generated, and the first ciphertext C is committed. Send to the generator. A part of the evidence when opening the commit is z, the confidential information to be committed is m, the commitment generation device receives the first ciphertext C, and the commitment generation device uses the public key pk and the tag information tag. Then, it is verified whether or not the first ciphertext C is a true ciphertext. If it is a true ciphertext, (a, z) ← simΣ () for the Σ-protocol of the relation R ^priv _{pk, tag} C, m) is calculated, and commitment information a is transmitted to the commitment receiver. In the commitment receiver, when the commitment information a is received, (tag, C, a) is stored, and (tag, m, z) is received, the relationship R ^priv _{pk, tag} with respect to the Σ-protocol Σ _vrfy ( C, a, m, z) is used to determine whether the confidential information m has been changed.

  Since the present invention constructs a new SSTC method using a tag-based key encapsulation mechanism that can be publicly verified without relying only on the conventional signature, it is safe even when the conventional signature is broken. Play.

The figure which shows the structural example of the commitment system. The figure which shows the processing flow of the commitment system. The block diagram which shows the function structural example of the third party apparatus 11. FIG. The figure which shows the processing flow of the third party apparatus 11. FIG. 3 is a block diagram showing an example of a functional configuration of a commitment receiving device 15. The figure which shows the processing flow of the commitment receiver 15. FIG. 3 is a block diagram showing a functional configuration example of a commitment generation device 13. The figure which shows the processing flow of the commitment production | generation apparatus 13. FIG.

  Hereinafter, embodiments of the present invention will be described.

<Definition>
First, terms and symbols used in this embodiment are defined.

{0,1} ^k means a set of binary sequences (data) having a k-bit length, and {0,1} ^* is all binary sequences, that is, {0,1} ^* = ∪ _{k ≧ 0} {0 , 1} ^k .
The probabilistic algorithm M is a two-input function of an input xε {0; 1} ^* and an internal random number r of M.
y = M (x; r) means that the output at the time of input x and random number r is y.
y ← M (x) represents a probabilistic trial at the input x of M. For example, Pr [y ← M (x): y = 1] <1/2 means that the probability that the random variable y output according to the random number r is 1 is less than 1/2.

  A time-series sequence of probabilistic trials such as “A (X) trial followed by B (Y) trial, and further ...” is expressed as a ← A (X); b ← B (Y); Write like this.

  Pr [a ← A; b ← B: event] represents the conditional occurrence probability of the event event under the probabilistic trial a ← A; b ← B. In order to shorten the description, Pr [M (x) = 1] may be written instead of Pr [y ← M (x): y = 1].

  Note that a deterministic algorithm may be considered as a stochastic algorithm without internal coins.

[Tag-based Key Encapsulation Mechanisim (Tag-KEM)]
That Π = (Gen, Enc, Dec) is Tag-KEM (see References 1 and 2) means that Π is a set of algorithms satisfying properties 1 to 4 as follows.
(Reference 1): V. Shoup, "A proposal for an ISO standard for public key encryption", Technical report, December 2001, Cryptology ePrint Archive, Report 2001/112
(Reference 2): M. Abe, R. Gennaro, and K. Kurosawa, "Tag-KEM / DEM: A new framework for hybrid encryption", Journal of Cryptology, 2008, Volume 21, Number 1, p.97- 130

(Property 1) (pk, sk) ← Gen (1 ⁿ ): The key generation algorithm Gen is a stochastic algorithm that takes a security parameter n as an input and outputs a public key / private key pair (pk, sk).
(Property 2) (C, K) <-Enc (pk, tag). The encryption algorithm Enc is a stochastic algorithm that receives the public key pk and tag information tagε {0; 1} ^* , generates a random number rεG _r internally, and calculates and outputs a ciphertext C and a key K. .
(Property 3) The decryption algorithm Dec is a deterministic algorithm that takes a secret key sk, tag information tag, and ciphertext C as inputs and calculates a key K = Dec (sk, tag, C).
(Property 4) For all n∈N and all tag∈ {0,1} ^* ,
Pr [(pk, sk) ← Gen (1 ⁿ ); (C, K) ← Enc (pk, tag): Dec (sk, tag, C) = K] = 1
It is.

[NP relationship between ciphertext and key and public verification possibility]
Define the following NP relationship for Tag-KEM Π.

Whether the ciphertext Cε {0; 1} ^* is a true ciphertext in which the corresponding key K exists (that is, a certain K exists (C, K) εR ^priv _{pk, tag} ) Tag-KEM V is said to be “publicly verifiable” when it can be verified only with keys pk and tag.

[Σ-Protocol]
Let R = {(x, w)} be an NP relationship. Let the language defined from the relation R be L _R (: = {x | ∃ w st (x, w) εR}). However, “A: = B” means “define B as the meaning of the symbol A”. The Σ-protocol of relation R (see Non-Patent Document 8) is an authentication protocol such as the following of three communications consisting of a prover and a verifier. Note that (x, w) εR. With x as the common input to the prover and verifier, the prover is further given w.
(1) prover, select the random number _{r a,} the first message _{a = Σ com (x, w} ; r a) is calculated, and send to the verifier.
(2) The verifier selects the random number c ← _R Σ _ch of the second message and sends it back to the prover. However, A ← _R B means that A is randomly selected from the set B. Note that _Σch is an algorithm for generating or selecting a challenge c (for example, a random number).
(3) The prover third message _{z = Σ ans (x, w} , r a, c) , and delivers it to the verifier. The third message z is a prover's response to the challenge c and is generated using a response generation algorithm Σ _ans .

The verifier calculates and outputs b = Σ _vrfy (x, a, c, z). Σ _vrfy is a verification algorithm. If b = 1, it means that the verifier has accepted a series of authentication actions of the prover, and if it is any other value, it means that it has been rejected. . And the response z first message a is, the prover knows the w, as long as each generated using a first message generation algorithm sigma _com and response generation algorithm sigma _ans, a b = 1. The Σ-protocol satisfies the following properties:
[Completeness] ∀r _a , ∀c∈Σ _ch [Σ _vrfy (x, Σ _com (x, w; r _a ), c, Σ _ans (x, w, r _a, c)) = 1]
[Special health]

That is, when x is not included in the language _LR as a source, c such that z exists is uniquely determined with respect to a. Furthermore, when c ≠ c ′, w satisfying (x, w) ∈R can be always calculated from the two accepted histories (a, c, z) and (a, c ′, z ′).

[Special Zero Knowledge for Honest Verifier] For ∀x∈L _R and ∀c∈Σ _ch , it is possible to create (a, c, z) ← simΣ (x, c) that is accepted by the verifier. . In addition, randomly selected c from Σ _ch, was made to enter the simΣ, consisting of (a, c, z) is, in the history and the same distribution honest prover has performed with the honest verifier.

It is already known that there is always a Σ-protocol for any NP relationship (see Reference 3).
(Reference 3): O. Goldreich, S. Micali, and A. Wigderson, "Proofs that yield nothing but their validity or all languages in np have zero-knowledge proof systems", Journal of the ACM, 1991, 1 (38 ), p.691-729

<First embodiment>
<Commitment system 1>
The processing outline of the commitment system 1 according to the first embodiment will be described with reference to FIGS. 1 and 2. The commitment system 1 includes a third party device 11, a commitment generation device 13, and a commitment reception device 15, and these devices can communicate with each other via a communication network 12, which is the Internet, for example.

Let Π = (Gen, Enc, Dec) be a tag-based key encapsulation mechanism that can be publicly verified. The relationship R ^priv _{pk, tag} is defined by Π. The relationship R ^priv _{pk, tag} is an NP relationship,

And The commitment system 1 is constructed from the Σ-protocol for Π and the relationship R ^priv _{pk, tag} .

  The third-party device 11 receives the security parameter n (s1), and generates a secret key sk and a public key pk using the key generation algorithm Gen (s2). This public key pk is used as common reference data. The third party device 11 stores the common reference data crs in a state where at least the commitment generation device 13 and the commitment reception device 15 can use the common reference data crs.

  The commitment generation device 13 and the commitment reception device 15 acquire tag information tag (s3). The tag information is information that both the commitment generation device 13 and the commitment reception device 15 know, such as a process session ID. The tag information may be acquired by both the commitment generation device 13 and the commitment reception device 15 before generating a pair (C, K) of the first ciphertext C and the first key K described later. An acquisition method may be used.

  Further, the commitment receiving device 15 acquires common reference data crs (s4). The commitment receiver 15 generates a pair (C, K) of the first ciphertext C and the first key K using the common reference data crs and the tag information tag for the encryption algorithm Enc (s5). The ciphertext C is transmitted to the commitment generation device 13 (s6).

  The commitment generation device 13 receives the secret information m to be committed (s7). Further, the commitment generation device 13 receives the first ciphertext C (s8). Further, the commitment generation device 13 acquires common reference data crs (s9).

The commitment generation device 13 verifies whether or not the first ciphertext C is a true ciphertext using the common reference data crs and the tag information tag (s10). If it is a true ciphertext, the commitment generation device 13 calculates (a, z) ← sim Σ (C, m) for the Σ-protocol of the relationship R ^priv _{pk, tag} (s11), and the commitment information a It transmits to the commitment receiver 15 (s12). Note that sym Σ for the Σ-protocol of the relationship R ^priv _{pk, tag} generates the first message a (commitment information a in the present embodiment) without knowing the secret w in the Σ-protocol described above, Fig. 4 is an algorithm for generating part z) of evidence when opening a commit in an embodiment.

  The commitment receiving device 15 receives the commitment information a (s13) and stores (tag, C, a) (s14).

  The commitment opening device 16 receives (crs, tag, C, m, a, z) from the commitment generation device 13 or the like (s15) and stores it safely. Then, when it is time to disclose the information m, (tag, m, z) is transmitted to the commitment receiver 15 (s16). The commitment generation device 13 and the commitment opening device 16 can communicate safely. Further, the commitment opening device 16 may not be provided, and (tag, m, z) may be directly transmitted from the commitment generation device 13 to the commitment reception device 15.

When the commitment receiving device 15 receives (tag, m, z) (s17), it uses the Σ _vrfy (C, a, m, z) for the Σ-protocol, and the confidential information m from the time when the commitment information a is received. It is determined whether or not has been changed (s18). Although verification algorithm sigma _vrfy In the foregoing Σ- protocols to verify whether the prover knows the w, sigma _vrfy for Σ- protocol in this embodiment commitment information a secret information from the time of receiving the m It is determined whether has been changed. In other words, sigma _vrfy for Σ- protocol in this embodiment is an algorithm part z to verify correct or not evidence when opening the commitment information a and commitment to confidential information m.

  Details will be described below. First, in the first embodiment, for example, the following Tag-KEM Π = (Gen, Enc, Dec) can be used.

<Tag-KEM Π>
The G and G _T and Abelian group of prime order q. e: a non-degenerate bilinear mapping G × G → G _T. Let g be a generator of G. Let Z / qZ be a set of integers greater than or equal to 0 and less than q. From the bilinearity, e (x ^a , y ^b ) = e (x, y) ^ab holds for x, yεG, a, bεZ / qZ. Than non-degenerative, e (g, g) is a generator of _{G T.} H: {0, 1} ^* → A hash function of Z / qZ. Let otΣ = (otKGen, otSign, OtVrfy) be an arbitrary disposable signature (see Reference 4).
(Reference 4): Leslie Lamport, "Constructing digital signatures from one-way functions", Technical Report SRI-CSL-98, SRI International Computer Science Laboratory, October 1979
Gen (1 ⁿ ): x, y ← _R Z / qZ; X: = g ^x ; Y: = g ^y ; pk = (g, X, Y, H), sk = (pk, x, y) , (Pk, sk) are output.
· Enc (pk, tag) :( otvk, otsk) ← otKGen (1 k); σ ← otSign (otsk, tag); r ← Z / qZ; t: = H (otvk, g r); C: = ( σ, otvk, g ^r , (X ^t Y) ^r ); K: = X ^r ; (C, K) is output.
Dec (sk, tag, C): C = (σ, otvk, u, τ) is decomposed into σ, otvk, u, τ, and if otVrfy (otvk, tag, σ) ≠ 1, decoding is stopped In other cases, t: = H (otvk, u) is calculated. If u ^{xt + y} ≠ τ, the decoding is stopped, and otherwise K: = u ^x ; K is output.

  In the first embodiment, for example, the following disposable signature otΣ (otKGen, otSign, otVrfy) can be used.

<Disposable signature otΣ>
Let G _{2 be} an abelian group of prime order q ₂ . H ₂ : {0, 1} ^* → Z / q ₂ Z hash function. q ₂ , G ₂ , and H ₂ may be the same as or different from q, G, and H used in Tag-KEM. In the following, the subscripts s1, s2, w1, w2, z1, z2, and H2 mean s ₁ , s ₂ , w ₁ , w ₂ , z ₁ , z ₂ , and H ₂ .
_{^{· OtKGen (1 k): g}} 1, g 2 ← R G 2; s 1, s 2, w 1, w 2 ← R Z / q 2 Z; b: = g 1 w1 g 2 w2; h: = g ^{_{1 s1 g 2 s2; otvk:}} = (g 1, g 2, h, b); otsk: = (otvk, s 1, s 2, w 1, w 2); (otvk, otsk) outputs a.
OtSign (otsk, m): c: = H (otvk, m); z ₁ : = w ₁ + c · s ₁ mod q ₂ ; z ₂ : = w ₂ + c · s ₂ mod q ₂ ; σ: = ( z ₁ , z ₂ ) are output.
OtVrfy (otvk, m, σ): 1 is output only when g ₁ ^z1 g ₂ ^z2 = bh ^{H2 (otvk, m)} .

<Generation and Acquisition of Common Reference Data crs>
Generation of the common reference data crs will be described with reference to FIGS. 3 and 4. The third-party device 11 acquires the security parameter n via the input unit 111 (s111), and the key generation unit 112 generates (sk, pk) using the Tag-KEM key generation algorithm Gen (1 ⁿ ). (S112). For example, x and y are selected at random from Z / qZ, X = g ^x and Y = g ^y are obtained, and a set of g, X, Y, and H is generated as a public key pk. This public key pk is used as common reference data crs. A pair of pk, x, and y is generated as a secret key. The common reference data crs is stored in the storage unit 114 in a state where at least the commitment generation device 13 and the commitment reception device 15 can use the common reference data crs. Further, the third party device 11 may store the secret key sk safely in the storage unit 114 or discard it (s113). The third party device 11 performs the above processing under the control of the control unit 115. In the present embodiment, one common reference data crs is repeatedly used.

  The commitment receiving device 15 requests the third party device 11 to transmit the public key pk via the output unit 156 under the control of the control unit 155 (FIG. 5). The control unit 115 of the third party device 11 receives the request via the input unit 111, extracts the public key pk from the storage unit 114, and transmits it to the commitment reception device 15 via the output unit 116. The commitment receiving device 15 receives the public key pk via the input unit 151 and stores it in the storage unit 154 (FIG. 6, s151). Similarly, under the control of the control unit 135 (FIG. 7), the commitment generation device 13 requests the public key pk through the output unit 136, receives the public key pk through the input unit 131, and stores it in the storage unit 134. Store (FIG. 8, s131).

<Generation of first ciphertext C and first key K>
The commitment receiving device 15 acquires the security parameter k via the input unit 151 (FIG. 6, s152). The commitment receiver 15 executes the Tag-KEM Π encryption algorithm Enc in the encryption unit 152 (FIG. 5) to generate a pair (C, K) of the first ciphertext C and the first key K. (S153).

The signature key verification key generation unit 152a in the encryption unit 152 generates a signature key otsk and a verification key otvk by using the security parameter k and the key generation algorithm otKGen. For example, signing key verification key generation unit 152a selects _g 1, _{g 2} from _{G 2} randomly, randomly selects _{s 1, s 2, w 1} , w 2 from the Z / _{q 2} Z. In _addition, ask for ^{b = g} 1 _w1 g ^{2 w2} and ^{_{h = g 1 s1 g 2 s2}} , a set of the _{g 1} and _{g 2} and h and b as a verification key otvk, and verification key otvk and _{s 1} and _{s 2} A set of w ₁ and w ₂ is obtained as a signature key otsk. If the hash functions H and H ₂ are different, the verification key otvk is configured to include the hash function H ₂ .

The signature generation unit 152b in the encryption unit 152 generates an electronic signature σ by using the signature algorithm otSign using the tag information tag and the generated signature key otsk. For example, the verification key otvk tag information tag as input of a hash function _{H 2,} obtaining or c. Further, (z ₁ = w ₁ + c · s ₁ mod q ₂ ) and (z ₂ = w ₂ + c · s ₂ mod q ₂ ) are obtained, and a set of z ₁ and z ₂ is set as an electronic signature σ.

The first key first ciphertext generation unit 152c in the encryption unit 152 uses the public parameter pk (= g, X, Y, H) and the verification key otvk to encrypt the first ciphertext C using the encryption algorithm Enc. And the first key K is generated. For example, select r at random from Z / qZ, obtaining the K = ^{X r.} Further, g ^r is obtained, and t is obtained using the verification keys otvk and g ^r as the input of the hash function H. ^(X t ^Y) computes the ^r, the set of the electronic signature σ and verification key otvk and ^{g r} and ^(X t ^{Y) r} and the first ciphertext C.

  The commitment receiver 15 associates the first ciphertext C with the tag information tag and stores it in the storage unit 154, and further transmits the first ciphertext C to the commitment generation device 13 via the output unit 156 (s154). The commitment receiving device 15 may store the signature key otsk in the storage unit 154 safely or discard it.

<Verification of first ciphertext C>
The commitment generation device 13 receives the first ciphertext C = (σ, otvk, u, τ) via the input unit 131 (FIG. 7) (s132).

The ciphertext verification unit 132 first verifies whether or not the electronic signature σ is valid by using otVrfy (otvk, tag, σ) using the electronic signature σ, the verification key otvk, and the tag information tag (s133). For example, g ₁ ^z1 g ₂ ^z2 is obtained using the electronic signature σ = (z ₁ , z ₂ ) and otvk = (g ₁ , g ₂ , h, b). Further, the verification key otvk and the tag information tag are input, H ₂ (otvk, tag) is obtained, and bh ^{H2 (otvk, tag)} is ^obtained using b included in the verification key. When the obtained g ₁ ^z1 g ₂ ^z2 and bh ^{H2 (otvk, tag)} are the same, it is determined that the electronic signature σ is valid. That is, otVrfy returns 1. If g ₁ ^z1 g ₂ ^z2 and bh ^{H2 (otvk, tag)} are different, it is determined that the electronic signature is not valid and the result is rejected (s137). That is, otVrfy returns a value other than 1. It is possible to reject electronic signatures generated by devices other than the commitment receiver 15.

If the electronic signature σ is valid, the ciphertext verification unit 132 takes out the public parameter pk = (g, X, Y, H) from the storage unit 154 and includes it in the hash function H and the first ciphertext C. Using u and the verification key otvk, t = H (otvk, u) is obtained. Further, using the public parameter pk = (g, X, Y, H) and τ included in the first ciphertext C, it is verified whether e (u, X ^t Y) = e (g, τ) holds. (S134). If u and τ included in the received first ciphertext C are the same as g ^r and (X ^t Y) ^r generated by the commitment receiver 15, the above equation holds. If e (u, X ^t Y) = e (g, τ) holds, it is determined that the received first ciphertext C is a true ciphertext. If e (u, X ^t Y) = e (g, τ) does not hold, it is determined that the first ciphertext C is not a true ciphertext, and a negative decision is made (s137). This process

Can first ciphertext C is to stop the process when not included as original language L _R (if C is not a true ciphertext).

<Generation of commitment information>
When it is determined that the first ciphertext C is a true ciphertext, the commitment information generation unit 138 uses the first ciphertext C and the confidential information m to (a) for the Σ-protocol of the relationship R ^priv _{pk, tag} , Z) ← simΣ (C, m) is calculated (s135). For example, the commitment information generation unit 138 randomly selects K ^ from the group G ^{* obtained} by removing the unit element from G, and randomly selects z from Z / qZ. Further, a ^ = e (g, K ^) ^z · e (u, X) ^-m is calculated, and a set of K ^ and a ^ is generated as commitment information a. The commitment generation device 13 transmits the generated commitment information a to the commitment reception device 15 via the output unit 136 (s136).

  When the commitment generation device 13 and the commitment opening device 16 are the same device, (crs, tag, C, m, a, z) is safely stored in the storage unit 134. In the case of another device, the commitment generation device 13 transmits the information to the commitment opening device 16 via the output unit 136.

<Receiving and opening commitment information>
The commitment receiver 15 receives the commitment information a via the input unit 151 (FIG. 5) (FIG. 6, s155), and stores it in the storage unit 154 in association with (tag, C) (s156).

Further, the commitment receiving device 15 receives (tag, m, z) from the commitment generating device 13 or the commitment opening device 16 via the input unit 151 (s157). In the unsealing unit 159 of the commitment receiver 15, it is determined whether or not e (g, K ^) ^z = a ^ · e (u, X) ^m is satisfied by using _Σvrfy (C, a, m, z). (S158). For example, using g and X included in the public parameter pk, a = (K ^, a ^), u, z, and m included in the first ciphertext C, e (g, K ^) ^z = a ^ E (u, X) Determine whether ^m holds. If true, Σ _vrfy (C, a, m, z) returns 1, and it is determined that the received confidential information m has not been changed since the reception of the commitment information a, and is accepted (s159). e (g, K ^) ^z = a ^ · e (u, X) If ^m does not hold, Σ _vrfy (C, a, m, z) returns a value other than 1, and at least either m or z It is assumed that there has been a change, and the result is rejected (s160).

<Effect>
With such a configuration, a safe commitment method can be achieved even when a conventional signature is broken.

  Furthermore, in this embodiment, since a digital signature is combined with a Tag-KEM that can be publicly verified, a commitment scheme with higher security is realized.

Furthermore, by making the electronic signature a disposable signature, a more efficient commitment scheme than the conventional one (see Non-Patent Documents 3, 4, 5, 6 and 7) is realized. In the prior art, the SSTC is configured based on a common conversion method from a non-disposable electronic signature. Since these schemes convert from signature schemes, the efficiency of commitment depends on the signature scheme. As far as is known, secure non-disposable signature schemes must use stronger homes or larger parameters than secure disposable signatures and secure cryptographic schemes. For example, the signature scheme described in Reference 5 requires (g, g ₁ , g ₂ , u ′, H, u ₁ ,..., U _n ) as public parameters pk (for example, n = 160, 256, etc.). . On the other hand, in this embodiment, by using a combination of Tag-KEM that can be publicly verified and a disposable signature, the public parameters can be (g, X, Y, H), and sufficient security can be realized with small parameters. it can.
(Reference 5): Brent Waters, "Efficient Identity-Based Encryption Without Random Oracles", EUROCRYPT 2005, LNCS, Springer, Heidelberg, 2005, vol. 3494, p.114-127.

In addition, this embodiment is tight with respect to the CDH assumption, and can reduce the security parameter, reduce both the amount of information and the amount of calculation, and configure an efficient commitment system as compared with the prior art. be able to. For example, when the CDH assumption is k bits, a security parameter of k ′ (≈k) bits can be used in this embodiment. On the other hand, the signature scheme described in Reference 5 cannot obtain the same level of security unless security parameters of k ″ (≈10 ² k) bits are used.

<Program and storage medium>
The above-described third party device, commitment generation device, and commitment reception device can be functioned by a computer. In this case, each process of a program for causing a computer to function as a target device (a device having the functional configuration shown in the drawings in various embodiments) or a processing procedure (shown in each embodiment) is processed by the computer. A program to be executed by the computer may be downloaded from a recording medium such as a CD-ROM, a magnetic disk, or a semiconductor storage device or via a communication line into the computer, and the program may be executed.

<Other variations>
Other publicly verifiable Tag-KEMs and disposable signatures may be used. A commitment system may be configured from the Σ-protocol for Π and the relationship ^Rpriv _{pk, tag} , and the first ciphertext C does not necessarily include a signature. In addition, a non-disposable signature may be used, and in that case, the commitment method is safer than that of the prior art.

  The present invention is not limited to the above-described embodiments and modifications. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. In addition, it can change suitably in the range which does not deviate from the meaning of this invention.

  The present invention can be used for various cryptographic protocols. For example, it can be used for zero knowledge proof, multi-party calculation, electronic money or electronic voting.

DESCRIPTION OF SYMBOLS 1 Commitment system 11 Third party apparatus 12 Communication network 13 Commitment generating apparatus 15 Commitment receiving apparatus 16 Commitment opening apparatus 111 Input part 112 Key generation part 114 Storage part 115 Control part 116 Output part 131 Input part 132 Encryption verification part 134 Storage part 135 Control unit 136 Output unit 138 Commitment information generation unit 151 Input unit 152 Encryption unit 152a Signature key verification key generation unit 152b Signature generation unit 152c First key first ciphertext generation unit 154 Storage unit 155 Control unit 156 Output unit 159 Unsealing unit

Claims (9)

A commitment system comprising a commitment generator and a commitment receiver,
The tag-based key encapsulation mechanism that can be publicly verified is ， = (Gen, Enc, Dec), the public key generated using the key generation algorithm Gen is pk, and both the commitment generation device and the commitment reception device The known tag information is tag, r is a random number, the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc is C, the first key is K, The relationship R ^priv _{pk, tag} defined by Π

age,
The commitment receiving device gives the public key pk and the tag information tag to the encryption algorithm Enc, generates a pair (C, K) of the first ciphertext C and the first key K, and the first ciphertext C to the commitment generator,
A part of the evidence when opening the commit is z, the secret information to be committed is m, the commitment generation device receives the first ciphertext C, and uses the public key pk and the tag information tag, It is verified whether or not the first ciphertext C is a true ciphertext, and if it is a true ciphertext, (a, z) ← simΣ () for the Σ-protocol of the relationship R ^priv _{pk, tag.} C, m), and transmits commitment information a to the commitment receiver,
The commitment receiving apparatus receives the commitment information a, stores (tag, C, a), and receives (tag, m, z) _{. When the tag} R, the relation R ^priv _{pk, tag} is Σ _vrfy for the Σ-protocol. (C, a, m, z) is used to determine whether the confidential information m has been changed.
Commitment system. The commitment system according to claim 1,
The Z / qZ an integer of the set of zero or more and less than q, x, and y ← _R Z / qZ, a G and _{G T} the abelian group of prime order q, e: non-degenerate I a G × G → _{G T} a bilinear mapping, a g and a generator of G, and H as a hash function, X: = a ^{g x,} Y: = a ^{g y,} and the public key pk = (g, X, Y , H,) and,
The commitment receiving device generates a signature key otsk and a verification key otvk, generates an electronic signature σ using the signature key otsk and the tag information tag, and further uses r ← Z / qZ and the verification key otvk T: = H (otvk, g ^r ) to generate the first ciphertext C: = (σ, otvk, g ^r , (X ^t Y) ^r ) including the electronic signature σ and the verification key otvk And
The commitment generation device receives the first ciphertext C = (σ, otvk, u, τ), verifies whether the electronic signature σ is valid using the public key pk and the tag information tag, If the electronic signature σ is valid and e (u, X ^t Y) = e (g, τ) holds, it is determined that the first ciphertext C is a true ciphertext, and K ^ ← G ^* = (G− {1 _G }) and z ← Z / qZ are used to calculate a ^ = e (g, K ^) ^z · e (u, X) ^−m , and commitment information a = (K ^, a ^) is transmitted to the commitment receiver,
The commitment receiving device receives the commitment information a, stores (tag, C, a), and receives (tag, m, z), e (g, K ^) ^z = a ^ · e. (U, X) It is determined whether ^m holds, and if it does, it is determined that the confidential information m has not been changed.
Commitment system. The commitment system according to claim 2,
Z / q ₂ Z is a set of integers greater than or equal to 0 and less than q ₂ , G ₂ is an abelian group of prime order q ₂ , H ₂ is a hash function,
The subscripts s1, s2, w1 and w2 mean s ₁ , s ₂ , w ₁ and w ₂ , respectively, the signature key otsk and the verification key otvk are disposable signatures, and the commitment receiving device is g ₁ , with _{g 2 ← R G 2, s} 1, s 2, w 1, w 2 ← R Z / q 2 Z, b: = g 1 w1 g 2 w2 and h: ₌ seeking ^g 1 _s1 ^{g 2 s2} , The verification key otvk: = (g ₁ , g ₂ , h, b) and the signature key otsk = (otvk, s ₁ , s ₂ , w ₁ , w ₂ ) are generated, and c: = H ₂ (otvk) , Tag), z ₁ : = x ₁ + c · s ₁ mod q ₂ , z ₂ : = x ₂ + c · s ₂ mod q ₂ , and generate the electronic signature σ = (z ₁ , z ₂ ) And
It means each subscript H2, z1 and z2 _H 2, _{z 1} and _{z 2,} wherein the commitment generator, the verification key _{otvk: = (g 1, g} 2, h, b) and the electronic signature σ = (Z ₁ , z ₂ ) is used to determine whether or not g ₁ ^z1 g ₂ ^z2 = bh ^{H2 (otvk, tag)} is satisfied, and if so, the electronic signature σ is determined to be valid To
Commitment system. A commitment generation device that commits confidential information m and generates commitment information a,
Commit that receives the commitment generation device and the commitment information a, where タ グ = (Gen, Enc, Dec) is a publicly verifiable tag-based key encapsulation mechanism, pk is a public key generated using the key generation algorithm Gen Tag information that the receiving device knows together is tag, r is a random number, and the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc is C, and the first key Is K, and the relationship R ^priv _{pk, tag} defined by Π

And z as part of the evidence when opening the commit
When the first ciphertext C is received, it is verified whether the received first ciphertext C is a true ciphertext by using the public key pk and the tag information tag. Calculates (a, z) ← simΣ (C, m) for the Σ-protocol of the relationship R ^priv _{pk, tag} and sends commitment information a to the commitment receiver.
Commitment generator. A commitment receiving device for receiving commitment information a,
The tag-based key encapsulation mechanism that can be publicly verified is Π = (Gen, Enc, Dec), the public key generated using the key generation algorithm Gen is pk, the confidential information m is committed, and the commitment information a is generated. Tag information known by both the commitment generating device and the commitment receiving device is tag, r is a random number, and the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc Is C, the first key is K, and the relationship R ^priv _{pk, tag} defined by Π is

age,
The public key pk and the tag information tag are given to the encryption algorithm Enc, a pair (C, K) of the first ciphertext C and the first key K is generated, and the first ciphertext C is received by the commitment To the device,
A part of the evidence when opening the commit is z, the commitment information a is received from the commitment generation device, (tag, C, a) is stored, and (tag, m, z) is received. Using Σ _vrfy (C, a, m, z) for the Σ-protocol to determine whether the confidential information m has been changed,
Commitment receiver. A commitment method using a commitment generator and a commitment receiver,
The tag-based key encapsulation mechanism that can be publicly verified is ， = (Gen, Enc, Dec), the public key generated using the key generation algorithm Gen is pk, and both the commitment generation device and the commitment reception device The known tag information is tag, r is a random number, the first ciphertext obtained by giving the public key pk and the tag information tag to the encryption algorithm Enc is C, the first key is K, The relationship R ^priv _{pk, tag} defined by Π

age,
In the commitment receiving device, the public key pk and the tag information tag are given to the encryption algorithm Enc, a pair (C, K) of the first ciphertext C and the first key K is generated, and the first ciphertext A first ciphertext generation step of transmitting a sentence C to the commitment generation device;
A part of the evidence when opening the commit is z, the secret information to be committed is m, the commitment generation device receives the first ciphertext C, and the commitment generation device receives the public key pk and the tag The information tag is used to verify whether or not the first ciphertext C is a true ciphertext. If the first ciphertext C is a true ciphertext, (a) for the Σ-protocol of the relationship R ^priv _{pk, tag} , Z) ← sim Σ (C, m) is calculated, and commitment information generation step of transmitting commitment information a to the commitment receiving device;
In the commitment receiving device, when the commitment information a is received, (tag, C, a) is stored, and (tag, m, z) is received, Σ with respect to the Σ-protocol of the relation R ^priv _{pk, tag using vrfy} (C, a, m, z) to determine whether the confidential information m has been changed,
Commitment method. The commitment method according to claim 6, comprising:
The Z / qZ an integer of the set of zero or more and less than q, x, and y ← _R Z / qZ, a G and _{G T} the abelian group of prime order q, e: non-degenerate I a G × G → _{G T} a bilinear mapping, a g and a generator of G, and H as a hash function, X: = a ^{g x,} Y: = a ^{g y,} and the public key pk = (g, X, Y , H,) and,
In the first ciphertext generation step, the commitment receiving device generates a signature key otsk and a verification key otvk, generates an electronic signature σ using the signature key otsk and the tag information tag, and r ← Z / QZ and the verification key otvk are used to calculate t: = H (otvk, g ^r ), and the first ciphertext C: = (σ, otvk, g ^r , including the electronic signature σ and the verification key otvk, (X ^t Y) ^r )
In the commitment information generation step, the commitment generation device receives the first ciphertext C = (σ, otvk, u, τ), and the electronic signature σ is valid using the public key pk and the tag information tag. If the electronic signature σ is valid and e (u, X ^t Y) = e (g, τ) holds, the first ciphertext C is a true ciphertext. If it is determined that there is K ^ ← G ^* = (G− {1 _G }) and z ← Z / qZ, a ^ = e (g, K ^) ^z · e (u, X) ^−m Calculating commitment information a = (K ^, a ^) to the commitment receiver,
In the opening step, the commitment receiving device receives the commitment information a, stores (tag, C, a), receives (tag, m, z), and e (g, K ^) ^z = A ^ · e (u, X) It is determined whether ^m holds, and if it holds, it is determined that the confidential information m has not been changed.
Commitment method. The commitment method according to claim 7, comprising:
Z / q ₂ Z is a set of integers greater than or equal to 0 and less than q ₂ , G ₂ is an abelian group of prime order q ₂ , H ₂ is a hash function,
The subscripts s1, s2, w1 and w2 mean s ₁ , s ₂ , w ₁ and w ₂ , respectively, and the signature key otsk and the verification key otvk are disposable signatures, and in the first ciphertext generation step, the commitment receiving apparatus with _{g 1, g 2 ← R G} 2, s 1, s 2, w 1, w 2 ← R Z / q 2 Z, b: = g 1 w1 g 2 w2 and h: = g ₁ ^s1 g ₂ ^s2 is obtained, and the verification key otvk: = (g ₁ , g ₂ , h, b) and the signature key otsk = (otvk, s ₁ , s ₂ , w ₁ , w ₂ ) are generated Then, c: = H ₂ (otvk, tag) is obtained, z ₁ : = x ₁ + c · s ₁ mod q ₂ , z ₂ : = x ₂ + c · s ₂ mod q ₂ is obtained, and the electronic signature σ = (Z ₁ , z ₂ )
In subscript H2, z1 and z2 means _H 2, _{z 1} and _{z 2,} respectively, the first ciphertext verification step, the commitment generating device, the verification key _{otvk: = (g 1, g} 2, h, b) and the electronic signature σ = (z ₁ , z ₂ ) are used to determine whether g ₁ ^z1 g ₂ ^z2 = bh ^{H2 (otvk, tag)} holds, It is determined that the electronic signature σ is valid.
Commitment method.   A program for causing a computer to function as the commitment generation device or commitment reception device according to claim 4 or 5.

Images