JP5683512B2 - Verifiable cryptographic signature system, verifiable cryptographic signature method, apparatus, and program - Google Patents

Description

  The present invention relates to a digital signature technology that can be verified in an encrypted state (verifiable encryption signature technology) used in, for example, a telecommunications system.

  To date, several secure verifiable cryptographic signature techniques have been proposed.

  The method disclosed in Non-Patent Document 1 is a method in which the size of the verification key is very small. However, since its security can only be proved by an unrealistic model called a random oracle model, the security cannot be trusted.

  The method disclosed in Non-Patent Document 2 is based on standard cryptographic assumptions and has been proved to be secure by a realistic model called a standard model. However, the size of the verification key is proportional to the size of the security parameter. There is a disadvantage of becoming larger.

  The method disclosed in Non-Patent Document 3 is a method whose security is proved by a standard model and the size of the verification key is small. However, since the cryptographic assumptions that form the basis of security are non-standard, There is no trust in sex.

  For the standard model, random oracle model, encryption security, etc., for example, Non-Patent Document 4 is helpful.

D. Boneh, C. Gentry, B. Lynn, and H. Shacham. Aggregate and Verifiably Encrypted Signatures from Bilinear Maps.In EUROCRYPT, volume 2656 of Lecture Notes in Computer Science, pages 416-432.Springer, 2003. S. Lu, R. Ostrovsky, A. Sahai, H. Shacham, and B. Waters. Sequential Aggregate Signatures and Multisignatures Without Random Oracles. In EUROCRYPT, volume 4004 of Lecture Notes in Computer Science, pages 465-485. Springer, 2006 . M. Ruckert and D. Schroder.Security of Verifiably Encrypted Signatures and a Construction without Random Oracles.In Pairing, volume 5671 of Lecture Notes in Computer Science, pages 17-34.Springer, 2009. Daisuke Moriyama, Ryo Nishimaki, Tatsuaki Okamoto, "Mathematics of Public Key Cryptography-Series Applied Mathematics Volume 2", First Edition, Kyoritsu Publishing Co., Ltd., March 2011, pp.23-31, pp.94-95 ISBN: 978-4-320-01951-5.

  In the existing method, the standard model that is secure uses only standard cryptographic assumptions, but the verification key size increases depending on the security parameter size, or the verification key size is small but non-standard There was only a scheme that required a common (more unreliable) cryptographic assumption.

  Accordingly, an object of the present invention is to provide a verifiable cryptographic signature technique based on standard cryptographic assumptions and whose verification key size does not depend on the size of security parameters.

The verifiable encryption signature technique of the present invention is as follows. According to the present invention, a verifiable cryptographic signature system includes an arbitration device, a signature device, and a verification device. p is a prime number, Z is a set representing the whole integer, Z _p is a remainder class ring of Z modulo _p , Z _p ^* = Z _p- {0}, G and G _T are cyclic multiplications of prime order p, respectively Standard group generation algorithm for groups, g for generators of group G, e for bilinear maps, M for _elements of Z _p , Γ: = (p, G, G _T , e, g) for bilinear maps Is a predetermined system parameter generated by. Then, the arbitrator key generation unit of the arbitrator selects the element β of Z _p ^* , and outputs the arbitrator public key apk: = ζ: = g ^β and the arbitrator decryption key ask: = β [arbiter key generation processing]. The key generation unit of the signature device selects elements v, v1, v2, w, u, h of group G and _elements a1, a2, b, α of Z _p , and sets τ1: = vv1 ^a1 , τ2: = vv2 ^a2 Calculate and verify key VK: = (g ^b , g ^a1 , g ^a2 , g ^ba1 , g ^ba2 , τ1, τ2, τ1 ^b , τ2 ^b , w, u, h, e (g, g) ^αa1b ), signature The key SK: = (VK, g ^α , g ^αa1 , v, v1, v2) is output [key generation process]. In addition, the signature generation unit of the signature device uses the _elements r1, r2, z1, z2, and tagk of Z _p as r: = r1 + r2, and σ1: = g ^αa1 v ^r , σ2: = g ^−α v1 ^r g ^z1 , σ3: = (g ^b ) ^-z1 , σ4: = v2 ^r g ^z2 , σ5: = (g ^b ) ^-z2 , σ6: = (g ^b ) ^r2 , σ7: = g ^r1 , σ8: = (u ^M w ^tagk h) Calculate ^r1 , choose the _elements ρ1, ρ2 , ^{ρ4 of} Z _p , K1: = σ 1・ ζ ^ρ1 , K1 ': = g ^ρ1 , K1 ^: = (g ^b ) ^ρ1 , K2: = σ2 ・ ζ ^ρ2 , K2 ': = g ^ρ2 , K2 ^: = (g ^ba1 ) ^ρ2 , K3: = σ3, K4: = σ4 ・ ζ ^ρ4 , K4': = g ^ρ4 , K4 ^: = (g ^ba2 ) ^ρ4 , K5: = σ5, K6: = σ6, K7: = σ7, K8: = σ8 and verifiable cryptographic signature ω: = (K1, K2, K3, K4, K5, K6, K7, K8, K1 ', K2', K4 ', K1 ^, K2 ^, K4 ^, tagk) are output [signature generation processing]. Then, the verification unit of the verification apparatus selects the elements s1, s2, t, and tagc of Z _p and sets s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3 : = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , E1: = (u ^M w ^tagc h) ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk) as e (K1 ', g ^b ) = e (g, K1 ^), e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1) / e (ζ ^s , K1 ^)) ・ (e (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5, K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g ) ^αa1b ) When it is confirmed that ^s2 is satisfied, and only when it is confirmed, a verification result indicating a verification success is output [verification processing].

Further, the restoration unit of the arbitration device selects the elements s1, s2, t, and tagc of Z _p and sets s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3 : = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , E1: = (u ^M w ^tagc h) ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk) as e (K1 ', g ^b ) = e (g, K1 ^), e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1) / e (ζ ^s , K1 ^)) ・ (e (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5, K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g ) ^αa1b ) If ^s2 is confirmed and confirmed, σ1: = K1 ・ (K1 ') ^-β , σ2: = K2 ・ (K2') ^-β , σ3: = K3, σ4 : = K4 ・ (K4 ') ^-β , σ5: = K5, σ6: = K6, σ7: = K7, and σ8: = K8, choose the elements z1', z2 ', r' of Z _p , σ1 ': = σ1, σ2': = σ2 ・ g ^{z1 '} , σ3': = σ3 ・ (g ^b ) ^{-z1 '} , σ4': = σ4 ・ g ^{z2 '} , σ5': = σ5 ・ (g ^b ) ^{-z2 ', σ6': = σ6} · (g b) -r ', σ7': = σ7 · g r ', and σ8': = σ8 · (u M w tagk h) r ' Calculated signature σ ': = (σ1', σ2 ', σ3', σ4 ', σ5', σ6 ', σ7', σ8 ', tagk) outputs the restoration process] also may include.

  According to the present invention, details will be given to the embodiment described later, but the number of elements of the signature key is slightly increased, but instead the number of elements of the verification key is greatly reduced. In addition, when encrypting a signature, not only the signature element related to the signature key but also the random number element of the signature not directly related to the signature key is encrypted with the arbitrator public key, so that the size of the verification key is secured. It is independent of parameter size, and security is based only on standard cryptographic assumptions.

The figure which shows the verifiable encryption signature system of embodiment. The figure which shows the process sequence of the verifiable encryption signature in embodiment. 1 is a diagram illustrating a functional configuration of a system parameter generation device, an arbitration device, a signature device, and a verification device that are components of a verifiable encryption signature system according to an embodiment.

Before describing the embodiment of the present invention, some basic matters will be described.
First, the notation will be described.
For a certain finite set S, r ← _U S represents that the element r is uniformly selected from the set S.
For a probabilistic polynomial time algorithm A, a ← _R A (x) represents that algorithm A operates with a random number and inputs a and outputs a.
For some values a and b, a: = b indicates that b is substituted for a or that a is defined by b. Which is clear is clear from the meaning of the sentence, so it is not particularly refused.

[Pairing]
An operation called pairing that satisfies bilinearity is defined as a group structure based on a rational point and an infinite point on an elliptic curve defined on a finite field. Although the group on the elliptic curve is usually an additive group, it is described as a multiplicative group according to the custom. For details, refer to Reference Document 1, for example.
(Reference 1) D. Boneh and MK Franklin. Identity-Based Encryption from the Weil Pairing. In CRYPTO'01, volume 2139 of Lecture Notes in Computer Science, pages 213-229. Springer, 2001.

The G and G _T the group of order p. Let Z be a set representing the whole integer. Where p is a sufficiently large prime number. The bilinear map e: G × G → G _T between the two groups G and G _T satisfies the following properties.
Bilinearity:
E (g ^a , h ^b ) = e (g, h) ^ab holds for any g, h∈G and any a, b∈Z.
Non-degenerative:
There exists g satisfying e (g, g) ≠ 1. That and, if g is G of origin e (g, g) is a generator of G _T.
Computability:
For any g, h∈G, e (g, h) can be computed efficiently (ie in polynomial time).

[Cryptographic assumptions]
Consider a cyclic group G of prime order p. Let g be a generator of group G. Let BMSetup be the standard group generation algorithm for bilinear maps that generate (p, G, G _T , e, g) with the security parameter λ as input.

[Judgment linear problem]
Using Z _p as a remainder class ring of Z modulo p, ^generate Ar _β ^DLIN (1 ^λ ), Γ: = (p, G, G _T , e, g) ← _R BMsetup (1 ^λ ), Select f, h ← _U G, x, y ← _U Z _p , Q ₀ : = g ^{x + y} , Q ₁ ← _U G as (Γ, f, h, g, f ^x , h ^y , Q _β ) Is an algorithm that outputs. β∈ {0,1}. Judgment linear problem is a problem that predicts β∈ {0,1} when (Γ, f, h, g, f ^x , h ^y , Q _β ) ← _R Ar _β ^DLIN (1 ^λ ) is given It is. This superiority is defined by equation (1).
Adv _A ^DLIN (λ) = | Pr [A (I) → 1 | I ← Ar ₀ ^DLIN (1 ^λ )]-Pr [A (I) → 1 | I ← Ar ₁ ^DLIN (1 ^λ )] | (1 )

[Judgment linear assumption]
The fact that the judgment linear assumption is satisfied means that the judgment linear problem is difficult, that is, Adv _A ^DLIN (λ) expressed by the equation (1) can be ignored for any attacker A. .

Next, the Waters signature on which the present invention is based will be outlined (Reference Document 2). λ represents a security parameter. BMSetup is a standard algorithm that takes 1 ^λ as input and outputs (p, G, G _T , e, g). p is the λ bit prime number, G, G _T is a cyclic multiplicative group number of order p prime respectively, g is generator of the group G, e represents a bilinear map.
(Reference 2) B. Waters. Dual System Encryption: Realizing Fully Secure IBE and HIBE under Simple Assumptions. In CRYPTO'09, volume 5677 of Lecture Notes in Computer Science, pages 619-636. Springer, 2009. full version available from http://eprint.iacr.org/2009/385.

W.Gen (1 ^λ , Γ):
With security parameter λ as input, generate Γ: = (p, G, G _T , e, g) ← _R BMsetup (1 ^λ ), and generate source v, v1, v2, w, u, h ← _U G and Select a1, a2, b, α ← _U Z _p , calculate τ1: = vv ₁ ^a1 , τ2: = vv ₂ ^a2 , and verify key VK: = (Γ, g ^b , g ^a1 , g ^a2 , g ^ba1 , g ^ba2 , τ1, τ2, τ ₁ ^b , τ ₂ ^b , w, u, h, e (g, g) ^αa1b ), signing key SK: = (VK, g ^α , g ^αa1 , v, v1, v2 ) Is output.

W.Sign (SK, M):
As input plaintext M∈Z _p and signature key SK, select the r1, r2, z1, z2, tagk ← U Z p, r: = a r1 + r2, σ1: = g αa1 v r, σ2: = g - ^α v1 ^r g ^z1 , σ3: = (g ^b ) ^-z1 , σ4: = v2 ^r g ^z2 , σ5: = (g ^b ) ^-z2 , σ6: = (g ^b ) ^r2 , σ7: = g ^r1 , σ8 : = (u ^M w ^tagk h) ^r1 is calculated, and the signature sig: = (σ1, σ2, σ3, σ4, σ5, σ6, σ7, σ8, tagk) is output.

W.Vrfy (VK, sig, M):
Input verification key VK, plaintext M, signature sig, select s1, s2, t, tagc ← _U Z _p , set s: = s1 + s2, V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^−t , E1: = (u ^M w ^tagc h) ^t , E2: = g ^t is calculated. Information (for example, a value of 1) indicating a successful verification is output when and only when the following is satisfied. However, θ: = 1 / (tagc-tagk).
tagc-tagk ≠ 0 and e (V1, σ1) ・ e (V2, σ2) ・ e (V3, σ3) ・ e (V4, σ4) ・ e (V5, σ5) = e (V6, σ6) ・ e ( V7, σ7) ・ (e (E1, σ7) / e (E2, σ8)) ^θ・ (e (g, g) ^αa1b ) ^s2

<Embodiment>
[Verifiable cryptographic signature system]
As shown in FIG. 1, the verifiable cryptographic signature system 1 according to the embodiment includes a system parameter generation device 500, an arbitration device 100, a signature device 200, and a verification device 300. These apparatuses can communicate with each other via a communication network 5 such as the Internet. Since it is sufficient that the system parameters described later are determined in advance, the system parameter generation device 500 is not an indispensable component of the verifiable cryptographic signature system 1, and the system parameters generated by a device (not shown) can be verified. It is sufficient if it is provided to the integrated signature system 1. Depending on the form, it is allowed that the arbitrating device 100 also serves as the system parameter generating device 500.

  The verifiable cryptographic signature system of the present invention may include one or a plurality of signature devices 200 and one or a plurality of verification devices 300 according to the number of users or the like. In order to facilitate understanding of the present invention, In an embodiment described later, it is assumed that the verifiable cryptographic signature system 1 includes one arbitration device 100, one signature device 200, and one verification device 300.

  The processing in the verifiable cryptographic signature system 1 will be described with reference to FIG. Refer to FIG. 3 for the functional configuration of each device.

The system parameter generation unit 501 of the system parameter generation apparatus 500 receives the security parameter λ as an input under the cryptographic assumptions described above, and is a system parameter common to the entire system, that is, a parameter Γ: = (p, G, G _T , e, g) ← _R BMsetup (1 ^λ ) is output (step S1).

  The transmission unit 508 of the system parameter generation device 500 transmits the parameter Γ to each device 100, 200, 300.

The receiving unit 109 of the arbitrating device 100 receives the parameter Γ. The parameter Γ is stored in a storage unit (not shown) of the arbitrating device 100. The arbitrator key generation unit 101 of the arbitrator 100 generates an arbitrator public key and an arbitrator decryption key as follows. Γ: = (p, G, G _T , e, g) received from the system parameter generation device 500 is input, β ← _U Z _p ^* is selected, and the arbitrator public key apk: = ζ: = g ^β and arbitration The person decryption key ask: = β is output (step S2). Z _p ^* = Z _p − {0}.

  The transmission unit 108 of the arbitrating device 100 transmits the arbitrator public key apk to the devices 200 and 300. The arbitrator public key apk and the arbitrator decryption key ask are also stored in a storage unit (not shown) of the arbitrator 100.

  The receiving unit 209 of the signature device 200 receives the parameter Γ and the arbitrator public key apk. The parameter Γ and the arbitrator public key apk are stored in a storage unit (not shown) of the signature device 200.

The key generation unit 201 of the signature device 200 receives Γ: = (p, G, G _T , e, g) received from the system parameter generation device 500 as an input, and the group elements v, v1, v2, w, u, Select h ← _U G and a1, a2, b, α ← _U Z _p , calculate τ1: = vv1 ^a1 , τ2: = vv2 ^a2 and verify key VK: = (g ^b , g ^a1 , g ^a2 , g ^ba1 , g ^ba2 , τ1, τ2, τ1 ^b , τ2 ^b , w, u, h, e (g, g) ^αa1b ), signing key SK: = (VK, g ^α , g ^αa1 , v, v1, v2) Is output (step S3). This is the same as the key generation for the Waters signature described above. The verification key VK and the signature key SK are also stored in a storage unit (not shown) of the signature device 200.

The signature generation unit 202 of the signature device 200 receives the signature key SK, the plaintext M, and the arbitrator public key apk of the arbitration device 100, and is generated by, for example, a random number generation device (not shown) or a random number generation unit included in the signature device 200. A verifiable cryptographic signature is generated using a random number. Specifically, it is as follows. The signature generation unit 202 selects random numbers r1, r2, z1, z2, tagk ← _U Z _p , sets r: = r1 + r2, and σ1: = g ^αa1 v ^r , σ2: = g ^−α v1 ^r g ^z1 , σ3: = (g ^b ) ^-z1 , σ4: = v2 ^r g ^z2 , σ5: = (g ^b ) ^-z2 , σ6: = (g ^b ) ^r2 , σ7: = g ^r1 , σ8: = (u ^M w ^tagk h) Calculate ^r1 , choose random numbers ρ1, ρ2 , ρ 4 ← _U Z _p , K1: = σ 1・ ζ ^ρ1 , K1 ': = g ^ρ1 , K1 ^: = (g ^b ) ^ρ1 , K2: = σ2 ・ ζ ^ρ2 , K2 ': = g ^ρ2 , K2 ^: = (g ^ba1 ) ^ρ2 , K3: = σ3, K4: = σ4 ・ ζ ^ρ4 , K4': = g ^ρ4 , K4 ^: = (g ^ba2 ) ^ρ4 , K5: = σ5, K6: = σ6, K7: = σ7, K8: = σ8 and ω: = (K1, K2, K3, K4, K5, K6, K7, K8, K1 ', K2 ', K4', K1 ^, K2 ^, K4 ^, tagk) are output (step S4). The transmission unit 208 transmits the verification key VK, the plaintext M, and the verifiable encryption signature ω to the verification device 300.

  The verification device 300 includes a verification unit 301 that verifies that the verifiable encrypted signature ω is a correct ciphertext using the arbitrator public key apk of the signature correctly generated by the signature device 200, a transmission unit 308, and a reception unit 309. I have. The receiving unit 209 of the verification apparatus 300 receives the parameter Γ, the verification key VK, the plaintext M, and the verifiable encryption signature ω. The parameter Γ, the verification key VK, the plaintext M, and the verifiable encryption signature ω are stored in a storage unit (not shown) of the verification apparatus 300.

The verification process is as follows. The verification unit 301 of the verification apparatus 300 includes a verifiable encrypted signature ω: = (K1, K2, K3, K4, K5, K6, K7, K8, K1 ′, K2 ′, K4 ′, K1 ^, K2 ^, K4 ^, tagk), plaintext M, verification key VK, and arbitrator public key apk, select random numbers s1, s2, t, tagc ← _U Z _p , set s: = s1 + s2, V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = Calculate (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , E1: = (u ^M w ^tagc h) ^t , E2: = g ^t , check tagc-tagk ≠ 0, and θ: = 1 / ( tagc-tagk), e (K1 ', g ^b ) = e (g, K1 ^), e (K2', g ^ba1 ) = e (g, K2 ^), e (K4 ', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1) / e (ζ ^s , K1 ^)) ・ (e (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3)・ (E (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5, K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e ( E2, K8)) ^θ・ (e (g, g) ^αa1b ) When verifying that ^s2 holds, and only when that is the case, verify by substituting information (for example, a value of 1) indicating verification success into the verification result result The result “result” is output (step S5). If any one of the verification units 301 does not hold, the verification unit 301 substitutes information (for example, a value of 0) indicating verification failure into the verification result result and outputs the verification result result.

  According to the verifiable encryption signature technique, the arbitrating device 100 uses the signature σ: = (σ1, σ2, σ3, σ4, σ5, σ6, σ7, before the signature device 200 encrypts using the arbitrator public key apk. (σ8, tagk) can be restored. Hereinafter, this process will be described.

  Verification device 300 requires signature σ: = (σ1, σ2, σ3, σ4, σ5, σ6, σ7, σ8, tagk) before signature device 200 encrypts using arbitrator public key apk The transmitting unit 308 transmits the verifiable encrypted signature ω, the verification key VK, and the plaintext M from the signature device 200 to the arbitration device 100.

The arbitrating device 100 further includes a restoring unit 102 that decrypts the verifiable encrypted signature ω and restores the normal signature. The verifiable encryption signature ω, the verification key VK, and the plaintext M received from the verification device 300 are stored in a storage unit (not shown) of the arbitration device 100. A process in which the restoration unit 102 of the arbitrating device 100 decrypts the verifiable encryption signature ω is as follows. The restoration unit 102 includes an arbitrator public key apk, an arbitrator decryption key ask, a verification key VK, a verifiable encryption signature ω: = (K1, K2, K3, K4, K5, K6, K7, K8, K1 ′, K2 ', K4', K1 ^, K2 ^, K4 ^, tagk) and plaintext M as input, the verification process by the verification apparatus 300 is performed first and the verifiable cryptographic signature ω is a correct cryptographic signature (See the process of step S5 above), and when the verification is correct, σ1: = K1 · (K1 ′) ^−β , σ2: = K2 · (K2 ′) ^−β , σ3: = K3 , σ4: = K4 ・ (K4 ') ^-β , σ5: = K5, σ6: = K6, σ7: = K7, and σ8: = K8, and calculate random numbers z1', z2 ', r' ← _U Z _p Σ1 ': = σ1, σ2': = σ2 ・ g ^{z1 '} , σ3': = σ3 ・ (g ^b ) ^{-z1 '} , σ4': = σ4 ・ g ^{z2 '} , σ5': = σ5 ・ ( g ^b ) ^{-z2 '} , σ6': = σ6 ・ (g ^b ) ^{-r '} , σ7': = σ7 ・ g ^{r '} , and σ8': = σ8 ・ (u ^M w ^tagk h) ^{r '} Σ ′: = (σ1 ′, σ2 ′, σ3 ′, σ4 ′, σ5 ′, σ6 ′, σ7 ′, σ8 ′, tagk), and outputs σ ′ as a signature (step S6). Note that when processing by the signature device 200 is valid, σ ′ = σ. If the verification fails, the restoration unit 102 does not obtain σ ′ (note that the arbitrating device 100 may transmit information indicating that the verification has failed to the verification device 300). The transmission unit 108 transmits the plaintext M and the restored signature σ ′ to the verification device 300.

Table 1 shows a comparison between the present invention and the prior art. CDH stands for computational Diffie-Hellman (computational Diffie-Hellman) assumption, and ROM stands for a random oracle model. Q-strong DH extraction assumptions with the prefix q- are classified into assumptions called q assumptions in the field of cryptography, and are the standard cryptographic assumptions CDH assumption, DDH (decision Diffie-Hellman) assumption, DLIN (Decision linear) The grounds for safety are less reliable than the assumptions. As can be seen from Table 1, first, according to the method disclosed in Non-Patent Document 1 or the method disclosed in Non-Patent Document 3, the size of the verification key and the verifiable encryption signature are smaller than those of the present invention. Although it can be evaluated, this is because the assumption and model of weak trust in cryptographic security are premised. The method disclosed in Non-Patent Document 1 and the method disclosed in Non-Patent Document 3 are the present invention. Is essentially different. According to the method disclosed in Non-Patent Document 2, it is not different from the present invention in that it is based on assumptions and models that are considered to be cryptographically secure, but unlike the present invention, the size of the verification key is different. Depends on the size of the security parameters. Since the size λ of the security parameter is generally set sufficiently larger than 12, the present invention is not limited to the size of the verification key, and the size of the verification key is sufficiently small. It can be evaluated that it is a verifiable cryptographic signature scheme.

<Supplementary note>
Hardware entities (system parameter generation device, arbitration device, signature device, verification device) that can be included in the verifiable cryptographic signature system are an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, hardware A communication unit to which a communication device (for example, a communication cable) capable of communicating outside the wear entity can be connected, a CPU (Central Processing Unit) [a cache memory, a register, or the like may be provided. ], A RAM or ROM that is a memory, an external storage device that is a hard disk, and a bus that connects the input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. have. If necessary, a hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device.) Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device. In the above description, a storage device such as a RAM or a register that stores an operation result, an address of a storage area thereof, or the like is simply referred to as a “storage unit”.

  In the hardware entity, each program stored in an external storage device (or ROM, etc.) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU implements predetermined functions (for example, a system parameter generation unit, an arbitrator key generation unit, a key generation unit, a signature generation unit, a verification unit, a restoration unit, etc.).

In the details of the hardware entity described in each embodiment, numerical calculation processing in number theory may be required, but numerical calculation processing in number theory itself is achieved in the same manner as in the well-known technique. A detailed description of the arithmetic processing method and the like has been omitted (software that can perform numerical calculation processing in number theory indicating the technical level of this point includes, for example, PARI / GP, KANT / KASH, etc. About PARI / GP For example, see the Internet <URL: http://pari.math.u-bordeaux.fr/> [searched on January 13, 2012] For KANT / KASH, for example, the Internet <http: // www .math.tu-berlin.de / ~ kant / kash.html> [Search January 13, 2012].
Reference literature A can be cited as a literature regarding this point.
(Reference A) H. Cohen, "A Course in Computational Algebraic Number Theory", GTM 138, Springer-Verlag, 1993.

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  Further, when the processing functions in the hardware entity described in the above embodiment are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (8)

A verifiable cryptographic signature system including an arbitration device, a signature device, and a verification device,
p is a prime number, Z is a set representing the whole integer, Z _p is a remainder class ring of Z modulo _p , Z _p ^* = Z _p- {0}, G and G _T are cyclic multiplications of prime order p, respectively Standard group generation algorithm for groups, g for generators of group G, e for bilinear maps, M for _elements of Z _p , Γ: = (p, G, G _T , e, g) for bilinear maps As a predetermined system parameter generated by
The arbitration device is
An arbitrator key generation unit that selects an element β of Z _p ^* and outputs an arbitrator public key apk: = ζ: = g ^β and an arbitrator decryption key ask: = β;
The signing device
Select elements v, v1, v2, w, u, h of group G and _elements a1, a2, b, α of Z _p , calculate τ1: = vv1 ^a1 , τ2: = vv2 ^a2 , and verify key VK: = (g ^b , g ^a1 , g ^a2 , g ^ba1 , g ^ba2 , τ1, τ2, τ1 ^b , τ2 ^b , w, u, h, e (g, g) ^αa1b ), signing key SK: = (VK, g ^α , g ^αa1 , v, v1, v2)
Using the _elements r1, r2, z1, z2 and tagk of Z _p , r: = r1 + r2, and σ1: = g ^αa1 v ^r , σ2: = g ^-α v1 ^r g ^z1 , σ3: = (g ^b ) ^-z1 , σ4: = v2 ^r g ^z2 , σ5: = (g ^b ) ^-z2 , σ6: = (g ^b ) ^r2 , σ7: = g ^r1 , σ8: = (u ^M w ^tagk h) Calculate ^r1 And select the _elements ρ1, ρ2 , ρ4 of Z _p , K1: = σ 1・ ζ ^ρ1 , K1 ': = g ^ρ1 , K1 ^: = (g ^b ) ^ρ1 , K2: = σ2 ・ ζ ^ρ2 , K2 ': = g ^ρ2 , K2 ^: = (g ^ba1 ) ^ρ2 , K3: = σ3, K4: = σ4 ・ ζ ^ρ4 , K4': = g ^ρ4 , K4 ^: = (g ^ba2 ) ^ρ4 , K5: = σ5 , K6: = σ6, K7: = σ7, K8: = σ8 and verifiable cryptographic signature ω: = (K1, K2, K3, K4, K5, K6, K7, K8, K1 ', K2', (K4 ', K1 ^, K2 ^, K4 ^, tagk)
The verification device is
Select the elements s1, s2, t, and tagc of Z _p , set s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4 : = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , E1: = (u ^M w ^tagc h) Calculate ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk), e (K1 ', g ^b ) = e (g, K1 ^) , e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1) / e (ζ ^s , K1 ^)) ・ (E (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5 , K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g) ^αa1b ) ^s2 A verifiable cryptographic signature system including a verification unit that outputs a verification result indicating a verification success only when it is confirmed. A verifiable cryptographic signature system according to claim 1, comprising:
The arbitration device further includes:
Select the elements s1, s2, t, and tagc of Z _p , set s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4 : = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , E1: = (u ^M w ^tagc h) Calculate ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk), e (K1 ', g ^b ) = e (g, K1 ^) , e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1) / e (ζ ^s , K1 ^)) ・ (E (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5 , K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g) ^αa1b ) ^s2 If this is confirmed, σ1: = K1 ・ (K1 ') ^-β , σ2: = K2 ・ (K2') ^-β , σ3: = K3, σ4: = K4 ・ (K4 ') ^- Calculate ^β , σ5: = K5, σ6: = K6, σ7: = K7, and σ8: = K8, choose the elements z1 ', z2', r 'of Z _p , and σ1': = σ1, σ2 ': = σ2 ・ g ^{z1 '} , σ3': = σ3 ・ (g ^b ) ^{-z1 '} , σ4': = σ4 ・ g ^{z2 '} , σ5': = σ5 ・ (g ^b ) ^{-z2 '} , σ6': = σ6・ (G ^b ) ^{-r '} , σ7': = σ7 ・ g ^{r '} , and σ8': = σ8 ・ (u ^M w ^tagk h) ^{r '} are calculated and signature σ': = (σ1 ', σ2' , σ3 ', 4 ', σ5', σ6 ', σ7', σ8 ', verifiable cryptographic signature system, characterized in that it comprises a restoring unit that outputs tagk). A verifiable cryptographic signature method in a verifiable cryptographic signature system including an arbitration device, a signature device, and a verification device,
p is a prime number, Z is a set representing the whole integer, Z _p is a remainder class ring of Z modulo _p , Z _p ^* = Z _p- {0}, G and G _T are cyclic multiplications of prime order p, respectively Standard group generation algorithm for groups, g for generators of group G, e for bilinear maps, M for _elements of Z _p , Γ: = (p, G, G _T , e, g) for bilinear maps As a predetermined system parameter generated by
An arbitrator key generation unit that selects an element β of Z _p ^* and outputs an arbitrator public key apk: = ζ: = g ^β and an arbitrator decryption key ask: = β; ,
The key generation unit of the signature device selects elements v, v1, v2, w, u, h of group G and _elements a1, a2, b, α of Z _p , and τ1: = vv1 ^a1 , τ2: = vv2 ^a2 And the verification key VK: = (g ^b , g ^a1 , g ^a2 , g ^ba1 , g ^ba2 , τ1, τ2, τ1 ^b , τ2 ^b , w, u, h, e (g, g) ^αa1b ), A key generation step of outputting a signature key SK: = (VK, g ^α , g ^αa1 , v, v1, v2);
The signature generation unit of the signing device uses the elements r1, r2, z1, z2, and tagk of Z _p as r: = r1 + r2, and σ1: = g ^αa1 v ^r , σ2: = g ^-α v1 ^r g ^z1 , σ3: = (g ^b ) ^-z1 , σ4: = v2 ^r g ^z2 , σ5: = (g ^b ) ^-z2 , σ6: = (g ^b ) ^r2 , σ7: = g ^r1 , σ8: = ( u ^M w ^tagk h) ^r1 , calculate the _elements ρ1, ρ2 , ^{ρ4 of} Z _p , and select K1: = σ 1・ ζ ^ρ1 , K1 ': = g ^ρ1 , K1 ^: = (g ^b ) ^ρ1 , K2: = σ2 ・ ζ ^ρ2 , K2 ': = g ^ρ2 , K2 ^: = (g ^ba1 ) ^ρ2 , K3: = σ3, K4: = σ4 ・ ζ ^ρ4 , K4': = g ^ρ4 , K4 ^: = ( g ^ba2 ) ^ρ4 , K5: = σ5, K6: = σ6, K7: = σ7, K8: = σ8 and verifiable cryptographic signature ω: = (K1, K2, K3, K4, K5, K6, K7 , K8, K1 ', K2', K4 ', K1 ^, K2 ^, K4 ^, tagk)
The verification unit of the verification device selects the elements s1, s2, t, and tagc of Z _p and sets s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , ^Calculate E1: = (u ^M w ^tagc h) ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk) and e (K1 ', g ^b ) = e (g, K1 ^), e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1 ) / e (ζ ^s , K1 ^)) ・ (e (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5, K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g) ^αa1b ) A verifiable encryption signature method having a verification step of outputting a verification result indicating a verification success only when it is confirmed that ^s2 is satisfied. A verifiable cryptographic signature method according to claim 3, further comprising:
The restoration unit of the arbitrating device selects the elements s1, s2, t, and tagc of Z _p and sets s: = s1 + s2, and V1: = (g ^b ) ^s , V2: = (g ^ba1 ) ^s1 , V3: = (g ^a1 ) ^s1 , V4: = (g ^ba2 ) ^s2 , V5: = (g ^a2 ) ^s2 , V6: = τ1 ^s1 τ2 ^s2 , V7: = (τ1 ^b ) ^s1 (τ2 ^b ) ^s2 w ^-t , ^Calculate E1: = (u ^M w ^tagc h) ^t , E2: = g ^t , check tagc-tagk ≠ 0, and set θ: = 1 / (tagc-tagk) and e (K1 ', g ^b ) = e (g, K1 ^), e (K2 ', g ^ba1 ) = e (g, K2 ^), e (K4', g ^ba2 ) = e (g, K4 ^), and (e (V1, K1 ) / e (ζ ^s , K1 ^)) ・ (e (V2, K2) / e (ζ ^s1 , K2 ^)) ・ e (V3, K3) ・ (e (V4, K4) / e (ζ ^s2 , K4 ^)) ・ e (V5, K5) = e (V6, K6) ・ e (V7, K7) ・ (e (E1, K7) / e (E2, K8)) ^θ・ (e (g, g) ^αa1b ) ^s2 is confirmed, and when this is confirmed, σ1: = K1 ・ (K1 ') ^-β , σ2: = K2 ・ (K2') ^-β , σ3: = K3, σ4: = K4 ・ (K4 ') ^-β , σ5: = K5, σ6: = K6, σ7: = K7, and σ8: = K8, select the _elements z1', z2 ', r' of Z _p and select σ1 ': = σ1, σ2': = σ2 ・ g ^{z1 '} , σ3': = σ3 ・ (g ^b ) ^{-z1 '} , σ4': = σ4 ・ g ^{z2 '} , σ5': = σ5 ・ (g ^b ) ^{- z2 ', σ6': = σ6} · (g b) -r ', σ7': = σ7 · g r ', and σ8': = σ8 · (u M w tagk h) r ' a total of And verifiable encryption, including a restoration step for outputting a signature σ ′: = (σ1 ′, σ2 ′, σ3 ′, σ4 ′, σ5 ′, σ6 ′, σ7 ′, σ8 ′, tagk) Signature method.       The arbitration device used in the verifiable encryption signature system according to claim 1 or 2.       The said signature apparatus used in the verifiable encryption signature system of Claim 1 or Claim 2.       The said verification apparatus used in the verifiable encryption signature system of Claim 1 or Claim 2.       A program that causes a computer to function as any one of the arbitration device according to claim 5, the signature device according to claim 6, and the verification device according to claim 7.

Images