KR102307483B1 - Forward secure sequential aggregate signature method and apparatus thereof - Google Patents

Abstract

An omni-directional secure signature method and apparatus for supporting sequential combining are disclosed. An omni-directional secure signature method supporting sequential combining includes the steps of (a) selecting a j-th random value used to sign _{a j-th message (M j ) at a current time point (t);} (b) generating a j-th signature for the j-th message (M _j ) using the j-th random value and a t _{j-th secret key for the j-th message (M j} ) at the current time point (t) step; (c) generating a j-th integrated blind variable value using the j-th random value and the integrated blind variable value up to a previous time point; and (c) generating a combined signature by sequentially combining at least some of the signatures of the previous time points and the j-th signature, wherein the j-th combined blind variable value can be used to verify the validity of the combined signature. have.

Description

Forward secure sequential aggregate signature method and apparatus thereof supporting sequential binding

The present invention relates to an omni-directional secure signature method and apparatus for supporting sequential combining.

In recent years, various embedded system devices use forward-secure signatures to store the performance record of the device and to authenticate its validity. The forward secure signature technique is a signature method that minimizes the damage caused by leakage of the private key by making it impossible to create a signature for a past point in time even if the current private key is leaked. That is, the forward safety signature technique is a signature technique in which signatures are separately created for each cycle, and the validity of the signature before the current cycle is maintained even if the signature corresponding to the current cycle is leaked.

In this regard, the conventional prior art 1 "A forward-secure digital signature scheme (Mihir Bellare and Sara K Miner)" first proposed a forward secure signature scheme, and the prior art 2 "A new forward-secure" Digital signature scheme (Michel Abdalla and Leonid Reyzin)" proposed a forward stable signature scheme based on factoring. In addition, in the prior art 3, "Practical forward secure sequential aggregate signatures (Di Ma)", a technique for verifying by combining the signatures generated in each cycle into one signature was proposed, and the prior art 4 "FAS" : Forward Secure Sequential Aggregate Signatures for Secure Logging (Jihye Kim, Hyunok Oh)" proposed a technique to increase the security of combined signatures.

However, in the prior art 3, only one signature for one message is generated in each cycle, an update must be performed after the signature is made, and the security of the generated combined signature is not secure.

In addition, in the prior art 4, only one signature can be made per cycle, and after signing, it has to be automatically updated, and there is a problem that a combined signature can be created except for the current cycle.

An object of the present invention is to provide an omnidirectional secure signature method and apparatus for supporting sequential combining that can sequentially combine signatures generated at each time point.

In addition, the present invention may provide an omni-directional secure signature method and apparatus for supporting sequential combining that can guarantee security not only for each signature but also for sequentially combined combined signatures.

In addition, the present invention may provide a forward-safe signature method and apparatus for supporting sequential combining capable of verifying the validity of signatures included in the combined signature through one-time verification of the combined signature.

According to a preferred embodiment of the present invention to achieve the above object, there is provided a method for sequentially combining each of the signatures generated by the forward secure signature technique.

According to an embodiment of the present invention, in the omni-directional secure signature method supporting sequential combining, (a) selecting the j-th random value used for signing _{the j-th message (M j ) at the current time point (t)} to do; (b) generating a j-th signature for the j-th message (M _j ) using the j-th random value and a t _{j-th secret key for the j-th message (M j} ) at the current time point (t) step; (c) generating a j-th integrated blind variable value using the j-th random value and the integrated blind variable value up to a previous time point; and (c) generating a combined signature by sequentially combining at least some of the signatures of previous time points and the j-th signature, wherein the j-th combined blind variable value is used for validation of the combined signature. An omni-directional secure signature method supporting sequential combining characterized in may be provided.

_{The step (b) further comprises the step of deriving a backward security deterministic variable value (E j} ) using the maximum number of messages (n) and the index (j) of the message, wherein when the j-th signature is generated, A result value (c) of inputting the backward security fixed variable value (E _j ) and the j-th message (M _j ) into a one-way hash function may be further used.

The method may further include verifying by determining whether the backward security fixed variable value (E _j ) matches the result of applying the one-way hash function j times and the information (D) included in the public key.

The j-th random value may be calculated using the j-th integrated blind variable value and the (j-1)-th integrated blind variable value and used to verify the joint signature.

The j-th signature is generated by the following equation,

는 제j 랜덤값을 나타내고,

는 제t 시점의 비밀키를 나타내며, N은 랜덤하게 선택된 두 소수(prime)의 곱에 의해 생성된 합성수 그룹의 최대값이다. here,

represents the jth random value,

denotes the secret key at the t-th time, and N is the maximum value of a group of composite numbers generated by the product of two randomly selected primes.

In a computing device performing a forward secure signature method supporting sequential combining, selecting a j-th random value used for signing _{a j-th message (M j ) at a current time point (t), the j-th random value} and a j-th signature for the j- _{th message (M j} ) is generated using the t _{j-th secret key for the j-th message (M j} ) of the current time point (t), and the j-th random value and the previous a signature generator for generating a j-th integrated blind variable value using the integrated blind variable value up to the time point; and a signature combiner configured to sequentially combine at least some of the signatures of previous time points and the j-th signature to generate a combined signature, wherein the j-th combined blind variable value is used to verify the validity of the combined signature. A computing device may be provided.

_{The signature generating unit further calculates a forward security fixed variable value (E j} ) using the maximum number of messages (n) and the index (j) of the message, wherein the backward security fixed variable value (E _j ) and the A result value (c) of inputting the j-th message (M _j ) into the one-way hash function may be further used when generating the j-th signature.

It may further include a signature verification unit that verifies the j-th signature by determining whether the backward security determination variable value (E _j ) matches the result of applying j times to the one-way hash function and the information (D) included in the public key. have.

The signature verification unit may calculate the j-th random value using the j-th integrated blind variable value and the (j-1)-th integrated blind variable value and use it for the j-th signature verification.

The backward security determination variable value (E _j ), the j-th integrated blind variable value, and the (j-1)-th integrated blind variable value may further include a combined signature verification unit for verifying the combined signature.

It further includes a secret key updater for updating the secret key using the t _j secret key, wherein the secret key updater may be updated whenever a signature for a message is generated.

By providing an omni-directional secure signature method and apparatus supporting sequential combining according to an embodiment of the present invention, signatures generated at each time can be sequentially combined.

In addition, the present invention can guarantee security not only for each signature but also for sequentially combined combined signatures.

In addition, the present invention has an advantage in that the validity of the signatures included in the combined signature can be verified through one-time verification of the combined signature.

In addition, the effects of the present invention are not limited to the above-described effects, and it should be understood to include all effects that can be inferred from the configuration of the invention described in the detailed description or claims of the present invention.

1 is a diagram illustrating a conventional omni-directional safety signature technique.
2 is a flowchart illustrating an omni-directional secure signature method supporting sequential combining according to an embodiment of the present invention.
3 is a diagram illustrating pseudo code for signature generation according to an embodiment of the present invention;
4 is a diagram illustrating pseudo code for generating a joint signature according to an embodiment of the present invention;
5 is a diagram illustrating a pseudo code for an initial key setting process according to an embodiment of the present invention;
6 is a diagram illustrating pseudo code for generating a signature for a unified blind variable according to an embodiment of the present invention;
7 is a diagram illustrating pseudo code for verifying a signature according to an embodiment of the present invention;
8 is a diagram illustrating pseudo code for verifying a joint signature according to an embodiment of the present invention;
9 is a diagram illustrating a pseudo code for verifying a signature for a unified blind variable according to an embodiment of the present invention.
10 is a diagram illustrating a pseudo code for updating a secret key according to an embodiment of the present invention.
11 is a block diagram schematically illustrating an internal configuration of a computing device according to an embodiment of the present invention.

As used herein, the singular expression includes the plural expression unless the context clearly dictates otherwise. In this specification, terms such as “consisting of” or “comprising” should not be construed as necessarily including all of the various components or various steps described in the specification, some of which components or some steps are It should be construed that it may not include, or may further include additional components or steps. In addition, terms such as "...unit" and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software. .

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

For the convenience of understanding and description, the omni-directional safety signature technique that is the basis of the present invention will be briefly described first.

In the case of public and private key (signing key)-based electronic signatures, when the private key (signing key) is exposed, there is no way to distinguish the signature previously generated by the legitimate signer from the signature forged by the attacker. The disadvantage is that the signature must be invalidated.

In order to compensate for this, even if the secret key is exposed at a specific time, the electronic signature technique that allows the validity of the signatures before the private key is exposed is the forward-safe signature technique.

As shown in FIG. 1, this forward secure signature scheme can update a private key when a signature is generated at a specific time. In the case of the forward secure signature scheme, the secret key can be updated so that it is impossible to infer the secret key of the past time using the secret key of the current time. For this reason, even if the secret key at a specific time point is exposed, there is an advantage in that validity of the signature at the time point before the secret key exposure can be maintained.

This forward secure signature scheme basically includes a key setup process (setup), a signature generation process (Sig), a key update process (Upd), and a signature verification process (Ver). Each of these processes will be briefly described.

)를 출력한다. The key setup process (setup) receives the security parameter (k), the hash output length (l), the maximum number for the entire time period (T), and the maximum number of messages (n), and uses them to obtain a public key (PK) and the initial secret key (

) is output.

)을 출력한다. 여기서, 비밀키(SK_j)는 특정 시점(j)의 메시지 M을 서명하기 위한 비밀키이다. 이러한 서명 생성 과정(Sig)은 키 업데이트 과정(Udp)와 함께 반복적으로 수행될 수 있다. Signature generation process (Sig) is a signature for the message M using the secret key (SK _j) of a particular time (j) (

) is output. Here, the secret key SK _j is a secret key for signing the message M at a specific time point j. This signature generation process (Sig) may be repeatedly performed together with the key update process (Udp).

The key update process (Upd) updates and outputs the secret key. That is, the key update process (Upd) may be output by updating the secret key (SK _{j + 1)} of the next time (j + 1) using the secret key (SK _j) of the j point.

), 특정 시점(

), 특정 시점이 메시지(

)을 입력받은 후 검증 후보 서명(

)이 메시지(

)의 유효한 서명인지를 검증한다. 만일 유효한 서명인 경우 1(ture)을 출력하고, 유효한 서명이 아니면 0(false)을 출력한다. The signature verification process (Ver) is a process of verifying the signature. The signature verification process (Ver) consists of a public key (PK), a verification candidate signature (

), at a specific point in time (

), the point in time is the message (

) and then the verification candidate signature (

) this message (

) to verify that it is a valid signature. If it is a valid signature, 1 (true) is output, and if it is not a valid signature, 0 (false) is output.

A basic omni-directional secure signature scheme has been described with reference to FIG. 1 . Hereinafter, an omni-directional secure signature method supporting sequential combining according to an embodiment of the present invention will be described with reference to FIG. 2 . Since the omni-directional safety signature method supporting sequential combination described below has the same basic premise as the forward-safe signature method described in FIG. 1, a detailed description of the known general forward safety signature method will be omitted. Hereinafter, only the parts necessary to explain the main argument of the present invention will be mainly described.

2 is a flowchart illustrating an omni-directional secure signature method supporting sequential combining according to an embodiment of the present invention, FIG. 3 is a diagram illustrating pseudo code for signature generation according to an embodiment of the present invention, and FIG. 4 is a diagram illustrating a pseudo code for generating a combined signature according to an embodiment of the present invention, FIG. 5 is a diagram illustrating a pseudo code for an initial key setting process according to an embodiment of the present invention, and FIG. 6 is a diagram illustrating a pseudo code for generating a signature for an integrated blind variable according to an embodiment of the present invention, and FIG. 7 is a diagram illustrating a pseudo code for verifying a signature according to an embodiment of the present invention, FIG. 8 is a diagram illustrating a pseudo code for verifying a combined signature according to an embodiment of the present invention, and FIG. 9 is a diagram illustrating a pseudo code for verifying a signature for an integrated blind variable according to an embodiment of the present invention. , FIG. 10 is a diagram illustrating a pseudo code for updating a secret key according to an embodiment of the present invention. Each of the following steps will be described on the assumption that it is performed by the computing device 200 .

In operation 210, the computing device 200 generates a j-th signature for the j- _{th message M j} by using the j-th secret key of the current time point (referred to as a t-th time point for convenience). The pseudo code for this is shown in FIG. 3 .

In step 215, the computing device 200 generates a combined signature by sequentially combining the j-th signature to the j-th signature. The pseudo code for this is shown in FIG. 4 .

According to an embodiment of the present invention, one combined signature may be generated by sequentially combining each of the signatures generated at each time point by the omni-directional secure signature. Also, by verifying the combined signature, validity of the combined signatures may be verified.

)이 서명 생성에 이용되는 해시 함수 입력으로 이용되었다. 즉, 서명은

와 같이 생성되었다. In the case of the conventional omni-directional safety signature, the result value (

) was used as input to the hash function used to generate the signature. That is, the signature is

was created as

가 이용됨에 따라 서명을 순차 결합하는 경우 서명의 유효성 검증에 이용되는 랜덤값을 특정할 수 있는 방법이 존재하지 않았다. For this reason, in the case of a conventional forward-safe signature, when generating a signature, it is

There was no way to specify a random value used to verify the validity of a signature when signatures are sequentially combined as is used.

However, in an embodiment of the present invention, when generating each signature, by integrating all information on a random value that verifies the validity of each signature into a specific variable (B), each random value used for generating each signature is Although it is not known directly, it is possible to calculate a random value for a specific time, and through this, the validity of the signature and the combined signature can also be verified.

This will be described in detail.

)를 생성하기 위한 과정이다. 물론, 초기 키 설정 과정은 본 발명의 일 실시예에 따른 순차 결합을 지원하는 전방향 안전 서명 방법을 수행하기 위해 필요한 각각의 변수에 대한 초기값들을 설정할 수도 있음은 당연하다. First, an initial key setting process will be briefly described. The initial key setting process consists of a public key and an initial private key (

) is the process for creating Of course, it is natural that the initial key setting process may set initial values for each variable required to perform the forward secure signature method supporting sequential coupling according to an embodiment of the present invention.

)를 생성할 수 있다. The pseudo code for the initial key setting process is shown in FIG. 5 . That is, in the initial key setting process, the security parameter (k), the hash output length (l), the maximum number for the entire time period (T), and the maximum number of messages (n) are received, respectively, and the public key (PK) is used. ) and initial secret key (

) can be created.

)을 생성할 수 있다. 본 발명의 일 실시예에서 변수 N은 합성수 그룹의 최대값인 것으로 이해되어야 할 것이다. More specifically, the initial key setting process randomly selects a plurality of prime numbers (p', q'), and uses the selected plurality of prime numbers to group a composite number (

) can be created. It should be understood that in an embodiment of the present invention, the variable N is the maximum value of the group of composite numbers.

In addition, it should be understood that random values selected for the omni-directional safety signature are selected from within the corresponding composite number group, even if there is no separate description hereinafter.

)을 포함하고, 비밀키는

을 포함할 수 있다. In addition, the public key (PK) is a value (

), and the secret key is

may include.

)내에서 랜덤하게 선택한다. 랜덤값(R_j)은 제t 시점(peroid)의 제j 메시지(M_j)의 유효성 검증에 이용될 수 있다. In addition, it is possible to set initial values for each variable required to perform forward-safe signature supporting sequential combining. For this, reference will be made to the pseudo code shown in FIG. 5 . After the initial key setting process as shown in FIG. 5 is completed, the computing device 200 sets the random value R _j to the composite number group (

) is randomly selected. The random value R _j may be used to validate the _j th message M j at the t th time point (peroid).

)을 계산한 후 해당 결과값을 메시지(M)과 함께 해시 함수 입력으로 이용하여 서명을 생성하였다. 즉,

와 같이, Y값이 서명 생성에 필요한 해시 함수 입력으로 입력되는 것을 알 수 있다. 이로 인해, 종래의 전방향 안전 서명 기법에 의해 각 주기마다 생성된 서명들을 결합하는 경우, 각 서명의 유효성 검증에 이용되는 랜덤값(R)이 뒤섞이게 되어 결합이 불가능한 문제점이 있었다. When generating a signature for the message using a private key of a point in time, the past, a period variable value to a random value (R _j) index seunghan As already described above the result (

), and the resulting value was used as a hash function input together with the message (M) to generate a signature. in other words,

As shown, it can be seen that the Y value is input as a hash function input required for signature generation. For this reason, when the signatures generated for each period are combined by the conventional omni-safe signature technique, the random value R used for validation of each signature is mixed, and there is a problem that the combination is impossible.

와 같이 갱신될 수 있다.In one embodiment of the present invention, in order to solve this problem, the integrated blind variable B may be newly defined, and the value of the integrated blind variable may be updated by multiplying a random value generated when each signature is generated. Referring to Figure 3,

can be updated as

For example, it is assumed that the j-th signature is combined with the i-th signature.

를 곱하여 결합 서명을 생성할 수 있다. In an embodiment of the present invention, the combined signature may be generated by sequentially multiplying the i-th to j-th signatures. That is, the computing device 200 is

can be multiplied to generate a joint signature.

을 통합하여 통합 블라인드 변수값을 계산한다. 본 발명의 일 실시예에서는

를 통합하기 위해

의

번째 근(root)에 대한 지식증명이 이용된다. Also, upon generating each signature, the computing device 200 binds to each signature.

to calculate the combined blind variable value. In one embodiment of the present invention

to integrate

of

The proof of knowledge for the second root is used.

According to an embodiment of the present invention, a signature (referred to as a blind signature) for the unified blind variable may be generated for validation of the unified blind variable. The pseudo code for this is as shown in FIG. 9 . .

To this end, in an embodiment of the present invention, a variable signature may be generated using the _{integrated blind variable (B j} ) and the definite variable (W _{j ).}

The pseudo code for this is shown in FIG. 6 .

In addition, in an embodiment of the present invention, when generating a signature, it is possible to generate a signature without a hash function and to maintain security. This will be described in more detail.

)를 계산할 수 있다. In addition, in one embodiment of the present invention, after defining the backward security fixed variable (E), the result value (

) can be calculated.

The backward security deterministic variable value (E) is updated for each signature generation, and assuming that the message is the j-th message, it can be derived by applying the (n-j) one-way hash function. Here, n may be the maximum number of messages.

가 계산되며, 이는 공개키에 포함될 수 있다. By applying a one-way hash function to the random value (C) as much as the maximum number of messages (n),

is calculated, which may be included in the public key.

로 백워드 보안 확정 변수값(E_j)이 도출될 수 있다. Here, the backward security fixed variable value (E _j ) for the j-th message at time t may be derived by applying a hash function (nj) times. in other words,

As such, a backward security deterministic variable value (E _j ) may be derived.

인지 여부를 판단하여 t시점의 제j 메시지에 대한 유효성 검증은 백워드 보완 확정 변수값(E_j)의 유효성을 검증할 수 있다. In addition, the backward complementary confirmation validity of the value of the variable (E _j) can be easily verified by comparing whether or not the result of applying a backward complementary confirmation value of the variable (E _j) for j times a one-way hash function equal to D. in other words,

Validation of the j th message at time t by determining whether or not it is t time can verify the validity of the backward complementary fixed variable value (E _j ).

A signature for each message is generated by multiplying the value of the backward complementary fixed variable and the message into the one-way hash function, multiplying the calculated result value (c) by the secret key, and then multiplying it by a random value.

와 같이 메시지에 대한 서명을 생성할 수 있다. in other words,

You can create a signature for the message as

는 제j 메시지에 대해 생성된 서명의 유효성 검증을 위해 이용되는 랜덤값이며,

는 제t 시점의 제j 메시지에 대한 서명을 위한 비밀키이다. 여기서, c는 백워드 보완 확정 변수값과 메시지를 단방향 해시 함수에 입력하여 계산된 결과값(c)이다. here,

is a random value used for validation of the signature generated for the j-th message,

is a private key for signing the j th message at the t th time. Here, c is the result value (c) calculated by inputting the backward complementary fixed variable value and the message into the one-way hash function.

As described above, although a random value is used when signing a message, it can be seen that the result value obtained by multiplying the periodic portion of the random value by an exponential is not used as a hash function input as in the prior art.

과 메시지(

)에 대한 검증을 위해,

인지 여부를 검증한다. 여기서,

이다. For convenience of understanding and explanation, a method for verifying a single message signature will be briefly described. signature

and message (

) for verification,

Check whether or not here,

am.

이므로,

Because of,

이다.

am.

A pseudocode for a detailed method of verifying a signature for a single message is shown in FIG. 7 .

라고 가정하기로 한다. A combined signature that combines the signatures from i to j

to assume that

에 의해 계산될 수 있다.

에 대한 결합 서명(

)은 다음과 같이 검증될 수 있다.

can be calculated by

A binding signature for (

) can be verified as follows.

이다. here,

am.

The pseudo code for this is shown in FIG. 8 .

According to an embodiment of the present invention, the private key is updated when the signature is generated due to the nature of the forward-safe signature. The pseudo code for updating the secret key is shown in FIG. 10 .

11 is a block diagram schematically illustrating an internal configuration of a computing device according to an embodiment of the present invention.

Referring to FIG. 11 , the computing device 200 according to an embodiment of the present invention includes an initialization unit 1110 , a signature generation unit 1115 , a blind signature generation unit 1120 , an update unit 1125 , and a verification unit ( 1130 ), a signature combination unit 1135 , a combined signature verification unit 1140 , a blind signature verification unit 1145 , a memory 1150 , and a processor 1155 .

The initialization unit 1110 generates a public key and an initial private key required for the forward secure signature method supporting sequential combination. Of course, the initialization unit 1110 may initialize various variables. The pseudo code for this is shown in FIG. 5 .

The signature generator 1115 generates a signature by using the secret key for the j th message at the local time point.

A detailed description thereof is the same as that described with reference to FIG. 2 , and thus a redundant description thereof will be omitted.

The blind signature generator 1120 generates a signature for the integrated blind variable value generated by the signature generator 1115 . The pseudo code for this is shown in FIG. 6 .

The update unit 1125 updates the secret key. That is, the updater 1125 may update the secret key to be used for signing the next message by using the secret key of the current time. The pseudo code for this is shown in FIG. 10 .

The verification unit 1130 verifies the validity of the signature using the public key, the signature, and the message. The pseudo code for this is shown in FIG. 7 .

The signature combining unit 1135 generates a combined signature using the public key and a plurality of signatures to be combined. Since this is the same as that described in FIG. 2 , a redundant description thereof will be omitted. Also, the pseudo code for this is shown in FIG. 4 .

The combined signature verification unit 1140 verifies the combined signature using the public key, the combined signature, and the messages. Since this is the same as that described in FIG. 2 , a redundant description thereof will be omitted.

The blind signature verification unit 1145 verifies the blind signature for the integrated blind variable. The pseudo code for this is shown in FIG. 9 .

The memory 1150 is a means for storing various program codes (instructions) necessary for performing the forward secure signature method supporting sequential combining.

The processor 1155 includes internal components (eg, the initializer 1110 , the signature generator 1115 , the blind signature generator 1120 , and the updater) of the computing device 200 according to an embodiment of the present invention. The unit 1125, the verification unit 1130, the signature combination unit 1135, the combined signature verification unit 1140, the blind signature verification unit 1145, the memory 1150, etc.).

In addition, the embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - optical media (magneto-optical), and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments of the present invention, and vice versa.

As described above, the present invention has been described with specific matters such as specific components and limited embodiments and drawings, but these are provided to help the overall understanding of the present invention, and the present invention is not limited to the above embodiments, Various modifications and variations are possible from these descriptions by those of ordinary skill in the art to which the present invention pertains. Therefore, the spirit of the present invention should not be limited to the described embodiments, and not only the claims to be described later, but also all those with equivalent or equivalent modifications to the claims will be said to belong to the scope of the spirit of the present invention. .

Claims (13)

A forward secure signature method supporting sequential join, comprising:
(a) selecting a j-th random value used to sign _{a j-th message (M j} ) at the current time point (t);
_{(b) the result of inputting the forward security deterministic variable value (E j} ) and the j-th message (M _j ) derived using the maximum number of messages (n) and the index (j) of the message into a one-way hash function The j-th signature for the j-th message (M _j ) using the value (c), the j-th random value, and the t _{j-th secret key for the j-th message (M j ) of the current time point (t)} generating;
(c) generating a j-th integrated blind variable value using the j-th random value and the integrated blind variable value up to a previous time point; and
(d) generating a combined signature by sequentially combining at least some of the signatures of the previous time points and the j-th signature,
The j-th integrated blind variable value is used for validation of the combined signature, wherein the j-th integrated blind variable value is generated by multiplying the j-th random value by the integrated blind variable value up to the previous time point. An omni-directional secure signature method that supports binding.
delete According to claim 1,
The result value (c) is an omnidirectional secure signature method supporting sequential combining, characterized in that calculated by the following equation.

According to claim 1,
Before supporting sequential combination, further comprising the step of verifying by determining whether the backward security deterministic variable value (E _j ) matches the result of applying j times to the one-way hash function and the information (D) included in the public key Directional safety sign method.
According to claim 1,
The j-th random value is calculated using the j-th integrated blind variable value and the (j-1)-th integrated blind variable value and is used for verifying the combined signature. .
According to claim 1,
The j-th signature is an omnidirectional secure signature method supporting sequential combining, characterized in that it is generated by the following equation.

here,

represents the jth random value,

denotes the secret key at the t-th time, and N is the maximum value of a group of composite numbers generated by the product of two randomly selected primes.
A computer-readable recording medium recording a program code for performing the method according to any one of claims 1, 3 to 6.
A computing device for performing an omni-directional secure signature method supporting sequential combining, the computing device comprising:
_{Select the j-th random value used for signing the j-th message (M j} ) at the current time point (t), and determine the backward security derived using the maximum number of messages (n) and the index (j) of the message The result value (c) of inputting the variable value (E _j ) and the j-th message (M _j ) into a one-way hash function, the j-th random value, and the j-th message (M _j ) of the current time point (t) The j-th signature for the j-th message (M _j ) is generated using the t _{j-th secret key for} Signature generating unit to generate; and
Comprising a signature combining unit for generating a combined signature by sequentially combining at least some of the signatures of the previous time points and the j-th signature,
The j-th integrated blind variable value is used for validation of the combined signature, and the j-th integrated blind variable value is generated by multiplying the j-th random value by the integrated blind variable value up to the previous time point. Device.
delete 9. The method of claim 8,
Computing further comprising a signature verification unit that verifies the j-th signature by determining whether the backward security deterministic variable value (E _j ) matches the result of applying j times to the one-way hash function and the information (D) included in the public key Device.
11. The method of claim 10,
The signature verification unit,
The j-th random value is calculated using the j-th integrated blind variable value and the (j-1)-th integrated blind variable value and used for verifying the j-th signature.
11. The method of claim 10,
The computing device further comprising a combined signature verification unit for verifying the combined signature using the backward security fixed variable value (E _j ), the j-th integrated blind variable value, and the (j-1)-th integrated blind variable value.
9. The method of claim 8,
Further comprising a secret key update unit for updating the secret key using _{the t j secret key,}
The secret key update unit is a computing device, characterized in that it is updated whenever a signature for the message is generated.

Images