JPH02275983A - Multiple digital signature system - Google Patents

Abstract

PURPOSE:To improve the efficiency of processing by allowing plural signers to repeat prescribed operation and transmitting the signature component of the signer with respect to a message to the next signer together with the message. CONSTITUTION:The (i+1)st signer generates a random number Ri+1 and calculates the signature component 1 (Xi+1) based on the signature component (Xi) which is taken over from the signer (i) and Ri+1. Simultaneously, the signature component (Ei+1) is obtained based on (ei+1) calculated with respect to the message (M) and the signature component (Xi) by using a unidirectional function (f) and the signature component (Ei) which is taken over from the signer (i). Besides, the signature component (Yi+1) is calculated based on the signature component (Yi) which is taken over from the signer (i), secret information Si+1, the random number Ri+1 and (ei+1) and the signature component (Xi+1, Ei+1 and Yi+1) of the signer (i+1) with respect to M is transmitted to the next signer together with M. Thus, since the speed of the calculation of the unidirectional function is higher than the multiplication, the processing quantity of the signer can be reduced and the efficiency of the processing is improved.

Description

DETAILED DESCRIPTION OF THE INVENTION "Field of Industrial Application" This invention is applicable to approval/settlement of electronic documents, electronic voting systems, etc., in which multiple persons electronically sign/sign multiple documents on one document. This invention relates to a multi-digit signature method for attaching a seal.

“Prior Art” As a typical example of digital signature method, I? SA cryptosystem (R4vest, R, L, etal, ``8 Method for Obtaining Digit
al Signatures and Public-
KeyCryptosystems, Com
communications of the ACM
Vol, 21, No 2, pp, 120-
126. (1978)).

The R3A cryptosystem is as follows.

Signer A has a signature copper (d, N) and an inspection key (ei N
) is generated so that N=P×Q eXd3i (nod L) where L=LCM ((P-1), (Q-1,)) is satisfied, the verification key is made public, and the signature copper is Manage secretly.

Here, LCM (a, bl represent the least common multiple of integers a and b, and P and Q are two different large prime numbers. Also, a=b (mod L) means that a and b are multiples of L. represents that

The R3A cryptosystem is a cryptosystem whose security is based on the fact that it is difficult to decompose N into prime factors when N is large. It is difficult.

Authenticator B manages the user's test key (ei N) together with personal identification information (ID) and rol1 as a test key file.

signature function I] and verification function E as D (P) - Pd (mod N) E (C) = C'' (mod N), then E (D ( It can be shown that a (mod N
) represents the remainder when a is divided by N.

The digital signature method using the R3A cryptosystem is as follows.

Signer A generates a signature C with C=1) (f (M) ) by applying a secret signature function to f (M) generated from message M using one-way function f. A set of personal identification information ID, M, and signature C (IDi M, C)
is sent to authenticator B as a message.

Authenticator B searches the verification key file using the ID as a key, obtains the verification function E, obtains the decrypted text from signature C using E (C), and verifies whether it matches f (M) obtained from M. do.

If E (C) = f (M) holds, then only A knows D, so the source of M is A, and (IDi
It can be determined that M and C) have not been tampered with.

Here, a unidirectional function of f is a function in which it is easy to calculate f (x), but it is difficult to calculate X from f (x). f is a high-speed conventional encryption device, such as DBS encryption (Data Encryption 5 standard
Federal Information Process
ssingStandardsPublication
46, 1977). A specific example of the configuration is shown in FIG. With fast components, the computation time for f is almost negligible.

By the way, the integer N used in R3A encryption is usually decimal 200.
digit (512 bits), and the d component of the signature key is also 5
It will be about 12 people. Here, to calculate the signature function, even if we use the high-speed exponential calculation method, the multiplication of 200-digit integers (including remainder calculation by modulo N) is 76 on average.
This requires 8 times, and the amount of processing required for signature generation by sender A is large.

(The high-speed index calculation method is described, for example, in Ikeno, Koyama, "Current Cryptography Theory," Institute of Electronics and Communication Engineers, pp. 16-17, (19
86L. ) The Fiat and Shamir methods are methods that can solve the problem of increased signature processing by the signer (F
iat, A. and Shamir,
8: 'How to prove you
rself: practical 5olutio
ns to 1 dentification and
signature problems + Pro
ceedingsof Crypto 86 + 5a
Barbara, August 1986
+pp, 18-l-18-7).

The Fiat and Shamir digital signature schemes are as follows.

The trusted center provides secret information 5j (1≦
j≦k) (k is a parameter that determines safety, and has a value of 1 or more).

Calculate v,=f (IDij) (1≦j≦k) using the 5-tepl one-way function f.

3tep2: Calculate s J = 1177 to (mod N) using prime factors P and Q of N for each ■4. That is, S; ”−1/V J(
modN).

5tep3: Secretly issue Sj to the signer and disclose the composite number N.

The calculation of the square root in (mod N) is the calculation of the square root in (mod N), which is a prime factor of N (P
and Q) can be executed if you know them.

The method is described, for example, by Rabin, M.O.:lID
1g1talized Signatures and
Public-KeyFunctions as I
tractable as Factorizati
onTech, Rep, MIT/1. C5/TR-
212 Former T Lab, Compute.

Sci., 1979. A specific example of the configuration of a square root calculation device is a public key cryptographic system (patent application No. 61).
-169350).

Signer A generates a signature corresponding to message M using the following procedure. Here, t is a parameter that determines safety, and has a value of 1 or more.

5tepl: i=1. −, for t, the random number r
i and calculate x r −r r” (mod N).

5tep2: Create a bit sequence consisting of k
(at-1+"'+ et, k))-f (M,
XI, ..., xt).

5tep3: Signature text y8 as VI =rI nsJ (mod N)ell,・
Generate 1.

5step 4: A sends the signature (IDi (el, +, “', el+K) +”・+ to M along with the message M)
(et, +...+el2.k), y,..., yt
) is sent to certifier B.

Authenticator B sends the message (M, ID, (el, +, -CI
+K)+”Z (eL+1+”’l eL+k)
+3'1. ``', yt), the validity of the signature for message M is confirmed in the next step.

5 step 5: Vj −r (IDi j) (1
≦j≦k).

5tep6: i=1. ..., Zi=V for t
+211vJ (mod N)ei+j-1 is calculated.

5step7: i = 1. ..., about t (
(el+1=”'+ el, J+”・+ (eil
−”'+ et−k ) )−f (M, z
,..., Check that Z1) holds true.

From the method of making yi, Z i −yi ” n V ;=r , ” n (S
j”
od N )e (,j=1 689.H=1 Therefore, if the inspection is passed, authenticator B recognizes that the message has not been tampered with.

At this time, the probability that certifier B accepts the fake signature as correct is 1/2kt. Here, k is the number of secret information (Si) secretly managed by the user, and L defines the bit length of the signature component corresponding to the message M.

In the Fiat and Shamir systems, the signature process at the signer requires t(k+2)/2 multiplications (including the remainder calculation in modulus N) on average. In particular, the above F
In the literature of iat and Shamir, it is recommended to choose k=9 and t=8. In this case, the number of multiplications between Fiat and Shamir signature methods is 44, and R3
It can be seen that the amount of processing can be significantly reduced compared to the signature method using the A cipher (44/768 = 0.06, so it can be achieved with about 6% of the amount of processing).

[Problems to be Solved by the Invention] Here, we will consider applying the two methods described in ``2'' to a multi-signature system in which multiple signers sequentially sign signatures.

In the digital signature using the R3A cryptosystem, the message (I
Di M, C) is sequentially signed on the signature component C of (
That is, multiple signatures can be realized by Dl...D, (f (M))). On the other hand, if we simply apply the Fiat-3hamir method, for each signer, the message M is
(el, +, -, e+, *)+"'+(et, +,
``'et-K) + V +,...y1)'' is a direct method.Here, the e component is (tX
k) bits, y is 512 bits. When m signers sign sequentially, the final value is (bit length of ID +
512Xt+kXt)Xm bits of information in message M
added to. Even if t=i, it is about 70% for one signer.
0 hit information is added, and the large increase in the signature component becomes a problem (kxt=70.I]: l
) Assuming number of bits - 120).

An object of the present invention is to propose an efficient method that is fast and can reduce the redundancy of signature components in a multi-signature system 1 in which a plurality of signers sequentially sign signatures.

[Means to Solve the Problem J According to the invention of claim (1), the j-th signer j:
A random number (Ri) is generated and the signature component (X=1) inherited from the signer (i-1) and R8 are used to generate the signature component 1. (Xi)
At the same time, the one-way function f is used for the message (M) to be signed and the signature component 1 (Xi).
Find the signature component 2 (Bi) from the signer (i-1), and then calculate the signature component (Yi-1) inherited from the signer (i-1).
) and confidential information S.

The signature component 3 (Y, ) is calculated from the random numbers Ri and C0, and the signature component (X,, E.) of signer i for M is calculated.

Yi) along with M to the next signer (i+1).

According to the invention of claim (2), signatures are made in two rounds, and in the first round, the j-th signer i generates a random number Ri and uses the signature inherited from signer (i-1). Component 1 (Xi
−1) and R;Kal”>signature component 1 (Xi ) and send it to the next signer (i+1), and the m-th signer calculates the signature component] (Xm) as the first In the second round, the first signer i calculates signature component 2 using a one-way function for the message (M) to be signed and signature component 1 (Xi). (Ei), and furthermore, signature component 3 (Y
, 1), secret information S1, and random numbers Ri and El, signature component 3 is obtained.
Calculate (Yi), M, X.

and send it to the next signature @ (i + 1).

In other words, in this invention, the high-speed Fiat-5hamir
Based on the method, the value of the y component, which is the main component of the signature component, is accumulated for each signature processing, and the y component, which in the conventional method required as many y components as the number of signatures, is reduced to one y component. reduce,
Reduce the memory stars required to accumulate signature sentences. Specifically, in the case of claim (1), the signature components of the sequential multiple signatures of m people are kept in focus by (ID length + kXt)Xm + 512Xt, and approximately 200 bits of information are added for each signer. In the case of claim (2), the length of the ID is limited to Xm+kXt+512Xt, and the ID is
Only the number of bits in D increases.

"Example" Examples of the present invention will be described below.

Hereinafter, a case where t=1 is adopted in the Fiat-5hamir method will be explained. The same holds true even if t is set to a general value.

FIG. 1 is a diagram showing the overall configuration of a first embodiment of the present invention. A trusted center 100 has multiple stations (signers) 20
0,300. . . are connected via a secure communication path 400. Multiple signers 200, 300.・・・
. . are connected via an insecure communication path 500 and perform signatures sequentially. Assume that the last signer 600 and authenticator 800 are coupled via an insecure communication path 700.

Trusted center 100, signers 200, 300,
When ... joins the system, the directional function calculator 110, the reciprocal calculation device 115, and the square root calculation device 12 are sent to the signer using the ID as personal identification information in the following steps.
0, k゛ pieces of secret information S1 (1≦j≦k) are generated and distributed.

Figure 2 shows a block diagram of the center.

5tepl: r(IDi
, j) is determined and transferred to the reciprocal calculation device 115.

(An example of the configuration of 110 is shown in FIG. 3) Step 2: The reciprocal calculation device 115 calculates 1/f (IDi,j) mod N using the composite number N, and passes it on to the square root calculation device 120.

5tep3: The square root calculation device W120 uses the prime factors P and Q of the composite number N to calculate s, , 2El/f (I Da, j) (mod
Calculate and output Sa+j that satisfies N). (However, N
=P×Q, 1≦j≦k) A specific configuration example of a square root calculation device is shown in Public Key Cryptography System (Japanese Patent Application No. 61-169350).

5tep4: Deliver the secret information, the composite number N, and the function f to each signer via a secure communication path 400 (there is no risk of leaking the secret of the secret information). (For example, when the signer joins the network, it may be stored in an IC card and handed over.) Also, the composite number N and the function f are disclosed to the authenticator.

Below, the message output by signer 1 will be described as (M.

1+, Ei = (el+I%"+ eI+h),
Xi, Y+). Second signer 2 (3
00) processes the message output by signer 1 and signs it. In the following, the signer who sent the message to be signed is signer i, and the signer who performs the signature process is signer (j+1).
This will be explained as follows. If m people sequentially perform multiple signatures, the following procedure may be repeated by incrementing i from O to m-1 one by one. However, Io=Eo−φ (empty set)
, Xo =Yo =1.

The signer (i +, 1) uses the message (M, I, , Ei, Ei,,,Xi,,
.

Create yr, 1).

In the fourth session, the communication sequence of the message is shown in Figure 5.
+1) Block diagram of 300 is not shown.

5tepl: Random number R8, using the random number generator 310.

is generated and input to the multiplier with remainder 320 together with the public information N and the X1 component of the message to calculate X4-+ = RH4I2xx, (mod N).

5tep2: X, - as message M, T, component ID
,. , and manually enter the f-calculator 330 to calculate (e;-+,+,-,et-+,b)-f(M,I+
++, X;. 1) (where l,, −(I
f, lDi. 1)).

5tep3: Y, component of the message, R taken over from the random number generator 310, . . . r- taken over from the old counter 330 (ei.

ei+l+k) and 1(i1lil's secret information Si.

j and public information N, multiplier with remainder Enter 340 generates Y8,1.

5tep4: Bai+ = (Bit(ei+I+
1.・”+ eitl, l+ )), then (1,
,,,I B,,,,Xi. +, Y+, 1) as the signature component of M and is transmitted to the next signer (i+2).

The message (M, I, ,E
A procedure for receiving the message M (i, Y1) and authenticating that the signatures of m people have been correctly applied to the message M will be described (the x8 configuration is not required for the authentication process). It is assumed that the authenticator knows the synthetic WAN and the function f made public by the center.

A block diagram of the authenticator 800 is not shown in FIG.

5tepl: 1 of the correspondence. Component (-(I D,, -・
, IDm)) into the f-calculator 810, V3. J−f (IDi, j) (1≦a≦m, 1≦j
≦k).

5tep2: Y0 composition of correspondence + E m component (-(
(el+l,"'+ CI, 11)l"'l (
effl, l, "'ei, 1))), f-calculator 81
v,,,j inherited from 0 (1≦a≦m, 1≦j≦k
) and the public information N are input to the multiplier with remainder 820, and z,, -y,"XrT nva,J (mo
Calculate dN) aeitl-1.

5 step 3: Z taken over from the multiplier 820 with remainder
o, Message M and Correspondence 1. Input the components into the f-function calculator 830 to calculate f (M, I,
, Z1).

Step 4: (eyoe+n,k in the E□ component of the message)
) component and f subtracted from the f-function calculator 830
(M, l, , Z1) is manually entered into the coincidence checker 840 and (ell+1+”・+0m11+) = f (
M, L, , Zm). If the two values are the same, pass, otherwise, fail.
Output.

Here, each message (M, Ii, Ei
If Xi, Y1) is valid, then YH2X IDmVH, -Y, -+"XR;"
(mod N)e H, J=], so finally Z, I=Y, Xll IDm V, l+j
(mod N) a=le a, j=1 (mad N) (mod N) R, xRIDm-, X-XRz xR+ (m
mod N) 11R, EEXIDm a=1 (mod N) holds true and passes the test. In this way, since X-i is not used, it can be omitted.

Next, a second embodiment of the invention will be described. The center is configured similarly to the first embodiment. Just 1 for each signer (
In addition to the secret information SL, J, the composite number N, and the function f, the function f is also delivered.

The m signers create signatures by circulating the correspondence twice. Therefore, as shown in FIG. 7, m signers are connected in a linked manner by a communication path 500.

First, m signers rotate the message (X1) and calculate signature component 1 (Xi). Next, each signer uses the signature component 3 (Yi-1) output by the previous signer, depending on the ID of the m signers, the signature component (mod N) (X1), and the message m. The signature component 3 (Yi) is calculated by processing. In the following, the previous signer is referred to as a signer (the signer who performs i-IL signature processing is referred to as signer (i)). When m people sequentially perform multiple signatures,
The following procedure may be repeated by incrementing i by 1 from 1 to m. However, let X,=Yo=1.

First, the first trick will be explained. The signer (Xi-1) creates a message (x8) from the message (Xi-1) output by the signer (i-1) according to the following procedure, and sends it to the next signer (i=1). Send to. However, i=1. At −,m, signer,m,inherits,X,I,to signer,1,. Figure 7 shows the communication sequence of the correspondence, and Figure 8 shows the signer (i) (
300) is shown.

5tepl-4: Generate random @R4 using the random number generator 310, and calculate input (modN) to the multiplier with remainder 320 together with the public information N and the X +-+ component of the message.

Next, the second trick will be explained. Signer (i) receives the message (M, I-i) output by signer (i-1).

Create a message (M, I, , X, , Y1) from the signer (
i+1). Here, the IDs of m signers are I
, , Let M be the message to be signed. However, signer m inherits (M, I7.Ei, Y1) to authenticator 800.

5tep2-i: Input Xm together with message M and 11 components to h-calculator 330, and calculate Et-(e++...,eu)-h(M, I, , XIDm>).

(For example, I, -ID, . . . , IDm).

5tep3-i: Y8-1 component of the message, Ro inherited from the random number generator 310, h-(ei..., ek) inherited from the calculator 330, and k pieces of secret information S
i + j and public information N are input to a multiplier with remainder 340 to generate Y.

Finally, the authenticator 800 receives the message (M,
I,, , B, −(e+,・, (!h),
The following describes the procedure for receiving the message M (Yllll) and authenticating that m signatures have been correctly applied to the message M (note that the X component is not required for the authentication process). It is assumed that the authenticator knows the composite number N and the functions f and h published by the center.

FIG. 9 shows a block diagram of the authenticator 800. It has the same configuration as the first embodiment and performs the same processing.

That is, 5 tepl: 11 components of the message (= l DIDm))
is input into the r-calculator 810, and V,, J= f (l Di, j) (1≦i≦m1≦j
≦k).

step 2: Y, component, Ei component of the message, Vi, j inherited from f-calculator 810 (1≦i≦m, 1
≦j≦k) and the public information N are input to the multiplier with remainder 820 to calculate the following.

5tep3: 211. taken over from multiplier 820. Input the message M and the 10 components of the correspondence into the + calculator 830, h(M, 1.

Calculate Z□).

5tep4: The E11 composition of the message and h(M, I,, Z□) inherited from the h-calculator 830 are sent to the match checker 84
Input 0 and check that E yaw h (M, I, , Z1) is true. If the two values are the same, "pass" is output, and if they are different, "fail" is output.

Here, if each signature component (X1) and (Y1) are created according to the procedure, Y, "Xn V,, 4 C781 YH-, 2XR;" (mod N),
Finally, it should be noted that in the above description, the functions f and h may be distinguished or the same function may be used.

"Effects of the Invention" (1) Signer's Processing Amount Since the calculation of a one-way function is faster than multiplication, the signer's processing amount is compared using the number of multiplications (including remainder calculations by modulo N). - Method using R3A code when expressed in boat fishing: (31ogz N) / 2 times Fia
A method that simply applies t and Shamir's method: t
(k+2)/2 times In the present invention: t(k+6)/2 times. For example, if the safety level is 2-72, l
Method using R3A encryption when og2N -512 Near 68 times Method 3 of simply applying Fiat and Shamir's method
7 times (when k=72.f, =]) 108 times (when k=l, t=72) Present invention = 39 times (when k=72.t=1). It can be seen that in the present invention, the amount of processing can be significantly reduced compared to the method using R3A encryption, and can be realized with the same amount of processing as a method simply applying the Fiat-3hamir method.

(ii) Redundancy of correspondence In the sequential multiple signature method using R3A code, for each signature,
ID information is added to the message M (assuming that the signature components are Dl...D, (f (M))).

In a method that simply applies the Fiat and Shamir methods,
For each signature, send message M (IDm), (cl,・
...eu), y) information is added (however, 1.=
1).

In the first embodiment of the present invention, for each signature, the message M is
In the second embodiment, ID information is added to the information of IDi (ei, -., ei)) (assuming t = 1. In order to reduce the amount of processing, a new χX1 component is added. However, the authentication process requires X, X.

(Note that X and X□ are not subject to preservation because the components are unnecessary.)

Here, the number of hits of D (f (M)) is equal to the number of hits of N, and the number of hits of (eJ) is (k×t) hits,
The 1-number of X and Y is equal to the 1-number of N.

Comparing the number of bits that increases as a signature component when m signers make multiple signatures, when N is 512 bits, we can see that the R3A encryption is applied sequentially: Bit length of ID x m The Fiat-3hamir method is simply Applicable method: (I
Bit length of D + 512 Xt + kXt1)
2X T Hint Second Example: ID Hit Length x m +k X +, +512X
t hits.

For example, k×1. -70. If the number of hits in M) is -120, the number of bits increased by one signature is as follows: 120 hits 1-Fl-Flat
A method that simply applies the -5ha method Near 02 hits (assuming 1. = 1) 1st example: 190 hits (
However, the number of bits of the entire signature component when 120 hits (assuming t = 1) is m-10 is a method in which R3A encryption is applied sequentially: 1
A method of simply applying the 200-bit Fiat-3hamir method: % formula % First example: 2/112 hits Second example: 1782 hints are obtained. In the present invention, Fiat-Shamir
It can be seen that the amount of communication can be significantly reduced compared to a method that simply applies the method.

In the above embodiment, the explanation was based on the Fiat-3hamir method, but a higher-order version of the Fiat-5hamir method (Ota, Kaihon: "Higher-order extension of the Fiat-3hamir method"), IEICE Technical Report 15IiC88-13) can be used in the same manner.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the overall configuration of a first embodiment of the invention, FIG. 2 is a block diagram of the center 100 in FIG.
FIG. 3 is a block diagram showing an example of the configuration of the f-calculator, FIG. 4 is a diagram showing the communication sequence of the message of the first embodiment, and FIG.
The figure shows signers 200, 300. ..., FIG. 6 is a block diagram of the authenticator 600 of the first embodiment, FIG. 7 is a diagram showing the communication sequence of the message of the second embodiment of this invention, and FIG. 8 is a block diagram of the authenticator 600 of the first embodiment. Block Diagram of Signer in Embodiment FIG. 9 is a block diagram of a certifier in the second embodiment.

Claims (2)

[Claims] (1) In a multiple digital signature system in which multiple signers sign messages (M) sequentially, when a signer joins the system, the center collects the signer's personal identification information (
The secret information (S_i) corresponding to ID_i) is divided into a one-way function (f) and two prime numbers (P, Q
) and send it to the signers, and publish the product N (=P×Q) of the two prime numbers and the one-way function (f), and then calculate it from multiple signers (signer 1,..., Signer m) repeats the following operation from signer 1 to signer m, and the authenticator uses the center's public information (N, f) to obtain the signature component (E, f) received from the final signer. Y) Message (
M) and multiple signer IDs (ID_i, ..., ID_
If m) satisfies a predetermined verification formula, it is a multiple digital signature method that can confirm that a message signed multiple times by multiple signers has not been tampered with. The i-th signer i generates a random number (R_i) and uses the signature component (X_i_-_1) inherited from the signer (i-1).
) and R_i, and at the same time calculate signature component 1 (X_i) from the message to be signed (M) and signature component 1 (X_i
) for e_i calculated using the one-way function f and the signature component (E_i_-_
Find the signature component 2 (E_i) from 1), and then calculate the signature component (Y_i_-_1) inherited from the signer (i-1).
Signature component 3 is obtained from secret information S_i and random numbers R_i and e_i.
(Y_i) and signer i's signature component (
X_i, E_i, Y_i) with M to the next signer (i+
1) Send to. (2) In a multiple digital signature system in which multiple signers sign messages (M) sequentially, when a signer joins the system, the center collects the signer's personal identification information (
The secret information (S_i) corresponding to ID_i) is divided into a one-way function (f) and two prime numbers (P, Q
) and send it to the signers, and publish the product N (=P×Q) of the two prime numbers and the one-way function (f and h), and then calculate it from multiple signers (signer 1,...・, signer m) repeats the following operation from signer 1 to signer m, and the certifier uses the center's public information (N, f and h),
Signature component 2 (E_m), signature component 3 (Y_m), message (M), and multiple signer IDs (ID_i, ..., ID_m) received from the final signer m use a predetermined verification formula. A multiple digital signature method that can confirm that a message (M) signed multiple times by multiple signers has not been tampered with. In the first round, the i-th signer i generates a random number (R_i) and signs the signature component 1 (inherited from signer (i-1)).
Signature component 1 (X_i) is calculated from In the second round, the i-th signer i creates signature component 2 (E_i) using a one-way function h for the message (M) to be signed and signature component 1 (X_m). Then, signature component 3 (Y_
Signature component 3 (Y_i) is calculated from i_-_1), secret information S_i, random numbers R_i and E_i, and is sent to the next signer (i+1) along with M and X_m.