JPH03103961A - Digital multisignature system using id information - Google Patents

Abstract

PURPOSE:To make it unnecessary to change the number of method of residues in each user and to attain digital multisignature requiring plural signatures whose forgery is impossible by using the number of method of residues obtained from two primes which are sufficiently large values and a number found from personal secret informa tion, personal identification (ID) information and a disclosed ID information. CONSTITUTION:A central control means 101 controls the number (n) of 1st method of residues regulated by two primes which are sufficiently large values and the number of 2nd method of residues which is an exponential value '1' obtained by raising an optional value to be a prime to a power and a remainder is found out by the number of method of residues of the product of the inverse of the personal secret information PWi and the inverses of the personal ID information IDi and disclosed ID information IDc to calculate the signature information Si. A certificator SIGi is formed from the personal secret information PWi inputted from the signatory (i) of a current termi nal 102 and signature information Si, the formed certificator SIGi is applied to a certificator obtained from the terminal 102 of the preceding signatory i-1 and the added certificator is sent to the decidor's terminal 103. Consequently, it is unnecessary to change the number of method of residues in each user and the digital nultisignature requiring plural signatures whose forgery is impossible can be attained.

Description

[Detailed Description of the Invention] [Summary] Regarding a digital multiple signature device that allows multiple people to sign signatures, it is not necessary to change the modulus of the remainder for each user, and signatures cannot be forged. The aim is to realize digital multiple signatures that are as close to possible as possible and easy to manage for each user.Multiple signers sign multiple signatures on communication information and send it to the approver, and the approver receives the communication information. In the digital multiple signature system that verifies the signature of each signer, the first remainder modulus number, which is the product of two sufficiently large prime numbers, and an arbitrary number that is coprime to it on the modulus number. and the second remainder modulus number, which is an exponent value that becomes 1 when raised to the power of the number of
A reciprocal number obtained from personal secret information that is 78 prime with respect to the second modulus of the second remainder corresponding to each signer, personal identification information having a similar relationship, and the second modulus of the second remainder with each other. and the reciprocal obtained from the prime public identification information.
By taking the remainder by the modulus of the first remainder, signature information is calculated and provided to each corresponding signer, and the modulus of the first remainder, each personal identification information, and the public identification information are calculated. and a center management means for disclosing the modulus of the second remainder, and a communication with an authentication code from the previous signer's terminal in each terminal to be operated by each signer. a first compression conversion means for compressing and converting information; and multiplying the output of the first compression conversion means by the product of the personal secret information input by the signer of the current terminal and the signature information, and 1
An authentication code for the signer of the current terminal is created by calculating the remainder with the modulus of the remainder of If there is a terminal, the first exponent remainder calculation means sends the information to the terminal; if not, the first exponent remainder calculation means sends it to the terminal to be operated by the approver, and the received authentication is stored in the terminal to be operated by the approver. Among the child-attached communication information, the authentication code-attached communication information to which the authenticator of the signer immediately before the signer whose signature is to be verified is added is compressed and converted, and the compression conversion means has the same characteristics as the first compression conversion means. The output of the second compression conversion means is multiplied by the personal identification information of the signer who wants to confirm the signature input by the approver and the second compression conversion means, and the output of the second compression conversion means is multiplied by the first remainder. a second exponentiation remainder calculation means for calculating a remainder by the number of exponentiations; If the outputs of the third power remainder calculation means that calculates the remainder modulo 1 and the outputs of the second and third power remainder calculation means match, the authenticator identifies the correct signer. and a discriminating means for discriminating that it has been added by.

[Industrial application field]

The present invention relates to a digital signature device using cryptographic technology,
More specifically, the present invention relates to a digital multiple signature device that allows multiple people to sign signatures.

9 10 [Conventional technology] Documents handled in the office, such as approval documents and purchase request slips, are
Approval from multiple people is often required for approval. In the case of current paper documents, they are lined up with a date stamp or seal stamped on them.

Incidentally, with the advancement of office automation, it has become possible to issue slips and approve slips on personal computer terminals. In this case, an alternative to traditional signatures and seals is required. When signing a digital signal, a digital signature technology based on encryption technology is used because it can be easily copied. The requirements for digital signature technology are that the signer cannot deny the fact of the signature after signing, and that the person verifying the signature cannot forge it. There are three points: it is impossible for a third party to forge it. Sign multiple signatures on it,
In other words, when performing multiple signatures, even if the number of signers increases, there is a need for a digital signature system that does not increase the number of signature blocks and allows easy verification of signatures.

Conventional digital signature systems will be explained in the order of the case of a single person's signature and the case of multiple people's signatures.

First, FIG. 5 shows a conventional digital signature system performed by a single person. In this example, a digital signature is applied when sending a message from sender i to receiver j.

The sender receives the message (plaintext) M from the i side, uses the secret key k common to the i side and the j side, and converts it to the compression conversion function h(*) at 501.
is used to obtain S=h (M).

Next, using the i-side private key kls of the RSA encryption, 502
The decoding process SIGi=D(h(M))=S"'(mod
ni) and send the signature (authenticator) as SIGi.
Send to the side.

Here, "rx(mod y)" or "rxmody" is
It is an operation to find the remainder when X is divided by the modulus number y of the remainder,
The same shall apply hereinafter. The sender also discloses the public key kip and the modulus number ni of the remainder.

On the j side, the received message M is used as a common secret key klj
is used, compression conversion TI=h(M) is performed in 503 and output
Get I.

Further, for the authenticator SIGi, using the public key ki2, cryptographic processing T2=SIG,"p(mod nl
) is performed 11 12 to obtain output T2.

Then, when TI and T2 match in 505, it is assumed that the signature is correct.

Note that the CFB mode of the DES algorithm is used as the compression conversion technology in 501 and 503. Also, the modulus number n1 of the remainder is the product of large prime numbers Pt+Qi, K+s
*Ktp=1 mod LCM (Pt 1+Qt 1)
shall be. However, LCM (x, y) is x. This is an operation to find the least common multiple of ay, and the same applies hereafter.

Next, a conventional digital signature system by multiple people will be explained using FIG. 6. Here, the above-mentioned digital signature method using the singular number is used as a base, and the digital signature method is stacked in series.

For the sake of simplicity, we will use the signatures of k people from i=1 to i=k.
The case where the values are calculated sequentially starting from i=1 will be explained.

First, the sender with i=1 sends the message M that he wants to sign using the private key klj shared by the sender with i=1 and the approver j (the person who confirms the signature), as in the case of FIG. is compressed using a compression conversion function hO), and H+=h(M). i
The previous sender uses his own private key kls to perform a modular exponentiation operation on the above Hl on the modulus nl of the remainder, as in the case of Fig. 5, and writes a signature text (authenticator) SIG+=H,''' mod
Find n. Then, this authenticator SIG1 is added to the message M and sent to the next signer i=2. The above operation is shown in STEP 1 in FIG.

Subsequently, the sender of i=2 sends SIG to the above message H.
, is added (expressed as 'M llsIG+J)
is considered to be a message, and the same operation as in the case of i=1 is performed. In other words, the common secret key k2j of the sender of i=2 and the approver j
Then, compress using the compression relation (*), o2=h (M
ItSIG+). The sender of i.2 uses his own private key k's to perform a modular exponentiation operation on the above H2 on the modulus n2, and obtains the authenticator SIG2=H2k2' mod
Find n2. Then, this authenticator SIG2 is added to the message M II SIG, and the message M II SIG.
II SIG2 and send to the next signer i23.

The above operation is shown in STEP 2 in FIG.

Hereinafter, similar operations (operations up to STEPk in FIG. 6) are performed for each signer from i=3 to i=k.

On the other hand, confirmation of each signature (authenticator) I3 1 4-SIG+ (i=1 to k) of the multi-signed message described above by approver j (corresponding to j in Fig. 5) is performed as follows. It will be done.

That is, any authenticator SIG. (i = any one of l to k), message MI before srci
IsIG,II SIG2 II...IsIGt is the common secret key kij of the signer i and the approver j, and compression conversion T1=h(M 11 SI
GI II SIG2 II...IIsIGI-1)
and obtain the output T1.

On the other hand, for the authenticator SIGI, the public key kip is used to perform cryptographic processing T 2 =SIGi''(
mod n+) to obtain output T2.

Similarly to 505 in FIG. 5, it is assumed that the signature is correct when T1 and T2 match.

Note that, as in the case of FIG. 5, the above compression technique includes DE
The CFB mode of the S algorithm is used.

Also, for i=1 to k, the modulus number n1 of the remainder is a large prime number p+. The product of qi, kls*klp=1 mod
Let it be LCM(Pt-+, Q+-+).

[Problem to be solved by the invention]

However, the above-mentioned conventional example has a problem in that if the signer claims that the private key kis was stolen after signing the message and the signature was signed, the recipient cannot deny this.

Further, for each signing party i=1 to k, a private key kis, a public key k, . ．． , it is necessary to store the corresponding modulus number n of the remainder. In particular, it is necessary to change the modulus number nt for each signing party. This is because RSA cryptography is a cryptosystem whose strength is based on the fact that ni, which is a product of large prime numbers, cannot be easily factorized, but a user with a pair of private key k1s and public key klp has the same From the public key k' (zero is arbitrary, the same applies hereinafter) on the modulus ni of the remainder, the corresponding private key k's is set to n. This is because it can be easily determined without factoring it into prime factors. this is,
For example, the literature: J. M. DeLaurentis, “A.
FURTHER WEAKNESS INTHE C
OMMON MODULUS PROTOCOL FO
R THE RSA CRYPTOALGQTITHM
,” CRYPTOLOGIA, vol.8,
No. 3, July 1983.

1 5 - 16 Therefore, it is necessary to change the modulus nl for each user, and it is necessary to prepare n{ for each signing party, which poses a problem in that management is difficult.

An object of the present invention is to realize a digital multiple signature that does not require changing the number of remainder moduli for each user, makes it nearly impossible to forge a signature, and is easy to manage for each user.

[Means to solve the problem]

FIG. 1 is a block diagram of the present invention. In the present invention, a plurality of signers of communication information 44-k multiplexly sign their signatures and send them to the approver, and the approver receives the communication information H and confirms the signatures SIGI-SIGk of each signer. This assumes a digital multiple signature method.

First, the center management means 101 calculates the first remainder modulus number n defined by the product of two sufficiently large prime numbers p and q, and any number that is coprime to it on the modulus number. Cross over l
The second remainder modulus number L, which is the exponent value, is managed. For example, n and L satisfy. Here, LCM is an operation for finding the least common multiple.

Then, the center management 101 stage 101 stores personal secret information PW that is disjoint with the second remainder modulus L and corresponds to each signer. Similarly, the reciprocal number PWI-' obtained from
and public identification information that is disjoint with the modulus L of the second remainder ■
The signature information S is obtained by taking the remainder by the second remainder modulus L for the product of the three numbers of the reciprocal IDC-' found from Dc.
．． Calculate. That is, calculate. This is then provided to each corresponding signer.

The center management means 101 also controls the number n of moduli of the first remainder.
, each personal identification information ID. and the public identification information IDC are made public, and the modulus number L of the second remainder is kept private.

Next, in the terminal 102 to be operated by each signer, a first compression conversion means 105 and a first exponentiation remainder calculation means 1 are installed.
It has 04. Although FIG. 1 shows the terminal 102 of signer i, the same applies to each of the terminals 102 of other signers 1 to k.

The first compression conversion means 105 converts the communication information M II to which the authentication code from the terminal 102 of the previous signer i-1 is added.
SIGI I1...llsIG+-+ is compressed and converted.

That is, for example, if h is a hashing function, +1i=
(M If SIG+ II...ll SIGt -
I) ...(Calculate 0. Note that the current terminal 1
If 02 is the signer 1, the communication information H is compressed and converted.

The first power remainder calculation means 104 calculates the personal secret information PWt input from the signer i of the current terminal 102 and the signature information S1.
The output Hi of the first compression conversion means is multiplied by the product of , and the remainder is calculated by the modulo number 0 of the first remainder to create the authenticator STGI of the signer i of the current terminal 102.

That is, Calculate.

Then, the first exponentiation remainder calculation means 104 converts the authentication code SIGi into communication information M i SIG, I1・to which the authentication code from the terminal 102 of the previous signer i-1 is added.
...IIsIG. In addition to Tsukasa, M II SIG,
II...11SIG. and the next signer's terminal 102
If there is, send it to the terminal, if not (in case of signer k),
It is sent to the terminal 103 of the approver.

Next, in the terminal 103 to be operated by the approver, there is a second compression conversion means 106, second and third exponentiation remainder calculation means 1.
07 and 10B, and a discrimination means 109.

The second compression conversion means 106 converts the received authentication code-attached communication information M II SIG, II... of the signers 1 to k.
・Among 11sIGh, the communication information with the authentication code to which the authentication code of the signer immediately before the signer whose signature is to be verified is added is compressed and converted, and the same characteristics as the first compression conversion 105 stages are performed. be. That is, for example, if the signer whose signature you want to verify is i, using the same hashing function h as described above, 1{,=h(M11SIG+ll=llSIGt-+)
--- Calculate (e).

19 20 The second exponentiation remainder calculation means 107 outputs the outputs H, . is raised to the power, and the remainder is calculated using the modulo number n of the first remainder.

That is, for example, if the signer whose signature is to be verified is i, the personal identification information ID1 is used to calculate .

The third power remainder calculating means 108 powers the authentication code of the signer whose received signature is to be verified by the public identification information ■Dc inputted by the approver, and calculates the modulus of the first remainder. Calculate the remainder with n. That is, for example, if the signer whose signature is to be verified is i, the following is calculated using the authenticator SIGN.

Then, when the respective outputs TI and T2 of the second and third exponentiation remainder calculating means 107 and 108 match, the determining means 109 determines that the authenticator being verified, for example, SIGI, has been added by the correct signer. Discern.

In the above structure, the public identification information IDC is, for example, the identification number of the center management means, but it may also be a product obtained by multiplying the number of the signature information Si, the date of issue, etc.

In addition, the public identification information IDC is omitted, and the personal secret information PW
It may be a combination of only I and personal identification information ID1,
In this case, the third power remainder calculation means 108 in FIG. 1 can be omitted.

Similarly, by omitting the personal identification information IDi, the personal confidential information P
It is also possible to combine only Wt and the public identification information IDC; in this case, the second exponentiation remainder calculation means 107 in FIG.
can be omitted.

On the other hand, if the first and second compression conversion means 105 and l06 perform compression using a common secret key between the signer and the approver, security will be further improved.

Note that the second and third exponentiation remainder calculation means 107 in FIG.
and 108 may be shared by one switchable exponentiation remainder calculation means (not shown).

[For production]

The authenticator SIGi added by the first exponent remainder calculation means 104 of the terminal 102 of signer i in FIG. 1 will be considered below.

First, from equation (a), H. mod n 4 - -
-(h) holds true.

On the other hand, from equation (b), if we set (y represents the quotient obtained by dividing the left side by L), -liI
L * V ” S i ) m o d nH,
``ymad n -H,S' mod n- -
・(i) becomes. Here, from equation (h), H4''' mod n = 1, so from equation (i), the following holds.Therefore, equation (d) above becomes 54G,=H,
PWlmIDc IDi'IPI'IIIlod
nH, IDcmlDl mOdn. ．． ．． (j
).

Therefore, the authenticator added by the correct signer i satisfies the above equation (j).

Therefore, when the third lJ power remainder calculation means 108 of the approver's terminal 103 in FIG. 1 performs the above-mentioned calculation (g) 2,
The output T2 is the authenticator SIG. based on the correct signature. As long as is input, from (g), (j)2, 72=H%D
c *IDI* Summer” mod nH,”’
mod n...(k).

On the other hand, T1 outputted from the second power remainder calculation means 107 via the second compression conversion means 106 is
), but since the characteristics of the first compression conversion stage 105 and the second compression conversion means 106 are the same, if the communication information is sent correctly, in equations (C) and (e), Hl- H, stands. Therefore, equation (f) is: 23 24 T1-Hl1Dl modn
・ ・ ・(i).

If the determining means 10 determines that T1=T2 from the relationship between equations (k) and (j2), it can be determined that the authenticator SIGI was added by the correct signer i.

Here, the number of remainder modulus required at the time of signature by each signer 44 to k (at the time of correcting the authenticator) and at the time of signature confirmation by the approver is only one type, which is the number n of the first remainder modulus. good. Since the center management means 101 does not disclose the second remainder modulus L, even if the signature information S1 is stolen, the first remainder modulus Since the personal secret information PWI etc. cannot be known from the number 0, it is almost impossible to forge the authenticator SIGi, and the security is extremely high.

In this case, each signer uses signature information S. In addition to personal identification number rD+, it is only necessary to manage personal secret information PWi such as an easy-to-remember password, and there is no need to manage the number of modulus of remainder for each user as in the conventional case, so management by each user is easy. becomes easier.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

Figure 2(a). (b). (C) is a structural diagram of an embodiment of the present invention.

FIG. 2(a) is a diagram showing the structure of the center 201. FIG.

The PWjD test registration circuit 202 tests whether the personal identification number IDt input by the user i satisfies the conditions described below, and outputs a G signal (Good) if the conditions are satisfied.
It is registered in the registration information file 203.

If the conditions are not met, an NG signal (No Good
) and waits for re-input. Further, the same process is performed for the password Plt1 input by the same user i.

In the secret information calculation circuit 204, the registration information file 203
The reciprocal of the password PW, registered in , is obtained and registered in the registration information file 203.

Also, the center 225 26 01 independently generates the center identification number IDC, and checks it in the Pld, ID registration circuit 202. If it passes, it is registered in the registration information file 203, and then the secret information calculation circuit 204 performs IDC processing.
The reciprocal of is calculated and stored in the registration information file 203.

The center's IDC is published along with each user's IDi and the modulus number n of the remainder (described later).

When the center 201 receives a request for the signature information SI from the user i, the center 201 calculates the signature information St using the data stored in the registration information file 203 and the center secret file 205 to obtain the signature information St. Issue to user i.

Registered in the registration information file 203 are a personal identification number ID+, a corresponding password PWi and its reciprocal, a center identification number IDC and its reciprocal, and public information n.

The center secret file 205 contains prime numbers P. Q, LLCM
(p-1, q-1) is stored.

Each user's ID+. The IDc and n of the center are disclosed, but the PWi, its reciprocal, and the reciprocal of the IDC are not disclosed as secret information.

FIG. 2(b) shows the signature device 20 of a user who creates a signature.
This is a diagram showing the structure of No. 7.

When user i inputs the transmission message M and the common secret key KiJ for information compression, the compression conversion circuit 208
Data H+ is obtained by compressing and converting the message M.

Further, when the user i inputs the secret password PIt11, the signature information S issued by the center, and the public information n, the exponentiation remainder calculation device 209 calculates the authenticator SIGi.

The control circuit 201 controls the above processing. The circuit is
After the signature is completed, SIGi is added to the message, and if a signature is required, the message is sent to the next user, and if the signature is completed by the user, it is sent to the user j who is the approver.

FIG. 2(C) is a block diagram of a user signature verification device 211 that performs signature verification.

Check the arbitrary authenticator SIG+ (+ = any one of 1-k) of the message with authenticator for the received signature 2
7 28 First, the signature verification device 211 is
The messages up to (when i=1, only the message M), the personal identification number IDi of user i, and the common key KiJ for creating compressed information are input.

Then, the compression conversion device 212 compresses and converts the messages up to STG+ - + to obtain H. Further, via the switching circuit 213, a power remainder calculation unit N214 performs a power remainder calculation on Hr using ID1 as the width number and modulus n to obtain confirmation information T1.

Next, the authentication code SIGf is inputted to the power remainder calculation device 214 via the switching circuit 213, and the power remainder calculation is performed on SIGt with the center identification number IDC as the width number, modulo n, and confirmation information T2 is obtained. sell.

TI, T2 are stored in each storage device 215, 216,
Thereafter, a comparison device 217 and a determination circuit 218 check whether they match. If they match, a G (Good) signal is output, and if not, an NG (No Good) signal is output. The control circuit 219 controls the above processing.

The operation of the embodiment shown in FIG. 2 will be described below.

First, as a first step, the meeting name information distribution operation will be explained. This operation consists of the following processes ① and ②.

■ Center 20 in Figure 2 (a) that manages k users
1, a personal identification number ID.1 consisting of a name, date of birth, etc. is sent from user i (i=1 to k). and password PW, are registered.

In the center 201, 25
Generate large prime numbers p and q of about 6 bits, and n”p.q
...(1) L = L
CM (p-1, q-1)...
・Calculate (2). I), Q, and L are secret information of the center 201 and are stored in the center secret file 205.

On the other hand, n is made public.゛Next, Pl1, ID test registration circuit 202 (Fig. 2 (a)
)), IDi and PW registered from user i
For each I, first, it is checked whether it is disjoint with the secret information L and whether it satisfies the following equation (3L (4)).

1<ID+<L...(
3) 29 30 1<PW+<L
・ ・ ・(4) If the above conditions are satisfied, ID.
and P.W. The registration information file 203 (Figure 2 (a))
Register.

In addition, the center 201 creates a center identification number Dc by a means not particularly shown, and the PW, ID test registration circuit 202 performs a test similar to that for the above-mentioned IDI, and if it passes, a registration information file is created. 203
will be registered. Additionally, the IDC will be made public.

■ The center 201 sends the requested user i (11 to k
) is distributed with the signature information Sl shown in the lower part.

S+= IDc-'ID+-PW+-' mod
I-...(5) However, IDC-' and Pltl
It is assumed that l-' satisfies the following conditions.

IDC・IDC-' = 1 mod L
・・16) PI1li・PW+-' = 1 m
odL 14 ~k)...(7) Here, the above (6)
Reciprocal IDcPI1l. that satisfies equations and equations (7). -' is
The secret information calculation circuit 204 shown in FIG. 2(a) performs the calculation.

The above equation (5) is then calculated by the signature information calculation circuit 206 of FIG. 2(a).

The result of the above operation at the center 201 is shown as 201 in FIG.

Next, as a second step, the operation of multiple signatures will be explained. Here, a method is shown in which k users t (i=1 to k) perform multiple signatures on a communication message H using the signature device 207 shown in FIG. 2(b). Each user i (i
-1 to k) are sent to the center with ID. , and PWi have been registered, and signature information SI and public information n have been obtained. Furthermore, each user i and user j have a common key k+j (i=
1 to k) are shared. The operation here consists of the following processes (■, ■, ■, ■).

(2) User 1 compresses and converts communication message M using a secret common key k+j between user 1 and approver j in compression conversion circuit 208 shown in FIG. 2(b).

The information obtained as a result is assumed to be H1. The compression conversion function h
0), then H,=h(M).

Subsequently, in the exponentiation remainder calculation device 209, using the signature information S of the user 1 and the secret password PW,
The authenticator SIG for the signature is calculated as shown in the following equation 31 32 .

SIG+= (H+sI mod n)"' mod n
- (6) From the above formulas (1) to (4), H'moclL = 1.
17), and from equation (5), ID.・ID.・Piano singing -L-y+S+.

Here, y is the quotient when the left side is divided by 17. From this, 1 1Dc *lD{*PWi mod n= 1
, (L*V″Sil mod n=H″ymod
n − H+” mod n. By substituting equation (7) into the above equation, the following holds true. Therefore, the above (6)
The formula is SIG, = (HrIDc ilDi*PW
i mod n) PWI mod nH! DC"'
mod n...-(8).

Note that, as in equation (6) above, in order to prevent overflow, the remainder calculation is performed by dividing each exponent of each exponent.

■ The authentication code SIG+ obtained in this way is added to the message as a signature, and MI SIG. Transfer to the next user 2 as shown below.

The operation result of the signature device 207 related to the user 1 described above is shown as 207 related to the user 1 in FIG.

(2) User 2 regards the message MIISIG, to which user 1's signature has been added, as a telegram, and performs the same operations as user 1. That is, as in the case of user 1, user 2 converts the message MIISIG, into a compression function using the common secret key K2j between user 2 and user j, who is the approver, in the compression conversion circuit 208 of FIG. 2(b). compressed using h0),
Suppose H2=h(M 11 SIG+). Subsequently, the user 2 enters the user 2's signature information S2 and the secret password Plt! in the exponentiation remainder calculation device 209. 2, perform the power remainder calculation on the above H2 on the modulus n of the remainder, and calculate the above
Similarly to formula 6) → formula (8), authenticator SIG2H 2
Find 1 D c * I D 2 mod n.

Then, send this authenticator SIG2 to message M ISIG
In addition to 2, as shown in Fig. 3, < M II SIGI I
I SIG2 and send it to the next user 3.

33 34 The above operation result of the signature device 207 related to the user 2 is shown as 207 related to the user 2 in FIG.

(2) Similarly, each user's authentication code is added to each message, and signatures are performed up to user k. The operation of any user i during the process is as follows based on the process of (1) or (2) described above.

User i receives the message M II sent from user i-1 in the compression conversion circuit 208 of FIG. 2(b).
SIG, l SIG2 I1...llsIGt-
+ is compressed and converted using the secret common key kiJ between users LJ, and o,=h (M IISIG+ll...llsIG
t-+).

Next, in the exponentiation remainder calculation unit W209, using the signature information SN of the user i and the secret password PWi,
The authenticator SIGi for the signature is calculated according to the following formula.

SIG+=(Hi” mod n) ”’ mod n
・- ・(6)'Similar to the above equation (6) → equation (8), SIG+=81"c"" mod n
...18) 'Add the authenticator SIGi obtained in this way to the message as a signature, and
SIG+ II...lsIG1 as the next user i+
Send to 1.

As a result of the above signature operations from user 1 to user k, a message M IIsI with each user's authenticator is created as shown in Fig. 3.
GII+...llsIGk is obtained and sent to user j who is the approver.

Finally, in the third step, user j receives the above message from user i (i4-k) and receives any authenticator SIG5 (
The procedure for confirming whether or not i=l to k) is a correct signature will be explained. The operation here is represented by the process (2) below.

(2) User j inputs an arbitrary authenticator SIG. (Any one from 44 to k)
When checking the SI of the received communication message.
Message M before G+ IIsIG, I1...l
lsIGt-+ is compressed and converted using the secret common key k1 between users 1+j. Let the information obtained as a result be H. If the compression conversion function is h(0, }1,=h(M
II SIG. I+...llsIG+) becomes.

35 36 The above H, is input to the exponentiation remainder arithmetic unit 214 via the switching circuit 213 in FIG. 2(C), and here, for H,
A modular exponentiation operation is performed using the IDi of the other user, and an authentication code T1 for signature verification is determined as shown in the following equation, and is stored in the storage device 215.

TI = Hr”' fflod n
(9) Next, the exponentiation remainder arithmetic unit 214 performs an exponentiation remainder calculation on the authenticator SIGi via the switching circuit 213 using the center ■Dc, and the exponentiation remainder arithmetic unit 214 performs an exponentiation remainder calculation on the authenticator SIGi via the switching circuit 213. is determined by the following formula, and is stored in the storage device 216.
is stored in

T2-SIGfIDcmodn...00) Here, if the signature is correct, the above 00) formula is obtained from the above formula (8)' as T2 = HI"" mod n
...(If). And, Fig. 2(b) and (C
) of the compression conversion circuits 208 and 212 of the compression conversion function h(
*), the above equation 01) and the above equation (9) become equal, and TI=T2.

Therefore, the comparison device 217 and the determination circuit 21B compare and determine T1 and T2 of the storage devices 215 and 216 (FIG. 2(C)), and if they match, the authenticator SIG input from the user i
It turns out that i is the correct signature.

The operation result of the signature verification device 211 for user j is shown as 211 in FIG. 3.

To summarize the above operations, user (i)
Using the signature information (Si) from 1, the input message is compressed and converted (UZ), and the result is a modular exponentiation operation and used as an authentication code (SIGi) for the signature. The resulting authenticator SIGi is the compressed information (H.) of the message multiplied by the signer's identification number (IDi) and the reciprocal (IDc-1) of the center 201's identification number (IDc) as an exponent. It is calculated.

To confirm the signature (user j), compress the message received in the same way as the signer (L), perform the exponentiation using the identification number (IDi) of the signer (i), and use the received authenticator. It is sufficient if the remainder obtained by multiplying (SIGH) by the IDC of the center matches.

According to the above embodiment, since the center does not disclose the modulus L of the remainder, even if the signature information Si is stolen, from the relationship (5) 2 mentioned above, each User password PW. etc., because it is not possible to know
Signature (authenticator) SIG. cannot be forged. Therefore, unlike the conventional example, there is no need for the user to change the modulus n of the remainder.

Additionally, since it is impossible to create an authenticator without the center's signature information, if the authenticator is lost or stolen, it is possible for the sender to notify the center as soon as possible. It is difficult to deny the fact that it was sent.

Furthermore, it is easy to change the order of multiple signatures and to confirm the fact of signatures.

FIG. 4 shows the results of a comparison between the above embodiment and the conventional example based on FIGS. 5 and 6 described above regarding multiple signatures and the data necessary for their confirmation.

In the conventional example, the private key k of each user i (i = 1 to k)
In addition to the public keys ls to kks and the corresponding public keys klp to kkp, the number of moduli of remainders n1 to n, , dedicated to each user for performing the exponentiation remainder calculation, was required. In particular, as described above, n1 to nn need to be different for each user as large prime numbers, making it difficult to determine and manage them.

In contrast, in this embodiment, each user i issued by the center
In addition to the signature information Sl-Sk for (i = 1 to k), the corresponding public key ID, ~IDk (signing side), and center identification information IDC (approval side), the modulus of the remainder It is sufficient that there is only one type of n. Also, each user needs to manage passwords PW1 to PWk as private keys, but these do not need to be large prime numbers like the modulus of the remainder, and can be any number as long as it is approved by the center. , management by each user can be performed easily. Even if the signature information S1 to Sk is stolen, the password Pill-PW
Unless k is known, signatures cannot be forged, and security is extremely high.

In the above embodiment, IDC-
' is used, but as a second example, in addition to this,
By multiplying the signature by the reciprocal of information such as the date and expiration date or the reciprocal of the signature issue number, it is possible to issue signature information 39 40 with the issue date and time or with the issue number.

In the first and second embodiments described above, the signature device 20
7. In order to obtain the authenticator SIGi, the compression conversion circuit 208 converts the message M using the hashing function h (book) and converts the message H. is used as input. In addition to the above, the compression conversion circuit 208 may not be provided and any predetermined value may be used as H. However, it is assumed that Hl and the modulus n of the remainder are relatively prime. In this case, on the signature verification device 211 side, the compression conversion circuit 212 is not necessary, and the predetermined value It, (-H,) is subjected to a modular exponentiation operation with respect to the modulo n using ID, as an exponent, and T1 is obtained. do it. The method for determining T2 is the same as in the previous embodiment.

〔Effect of the invention〕

According to the present invention, there is no need to change the number of residual moduli for each signer, and even if signature information is stolen, it is impossible for a third party other than the approver or the communication party to forge the signature (authenticator). Not only this, but it also becomes possible to create a signature text (certifier) in which the fact of communication by the signer cannot be denied.

In this case, each signer only needs to manage personal secret information such as an easy-to-remember password in addition to signature information and personal identification number, which are relatively unguarded. Since there is no need to manage even the number of rules, each user can easily manage the number of rules.

Furthermore, if the issue number, issue date, etc. of the signature information are used as the public identification information, the information can be grasped by the center management means, and a more strict digital signature becomes possible.

[Brief explanation of drawings]

Fig. 1 is a block diagram of the present invention; Fig. 2 (a), (b), and (C) are structural diagrams of embodiments of the present invention; Fig. 3 is an explanation of the principle of the embodiment of the present invention. 4 is a comparison diagram of signatures and data necessary for their confirmation, FIG. 5 is a composition diagram of a conventional example, and FIG. 6 is an explanatory diagram of multiple signatures. 41 42 101 ・ 1 02 ・ 103 ・ 1 0 4 ・ 1 05 ・ 1 06 ・ 1 07 ・ 1 08 ・ 109 ・ Center management means, signer's terminal; approver's terminal, first exponentiation remainder calculation means, First compression conversion means, second compression conversion means, second power remainder calculation means, third power remainder calculation means, discriminating means.

Claims (1)

[Claims] 1) A plurality of signers (i=1 to k) multiplexly sign the communication information (M) and send it to the approver, and the approver receives the communication information (M). In the digital multiple signature method that verifies the signature of each signer, the first
Manage the number of moduli of the remainder (n) and the number of moduli of the second remainder (L), which is the exponent value that becomes 1 when raised to the power of any number coprime to the modulus. and personal secret information (
PW_i), personal identification information (ID_i) with a similar relationship, and public identification information (ID_c) that is disjoint with the second modulus number (L).
) and the product of three numbers, the signature information (S_i) is computed and corresponds by taking the remainder by the second remainder modulus number (L). the number of moduli of the first remainder (n
), each of the personal identification information (ID_i) and the public identification information (ID_c) are made public, and the modulus of the second remainder (
L) is a center management means (101) which is kept private, and communication information with an authentication code from the previous signer's terminal (102) is stored in each terminal (102) to be operated by each signer. The first compression conversion means (105) performs compression conversion, and the first
The output (H_i) of the compression conversion means of
2) Create a signer authenticator (SIG_i), and
It is added to the communication information with the authenticator from the previous signer's terminal (102) and sent to the next signer's terminal (102) if there is one; 1
03), and a first exponentiation remainder calculation means (104) that sends the information to the terminal (103) to be operated by the approver to confirm the signature of the received authentication code-attached communication information. a second compression and conversion means (106) having the same characteristics as the first compression and conversion means (105) for compressing and converting communication information with an authentication code to which an authentication code has been added up to the signer immediately before the signer who wants to sign;
Then, the output (H_r) of the second compression conversion means (106) is multiplied by the personal identification information (ID_i) of the signer whose signature is to be confirmed, inputted by the approver, and the output (H_r) of the second compression conversion means (106) is I would like to confirm the signature received using the second exponentiation remainder calculation means (107) that calculates the remainder using the modulus number (n) of the remainder and the public identification information (ID_c) entered by the approver. a third exponentiation remainder calculation means (108) for exponentiating the signer's authentication code (SIG_i) and calculating the remainder by the modulus number (n) of the first remainder; Each output (T1, T2
) match, determining means (10) determines that the authenticator (SIG_i) has been added by a correct signer.
9) A digital multiple signature system using ID information, characterized by having the following. 2) In a digital multiple signature method in which multiple signers sign the communication information multiple times and send it to the approver, and the approver receives the communication information and confirms the signatures of each signer, the signature is sufficiently large. The first remainder modulus is the product of two prime numbers of the value, and the second remainder modulus is the exponent value that is 1 when raised to the power of any number coprime to the modulus number. and the reciprocal obtained from personal secret information that is coprime to the second modulus number of the second remainder corresponding to each signer, and personal identification information having a similar relationship. On the other hand, by taking the remainder with the modulus of the second remainder, signature information is calculated and provided to each corresponding signer, and the first modulus of the remainder and the personal identification information are disclosed. and a center management means for keeping the second remainder modulus private; and a center management means that stores communication information with an authentication code from the previous signer's terminal in each terminal to be operated by each signer. The output of the first compression conversion means is multiplied by the product of the personal secret information input by the signer of the current terminal and the signature information, and the first compression conversion means performs compression conversion. An authentication code for the signer of the current terminal is created by calculating the remainder with the modulus of the remainder, and is added to the communication information with the authentication code from the previous signer's terminal to create the authentication code of the next signer. If there is a terminal, the first exponentiation remainder calculation means is sent to the terminal, and if not, it is sent to the terminal to be operated by the approver, and the received authentication code is stored in the terminal to be operated by the approver. One of the signers whose signatures you want to confirm among the communication information with
a second compression conversion means having the same characteristics as the first compression conversion means for compressing and converting the communication information with the authentication code to which the authentication code of up to the previous signer has been added; and the signature inputted by the approver. a second exponentiation remainder calculation means for exponentiating the output of the second compression conversion means by the personal identification information of the signer to whom confirmation is desired, and calculating the remainder by the modulo number of the first remainder; ID characterized in that it has a determining means that determines that the authenticator has been added by the correct signer when the output of the means matches the authenticator of the signer whose signature is to be verified. Digital multiple signature method using information. 3) In a digital multiple signature method in which multiple signers sign communication information multiple times and send it to an approver, and the approver receives the communication information and confirms the signatures of each signer, the signature is sufficiently large. The first remainder modulus is the product of two prime numbers of the value, and the second remainder modulus is the exponent value that is 1 when raised to the power of any number coprime to the modulus number. and a reciprocal number obtained from personal secret information that is coprime to the second modulus number corresponding to each signer, and a public identification that is disjoint to the second modulus number. The signature information is calculated and provided to each of the corresponding signers by calculating the remainder by the modulus of the second remainder for the product of the two numbers of the reciprocal obtained from the information, and the first a center management means for disclosing the number of moduli of the remainder and the public identification information, and keeping the number of the second modulus of the remainder private; a first compression conversion means for compressing and converting communication information with an authenticator from the signer's terminal; and the first compression conversion by the product of the personal secret information input by the signer of the current terminal and the signature information. The output of the means is multiplied and the remainder is calculated by the modulus of the first remainder to create an authentication code for the signer of the current terminal, and an authentication code from the previous signer's terminal is attached. a first exponentiation remainder calculation means that is added to the communication information and sent to the next signer's terminal if there is one, or to a terminal to be operated by the approver if not; In the terminal to be operated, one of the signers who wish to confirm the signature of the received communication information with authentication code.
a second compression conversion means having the same characteristics as the first compression conversion means for compressing and converting communication information with an authentication code to which an authentication code of up to the previous signer has been added; and a third exponentiation remainder calculation means for exponentiating an authentication code of a signer whose signature is to be verified using identification information, and calculating a remainder by a modulo number of the first remainder; The ID information is characterized in that it has a determining means for determining that the authenticator has been added by a correct signer when the respective outputs of the compression converting means and the third exponentiation remainder calculation means match. Digital multiple signature method. 4) The digital multiple signature system using ID information according to claim 1, wherein the second and third power remainder calculation means are shared by one switchable power remainder calculation means.