KR100349418B1 - Method for preventing abuse in blind signatures - Google Patents

Abstract

The present invention relates to a method for preventing abuse of a hidden signature. The present invention provides a complete anonymity guarantee by a conventional concealed signature that allows a signer to perform signatures without recognizing the contents of the message. Based. The present invention consists of the prevention of the abuse of hidden signatures based on the segmentation selection method, and the prevention of the abuse of hidden signatures by one-time duplicate transmission based on the discrete algebra problem. Can be minimized.

Description

{METHOD FOR PREVENTING ABUSE IN BLIND SIGNATURES}

The present invention relates to a hidden signature technique for generating a signature without knowing the contents of a message used for a special purpose, and more particularly, to prevent a dysfunction caused when anonymity is ensured by the hidden signature technique. It is about a method of preventing abuse of hidden signatures that can revoke anonymity.

With the development of information and communication network, various information is exchanged through network. When a sender wants to deliver a valuable message through an e-mail or electronic document delivery system, the sender needs to check whether the right recipient has received the right information, and from the recipient's point of view, the message creator is the right sender. Mechanism is needed. As one of the methods for effectively providing such a function, an electronic signature method using a public key cryptographic system in which each user has a secret key and a public key as two key information is used.

Public key cryptography systems are also referred to as asymmetric cryptography methods, which use a pair of keys, a key for encryption and a key for decryption. In a public key encryption system, information encrypted with any arbitrary key can be decrypted only by a corresponding key, and thus it is widely used because it proves the identity of the document creator and secures the confidentiality and integrity of the message.

Referring to FIG. 1, a process of performing a general digital signature using the aforementioned public key encryption system is illustrated.

First, the electronic signature scheme begins with step 11 of generating a message to be signed at the sender side. The message sender generates a signature value for the message to be sent using its private key (step 12), and sends the generated message and signature value to the recipient (step 13). The receiver performs signature verification using the sender's public key to verify that the message sent from the sender and the signature value were sent by the creator of the legitimate message (step 14). In the signature verification process, if the verification result is not the same, the reception is rejected or a retransmission is requested (step 15).

Based on the above-mentioned digital signature scheme, there are signature techniques that are applied to special purposes. One of them is a cryptographic protocol in which a signer joins a message sender and a received message. Is proposed. In the concealment signature scheme, a message sender must be able to receive a message-signature value pair signed by the signer without leaking information about the message sent, and furthermore, the signature that the signer recognizes while performing the signature protocol is signed. It shall not be possible to link the message-signature value pairs resulting from the protocol to each other. 2 is a flowchart illustrating the conventional hidden signature method described above.

First, the sender generates a message to be signed (step 21), generates a hidden element with an arbitrary random number to conceal the message (step 22), and sends the hidden message to the signer (step 23).

The signer who receives the hidden message from the sender then generates a signature value for the hidden message using its private key and sends the hidden signature message to the sender (step 24).

The sender calculates the signature value for the original message from the hidden signature message received from the signer using the original hidden element (step 25), and verifies the signature using the message and the signature and the sender's own public key. (Step 26). In the signature verification step, the sender rejects the reception or requests retransmission if the signature verification results are not the same (step 32).

The above-mentioned concealed signatures are mainly adopted in an electronic cash protocol that satisfies the anonymity of the customer, and are used to protect the cashier's identification information or implement an electronic voting protocol that prevents linkage between the voter's identification information and the contents of the vote. It has been used mainly. Most of the concealed signature schemes presented so far provide complete impossibility of being able to be connected with the message-signature value pairs that are the result of the signature protocol and the contents recognized by the signer during the signature protocol.

Since such a hidden signature satisfies the sender's complete anonymity, when used in an electronic cash system, a message sender may illegally change a message or a session identifier (ID) to receive a legitimate signature value. In order to prevent such a problem, a method of preventing abuse of a hidden signature has been proposed, which can withdraw the sender's anonymity if necessary, unlike a hidden signature.

The method of preventing abuse of hidden signatures is a protocol using cut-and-choose, which was presented at 1995 Eurocrip '95 International Conference by Steadler et al. The sender of the message, the signer that signs the received message with its own private key, and the message to be forwarded using its public key, and then the content and message-signature value pairs that the signer has recognized over the protocol. It consists of three members of a trusting organization that perform the function of providing information that enables them to connect.

The abuse prevention method of the concealed signature includes the signature protocol and the connection recovery protocol performed between the three members. The signature protocol refers to a procedure in which a message sender and a signer participate, and a message sender obtains a legitimate signature value while preventing the signer himself from linking a message-signed value pair to a message signed by the signer. The recovery protocol refers to a procedure by which signer and relying authority can obtain information from the relying authority to enable the signer to associate the message-signature value pair with the contents recognized by the protocol.

There are two types of techniques to prevent the abuse of these hidden signatures. The first type, given the recognition on the signer's protocol, conveys information that allows the relying party to recognize the corresponding message-signature value pair. The second type, given a message-signature value pair, conveys information that enables the signer to recognize the sender of the message.

3 illustrates a flowchart illustrating the conventional concealment scheme described above.

First, the message sender and the signer agree on the session identifier in advance and perform the following process. The system parameters used in the description below are defined as follows.

(n, e) represents the signer's public key, where n = pq is the product of two large prime numbers p and q, and e is (n) = (p-1) (q-1) is an integer having a sweeping relationship with each other.

E _J (.) Refers to the encryption process of a public key cryptosystem of a trusted authority.

H is a one-way hash function, and k is a stability variable (eg k> 20).

First, the message sender selects 2k random strings or random numbers α _i and β _i , encrypts the message m and the session identifier (ID) to 2k using the public key of the trust authority, and 2k random numbers ( r _i ) is used to conceal the 2k encrypted messages m _i and send them to the signer (steps 31 and 32).

The message signer then selects a randomly corresponding set k of 2k messages received from the sender and sends it to the message sender to verify the sender's message (step 33).

The message sender sends k information r _i , u _i , β _i necessary for verification of the k hidden message sets s sent from the message signer (step 34).

The message signer uses the information received from the message sender for k randomly selected messages to confirm that the message was correctly concealed using Equation 1 for all i in the set (s) and then the remaining k hidden messages. In step 35, the signature value b is transmitted to the message sender using the signer's own private key.

The sender of the message calculates the signature value s for the original message by using the random numbers generated by the signature value b received from the signer as shown in Equation 3 below (step 36). The calculated signature is (s, T) and T = {(a _i , v _i ) } to be.

Thereafter, the message sender verifies the signature by performing a calculation as shown in Equation 4 below to validate the signature (step 37).

Then, if the confirmation is not satisfied, the reception can be rejected or a retransmission can be requested (step 38).

In the method of preventing the abuse of hidden signatures using the partition selection scheme illustrated in FIG. 3, the probability that the message sender obtains a valid signature value by forging a message m or a session identifier ID is overwhelming depending on the stability variable k. There is a small chance. However, the hidden signature abuse prevention technique using this segmentation selection method is inefficient to apply due to the excessive amount of data exchanged on the signature protocol and the length of the signature value.

In addition, full anonymity by concealment signatures can be misused by criminals, especially in the electronic cash system using the concealment signature technique, providing full anonymity for cash withdrawals makes it impossible to interconnect cash withdrawal procedures and payment procedures. The attacker can then use it to complete extortion or money laundering. As a result, in the implementation of a practically applicable electronic cash protocol, if the anonymity of the user needs to be revoked for a legal reason, there is a need for a technique for preventing abuse of a secret signature that enables the user to withdraw it with the help of a trusting authority.

Therefore, the present invention has been made to solve the above problems, and an object thereof is to provide an effective method for preventing abuse of a hidden signature that can be used in a safe and practical electronic payment system and an electronic voting system.

The method of preventing abuse of a hidden signature according to the present invention includes: On the signer side, an evidence value ( ) (here, Is Is a random number satisfying Z _q = {0 _,. . . q-1}, q being public information), and transmitting to the message sender; At the message sender side, encrypting the transmission message m with the public key y of the trusted authority to generate an encrypted message e (e = E _J (m)); On the sender side of the message, the evidence value ( Concealment information (r) necessary for concealing the encrypted message (e) (Where α and β are each ( ) Wow ( Generating a random number that satisfies On the message sender side, the encrypted message e is concealed using the hidden information r to generate a hidden message A, and the encrypted message e and the hidden message A are stored. Sending to the signer; On the signer side, a signature value (1) is used for the secret message (A) using a signer's own private key (x). ) Generating and transmitting the generated message to the message sender; At the message sender side, the signature value ( A signature value (s, r) signed by a signer for the transmission message m from Determining; At the message sender side, verifying a signature value (s, r) of the signer.

According to another embodiment of the present invention, a method for preventing abuse of a hidden signature may include: On the signer side, an evidence value ( ) (here, Is Is a random number satisfying Z _q = {0 _,. . . q-1}, q being public information), and transmitting to the message sender; At the message sender, encrypting a session identifier (ID) of a signature protocol with a public key (y) of a trusted authority to generate an encrypted session ID (m) (m = E _J (ID)); On the message sender side, concealment information (r) necessary for concealing the encrypted session ID (m) (Where α and β are each ( ) Wow ( Concealed random message) and concealed the transmission message m using the generated concealed information. Generating and transmitting to the signer; On the signer side, a signature value (1) is used for the secret message (m ') by using a signer's own secret key (x). ) Generating and transmitting to the message sender; At the message sender side, the signature value ( A signature value (s, r) signed by a signer for the transmission message (m) Determining; At the message sender side, verifying a signature value (s, r) of the signer.

1 is a flow chart illustrating a general digital signature method of the prior art;

2 is a flowchart illustrating a conventional concealment method;

3 is a flowchart illustrating a conventional concealment signature method;

4 is a block diagram illustrating a relationship between components for performing a method for preventing abuse of a hidden signature according to the present invention;

5 is a flowchart illustrating a first embodiment of a method for preventing abuse of a hidden signature according to the present invention;

6 is a flowchart illustrating a second embodiment of the method for preventing abuse of a hidden signature according to the present invention.

<Description of the symbols for the main parts of the drawings>

40: message sender 50: signer

60: trust authority

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Figure 4 illustrates the relationship between members performing protection against abuse of hidden signatures, i.e., message senders, message signers, and trust authorities, in accordance with the present invention.

The message sender 40 and the message signer 50 generate a message using a message signing protocol, and sign the generated message.

The trust authority 60 receives the contents recognized by the message sender 40 by participating in the signature protocol, decrypts the received recognition contents with the private key of the trust authority, and transmits them to the message signer 50 so that the signer can sign them. Performs a first type (I) connection recovery protocol that allows the message (m) to be known.

In addition, the trust authority 60 receives the message-signature value pairs (m, r, s) of the message sender 40 provided from the signer 50, and confirms the validity of the signature from the received message-signature value pairs. Then, the second type (II) connection recovery protocol performs a second type (II) of decrypting the message (m) with the private key of the trusted authority and sending it to the signer 50 so that the session identifier (ID) of the sender 40 can be known.

Hereinafter, the method of preventing the abuse of the first type (I) and the second type (II) of the hidden signature performed between the three members of the message sender, the signer, and the trust authority shown in FIG. 4 will be described in detail as follows.

Referring to Fig. 5, a flowchart illustrating a method of preventing abuse of a first type (I) hidden signature is illustrated.

First, the signer 50 is any random number (Where Z _q = {0,..., Q-1} and q is public information), and the evidence value ( ), Then calculate the evidence ) And the evidence value is transmitted to the message sender 40 only when the following Equation 6 is satisfied through the verification process using the greatest common divisor relationship between the public information (p, q). At this time, if the verification result does not match, the process of generating a new random number and evidence value is repeated until the verification is made (step 51).

In Equation 5, g represents public information.

In the next step 52, the message sender 40 checks whether the message value m (7) is satisfied by verifying using the greatest common factor with respect to the evidence value received from the signer 50. ) Is encrypted with the public key y of the trust authority 60 as shown in Equation 8 to calculate the encrypted message e.

In the next step 53, the message sender 40 is a random string Wow Then, the concealment information r necessary for concealment is calculated as in Equation 9 below.

Thereafter, the above-described arbitrary strings (α, β), concealment information (r), and evidence values only when the following equation (10) is satisfied by verification using the greatest common divisor. ), The encrypted message e is concealed to generate a first hidden message e 'and a second hidden message e ″ as shown in Equations 11 and 12 below.

In step 53 the encrypted message e, the first and second hidden messages e 'and e e generated by the message sender 40 are sent to the signer 50 (step 54).

In a next step 55, the signer 50 receives the encrypted message e, the first and second hidden messages e ′ and e ′ sent from the message sender 40, thereby sending the message sender. In order to check the hidden information of (40), after checking whether the following Equation 13 is satisfied, the protocol ends if different.

However, if the above equation is satisfied, the value signed for one hidden message selected by the signer's own secret key (x), for example, the first hidden message ( ) Is calculated and transmitted to the message sender 40 (step 56).

In the next step 57, the message sender 40 determines the signature value sent from the signer 50. (S) (see Equation 15 below) and (r) are determined as values signed for the original message using random numbers generated by the user.

Then, the message sender 40 performs a signature verification process through the following procedure. First, the encrypted message e is calculated using the public key y of the trust authority 60 as shown in Equation 16 below, and the following Equation 17 is verified from the message-signature value pair s and r. (Step 58).

In order to recover the type I connection described above, the signer 50 transmits (e) to the trust authority 60, which is the content recognized by participating in the signature protocol, and the trust authority 60 transmits from the signer 50. The recognized recognition content (e) is decrypted with the private key of the trusted authority and provided to the signer 50. Accordingly, the signer 50 can know the message m signed by the signer 50.

Referring to Fig. 6, a flowchart illustrating a method of preventing abuse of a second type (II) hidden signature is illustrated.

First, the signer 50 is any random number that is a hidden element. (Where Z _q = {0,..., Q-1} and q represents public information), and the evidence value ( ) Is calculated and transmitted to the message sender 40.

At this time, the signer 50 transmits the evidence value to the message sender 40 only when the following Equation 19 is satisfied through the verification process using the greatest common divisor as follows whether the calculated proof value is correct, but the verification result is identical. Otherwise, the process of generating new random numbers and evidence values is repeated until verification is made (step 61).

In the next step 62, the message sender 40 checks whether the evidence value received from the signer 50 satisfies the following equation (20) by verification using the greatest common factor, while the session identifier ( ID) is encrypted with the public key y of the trust authority 60 to calculate the encrypted session ID m as shown in Equation 21 below.

In addition, the message sender 40 can be any string or random number. Next, the first concealment information r is calculated as shown in Equation 22, and the first concealment message m 'concealing the message m is calculated using the calculated first concealment information r. Equation 23), and again, the second concealment information ( ), And the calculated second concealment information ( ) Is used to generate a second hidden message m &quot;

At this time, the first and second concealed messages m ′ and m ″ generated by the message sender 40 check whether the first and second hidden messages m ′ and m ″ satisfy the following Equation 26, and then to the signer 50. Is sent (step 64).

In a next step 65, the signer 50 receives the encrypted session ID m, the first and second hidden messages m ′ and m m sent from the message sender 40, thereby receiving the message. In order to check the hidden information of the sender 40, it is checked whether the following Equation 27 is satisfied, and if not, the protocol is terminated.

Otherwise, if the above Equation 27 is satisfied, the signature value signed for one of the two hidden messages, for example, the first hidden message, is used by the signer's own secret key (x). (See Equation 28 below) is then sent to the message sender 40 (step 66).

In the next step 67, the message sender 40 determines the signature value sent from the signer 50. ), The signed values (s, r) (see Equation 29) for the original message are determined using random numbers generated by the user.

Thereafter, the message sender 40 performs a signature verification procedure using Equation 30 below (step 68).

For the type II connection recovery described above, the signer 50 transmits the message-signature value pair (m, r, s) received from the message sender 40 to the trust authority 60, and the trust authority 60 The validity of the signature is verified from the message received from the message sender 40 and the signature value pairs m, r, and s. If the message is justified, the message m is decrypted with its own private key and provided to the signer 50. Accordingly, the signer 50 can know the session identifier ID from the message m signed by the signer 50.

Therefore, according to the method for preventing the abuse of the hidden signature according to the present invention, when the security variable k is assumed to be 20 in the case of using the partition selection method of the prior art, a total of 80 encryptions and 40 public keys e are performed at the sender side of the message. Exponential and hash operations on modular n by n, and multiplication on 20 modular ns, and on the signer side, exponential and hash operations on modular n by 20 public keys e, and 20 modular Multiplication on n must be done.

However, using the method of the present invention, only one encryption, exponential multiplication on four modular p, and multiplication on nine modular q are made on the message sender side. On the signer side, only nine multiplications on modular q need to be performed.

In addition, in terms of traffic volume, when the partitioning scheme is used, a value of about 100 Kb should be transmitted when the stability variable k is assumed to be 20 and n is 1 Kb. And Less than 2Kb is sufficient for the transmission of.

Third, considering the length of the signature value, in the case of the prior art split selection technique, the signature value is (s, T = {(a _i , v _i ). }, About 40 Kb is required. However, in the present invention, since the signature value is composed of (r, s), only a total of 1 Kb is required, so that the amount of data may be smaller.

Claims (10)

In the method of preventing the abuse of hidden signatures, On the signer side, the evidence value ( ) (here, Is Is a random number satisfying Z _q = {0 _,. . . , q-1}, and q represents public information) and transmits the message to the message sender; At the message sender side, encrypting the transmission message m with the public key y of the trusted authority to generate an encrypted message e (e = E _J (m)); On the sender side of the message, the evidence value ( Concealment information (r) necessary for concealing the encrypted message (e) (Where α and β are each ( ) Wow ( Generating a random number that satisfies On the message sender side, the encrypted message e is concealed using the hidden information r to generate a hidden message A, and the encrypted message e and the hidden message A are stored. Sending to the signer; On the signer side, a signature value (1) is used for the secret message (A) using a signer's own private key (x). ) Generating and transmitting the generated message to the message sender; At the message sender side, the signature value ( A signature value (s, r) signed by a signer for the transmission message m from Determining; At the message sender side, verifying the signer's signature value (s, r). The method of claim 1, wherein in the generating the hidden message (A), in order to prevent unauthorized alteration of the message (m) at the signer side, the message sender sends the hidden message (A) to two first hidden messages (A). e ') ( ) And the second hidden message (e ″) ( Method of preventing the abuse of a hidden signature, characterized in that the generated by. The method of claim 2 wherein the method is: On the signer side, in order to confirm the validity of the message sender The method of preventing abuse of the hidden signature further comprising the step of performing the verification. The method of claim 1 wherein the signature verification step is: Using the public key y of the trusted authority, the cryptographic message e is Perception); Using the pair of the recognized encryption message (e) and the determined signature value (s, r) The method of preventing abuse of a hidden signature, characterized in that it comprises the step of verifying that the satisfactory. The method of claim 1, wherein the method further comprises the step of recovering the link to verify the message (m) signed by the signer. At the signer side, providing the recognized cryptographic message (e) to the trusted authority; At the trusted authority side, decrypting the received cryptographic message (e) using the private key of the trusted authority and transmitting it to the signer. In the method of preventing the abuse of hidden signatures, On the signer side, the evidence value ( ) (here, Is Is a random number satisfying Z _q = {0 _,. . . q-1}, q being public information), and transmitting to the message sender; At the message sender, encrypting a session identifier (ID) of a signature protocol with a public key (y) of a trusted authority to generate an encrypted session ID (m) (m = E _J (ID)); On the message sender side, concealment information (r) necessary for concealing the encrypted session ID (m) (Where α and β are each ( ) Wow ( Concealed random message) and concealed the transmission message m using the generated concealed information. Generating and transmitting to the signer; On the signer side, a signature value (1) is used for the secret message (m ') by using a signer's own secret key (x). ) Generating and transmitting to the message sender; At the message sender side, the signature value ( A signature value (s, r) signed by a signer for the transmission message (m) Determining; At the message sender side, verifying the signer's signature value (s, r). 7. The method according to claim 6, wherein in the concealment message generating step, in order to prevent unauthorized alteration of a message at the signer side, the message sender has another concealment element (r ') ( ) And another concealment message m ″ (using the second concealment element r ′) The method of preventing abuse of a hidden signature, characterized by generating a). 8. The method of claim 7, wherein the method is: On the signer side, in order to confirm the validity of the message sender The method of preventing abuse of the hidden signature further comprising the step of performing the verification. 7. The method of claim 6 wherein the signature verification step is: The method of preventing abuse of a hidden signature, characterized by verifying that the following equation is satisfied. 7. The method of claim 6, wherein the method further comprises a step for connection recovery that enables the signer to know the session identifier from a message signed by the signer itself. At the signer side, providing the transmission message (m) and the signature value (s, r) to the trusted authority; Verifying the validity of the signature from the transmission message (m) and the signature values (s, r) at the trusted authority side, and decrypting the message (m) with the private key of the trusted authority and transmitting it to the signer. The abuse prevention method of the hidden signature, characterized in that.