KR20070067324A - Limited verifier signature method from bilinear pairings - Google Patents

Abstract

A method for signing on a limited verifier with bilinear pairings is provided to apply to an asymmetrical situation as well as a situation requiring symmetrical calculation ability by efficiently calculating Tate or Weil pairings. A system manager generates a system parameter, and a signer generates a public and private key pair(S_2). The signer generates a limited signature and a confirmer generates the signature of a message(S_4). The confirmer verifies the received signature and approves the signature if verification is successful(S_6). If the verification is unsuccessful, the signature is denied and terminated(S_7). The confirmer makes the third object ensure that the signer generates the signature of the message(S_8). Everyone ensures that the signer generates the signature of the message(S_9).

Description

Limited Verifier Signature Method from Bilinear Pairings

1 is a schematic configuration diagram according to the present invention.

1 a is a process of generating the parameters of the system according to the invention;

1B is a process of generating and delivering a signature of a signer and a limited verifier to the verifier.

2 is an overall flow chart in accordance with the present invention.

3 is a flow chart of the step of ascertaining to a third entity the present invention.

4 is a flow chart of public verifying steps in the present invention

** Explanation of symbols for main parts of drawings **

100: signer 200: verifier

300: system administrator 400: third object

TECHNICAL FIELD The present invention relates to a special digital signature method, and more particularly, to a secure limited validator signature method using overlapping mapping.

The undeniable signature introduced by Chaum and van Antwerpen is an electronic signature that cannot be verified without interaction with the signer. This is useful if the signature should not be validated universally. After Cham and Van Antwerp, several non-deniable signature methods have been proposed. In addition, Boyar introduced the concept of convertible non-repudiation signatures.

In some cases, it may be a disadvantage that the signature can only be verified through interaction with the signer. If the signer is absent or refuses to cooperate, the recipient cannot use the signature. This introduced the concept of "designated confirmer signatures." This is the concept that the designated verifier can verify the signature when there is a dispute, without cooperating with the signer.

Depending on the application, it may be important for blackmailing and mafia attacks to determine who will be verified by the signer as well as when the signature is verified. For example, voting centers provide evidence to convince voters that a particular voter's vote has been processed without being known to others (eg, coercers). This is an important concept needed to design a receive-free electronic voting method that prevents the purchase or coercion of voting rights. This motivated the notion of a "designated confirmer signature." The designated verifier trusts that the signer has signed the message using his evidence. However, because the verifier can generate the same evidence, this evidence cannot be presented to convince the third party.

Recently, due to privacy issues associated with the dissemination of digital certificates, Steinfeld introduced the "Universal" name verifier signature, which is an extended form of "name verifier signature." Any signature owner (not necessarily a signer) can assign that signature to a specific named verifier that he or she wants, but the verifier can be sure that the signer has created a signature, but cannot send this evidence to any other third party.

Depending on the application, it is important for the recipient to decide when and by whom the signer's signature should be verified. For example, credit card companies do their best to protect their privacy in order to earn their trust. Thus, it is sufficient for the company to ensure the validity of the customer signature only for the infamous message of the customer such as the invoice. In addition, the company wants to protect privacy, such as whether a customer pays at a certain time. However, if the customer violates the rules, the company will provide evidence to convince the third party. However, the third party cannot send this evidence to convince other third parties.

Nonrepudiation signatures and signature verifier signatures are not suitable for such situations. In non-repudiation signatures, the signature can only be verified with the cooperation of the signer. The name verifier signature never transmits the signature or evidence to a third party, even if the name verifier leaks his private key. This is because the name verifier can generate a “signature” that is identical to the signature of the actual signer.

Araki introduced the concept of "limited validator signatures" to solve these problems. Limited verifier signatures can only be verified by a limited verifier that attempts to protect the signer's privacy (especially an infamous message), unless the signer violates any rules. In case of further controversy, the limited verifier can really convince the third party, usually the third party, that the signer has created a signature. The goal of the limited validator is not to ensure that the signature is not publicly verified, but to allow the signer to follow certain rules. In some cases, the signer may violate the rule even though it was not intended. In this case, the qualified verifier gives the signer the opportunity to correct the error. So the third entity should not send this evidence to convince other entities.

The privacy of the signer is closely related to the privacy of the recipient. Thus, the qualified verifier signature can be used where the signature of the signer must be protected by the recipient.

Official documents processed with limited validator signatures should be verified by everyone after a certain time, if necessary. This is the motive behind Araki's introduction of “Convertible Qualified Verifier Signatures.” Convertible Qualified Verifier Signatures mean a signature that allows a Qualified Verifier to convert a signature to a generic signature for public verification.

Coordination with the original signature is required to convert the signature from the convertible limited validator signature. It will not be available if the original signatories do not like to cooperate or are uncomfortable.

Accordingly, the present invention has been proposed to solve the problem of fraud, and the object of the present invention is to provide two efficient (transformable) limited verifier signature methods based on the parallel linear mapping.

It is a further object of the present invention to provide a limited verifier signature method that is non-counterfeiting and non-transferablity.

TECHNICAL FIELD The present invention relates to a special digital signature method, and more particularly, to a secure limited validator signature method using overlapping mapping.

Electronic signature method according to the invention,

The system administrator generating system parameters (S_1);

Signer public (r _U P) and secret key (r _U ) Generating a pair (S_2);

Signer generates a definitive signature (S_3)

The verifier generates the signature S = (c, k, t) (method I) or C = (kp, U, V, W) (method II) of the message m (S_4);

Verifying the received signature by the verifier (S_5);

If the verification matches, approving the signature (S_6);

If the verification does not match, rejecting the signature and ending (S_7);

A verification step (S_8) in which the verifier assures the third object that the signature is generated by the signer;

A public verification step S9 in which anyone can be sure that the signer has generated a signature of the message m;

Characterized in that it comprises a.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 shows a schematic diagram of a limited verifier signature method according to the present invention. The main participants of the signature method are the signer 100, the verifier 200, the system manager 300, and the third object 400. Each of these participants can be implemented as a computer system. Each participant in the limited validator signature method performs the following functions:

The signer 100 generates a public key and a private key according to a given system parameter, publishes the public key, signs it using a limited validator signature method that presents a message to be transmitted, and then verifies the validator 200. It is then presented to the public and, in some cases, is responsible for converting his signature into a generic signature for public verification.

The verifier 200 verifies by referring to system parameters that the signatures presented by the signer 100 have been signed by the signer 100, and if the signer 100 violates certain rules, Evidence of the signature is presented to the third entity 400, and in some cases, serves to convert the signature presented by the signer 100 into a general signature for public verification.

The system manager 300 operates only during system initialization and announces system parameters generated by the system manager 300. Sometimes the signer's public and private key pairs can be generated and transmitted over a secure channel. However, it does not participate in the signature generation and verification process.

The limited validator signature method of the present invention composed of the above-mentioned participants sequentially generates the system parameter generation process of FIG. 1A and the signer 100 secret key / public key generation process, and the signer 100 limited validator signature generation of FIG. 1B. And to operate through the process of passing to the verifier 200 The present invention relates to a protocol for the verifier 200 to verify the signature of the signer 100.

In the system parameter generation process of FIG. 1A, system parameters shared by the signer 100, the verifier 200, and the third object 400 are generated and disclosed by the system administrator.

In the above process, a gap Diffie-Hellman (GDH) group G ₁ and a cyclic multiplicative group G ₂ are generated.

The double line mapping is map e: G ₁ × G ₁ → G ₂ .

And we define the cryptographic hash function according to each method.

In the process of generating the limited validator signature of FIG. 1B, the signer 100 generates a random number based on a system parameter disclosed by the system manager 300 to generate a public key. The generated validator signature for the message m is generated using the generated public key / private key pair and transmitted to the verifier 200.

The signed verifier 200 verifies the signature using the system parameters received from the system manager 300.

The safety of the limited verifier signature method of the present invention is constructed based on the difficulty of the bilinear diffi-Hellman problem proposed by Bonh-Franklin at the Krypto 2001 Society. The system manager 300 generates a group of points on the elliptic curve and a finite body and generates a deformed double line mapping that maps between the two cyclic groups. These values are published and made available to both signer 100 and verifier 200.

2 shows a flowchart of the present invention.

The system administrator generating system parameters (S_1);

Signer public (r _U P) and secret key (r _U ) Generating a pair (S_2);

Signer generates a definitive signature (S_3)

The verifier generates the signature S = (c, k, t) (method I) or C = (kp, U, V, W) (method II) of the message m (S_4);

Verifying the received signature by the verifier (S_5);

If the verification matches, approving the signature (S_6);

If the verification does not match, rejecting the signature and ending (S_7);

A verification step (S_8) in which the verifier assures the third object that the signature is generated by the signer;

A public verification step S9 in which anyone can be sure that the signer has generated a signature of the message m;

Is made of.

It will be described through the following equation.

In the present invention, the system parameter generates a GDH group G ₁ and a cyclic multiplication group G ₂ of order q in step 610 by the system administrator, as shown in FIG. .

e: G ₁ × G ₁ → G ₂

And we define the cryptographic hash function according to each method.

For method I, three kinds of cryptographic hash functions H ₁ : {0,1} ^l- > G ₁ , H ₂ : G _2- > Z _q , h: {0,1} ^l × G _2- > Z Define _q

For method II, five cryptographic hash functions H ₁ : {0,1} ^l- > G ₁ , H ₂ : G _2- > Z _q , H ₃ : Z _q- > G ₁ , H ₄ : G _1- > {0,1}, h: {0,1} ^l × Z _q- > Z _q And are defined.

(l means boundary of message bit length)

Then, using the system parameters described above, the signer 100 generates its own public and private key pair. First, a random value r _U , belonging to Z ^* _q is selected as a secret key, and a public key v is specified by Equation 2.

v = r _U P

The public key calculated in this way is disclosed by the signer 100 and the private key is securely stored by the signer 100. Therefore, the verifier 200 can access the public key of the signer 100 at any time.

The signer 100 then creates a signature for the message m in accordance with two methods according to Equation 3 and presents it to the verifier 200. In order to calculate Equation 3, the signer 100 first selects a random point Q∈ _R G1 in method I and a random value c∈ _R Z _q in method II.

Method I: c = e (Q, r _A P), s = Qr _A kH ₁ (m), t = H ₂ (e (r _A Q, r _B P)) ⁻¹ , S = (c, k, t)

c, V=H3(c)

S, W=H4(S)

m, C=(kP, U, V, W) Method II: S = cr _A H ₁ (m), k = h (m, c), U = H ₂ (e (r _A P, r _B P) ^k )

c, V = H3 (c)

S, W = H4 (S)

m, C = (kP, U, V, W)

는 XOR 연산이다.From above

Is an XOR operation.

The signature of Method I or Signature C of Method II, which is the value calculated by Equation 3, is sent to verifier 200.

Validator 200 then calculates Equation 4 upon receiving S (or C) as the signature of signer 100.

Method I: s = H ₂ (c ^rB ) t, d = e (s, P) e (H ₁ (m), r _A P) ^k

H₂(e(r_AP,kP)^rB), S=V

H₃(c), m=W

H₄(S) Method II: c = U

H ₂ (e (r _A P, kP) ^rB ), S = V

H ₃ (c), m = W

H ₄ (S)

In the next step 650, the verifier 200 verifies that Equation 5 holds, and "approves" the signature if it is satisfied, otherwise "denies" it.

Method I: k = h (m, d)

Method II: kP = h (m, c) P, e (S, P) ^c-1 = e (H ₁ (m), r _A P)

The second main feature of the present invention is that the verifier 200 in FIG. 4 confirms that the signer 100 signed the message m with respect to the signature of the signer 100, and the third object 400. Confirm with If a match is found in the above process, it is found that the given signature is truly signed by the signer 100. If it does not match, the signature is rejected and the execution of the verification protocol is immediately stopped.

After the verifier 200 completes the signature verification, the verifier calculates the proof by using Equation 7 to confirm the signature to the third object 400 and transmits the proof to the third object 400 together with the message m. The third entity 400 cannot send it to convince other entities.

Method I: a = e (s, r _J P)

Method II: a = e (S, r _J P) ^c-1

The third object 400 that has received the message m and the proof a checks whether the signer 100 has signed the message m by checking whether the message 8 satisfies Equation 8 in step 720.

Method I: l = (d ^rJ / a) ^k-1 = e (H ₁ (m), r _A P) ^rJ

Method II: a = e (H ₁ (m), r _A P) ^rJ

A third main feature of the present invention is to operate by converting the limited validator signature signed by the signer 100 of FIG. 5 into a general signature and publicly verifying it. The present invention is performed by the signer 100 or the validator 200. ) Is associated with a protocol that converts the signature of the signer 100 into a generic signature for public verification.

Signer 100 or limited verifier 200 issues a generic signature for the limited verifier signature, if necessary. To do this, we issue a pair for method I and a signature T = c ^-1 S for method II.

Anyone can verify via Equation 9 that the signer 100 signed the message m using the generic signature.

Method I: d = e (s, P) e (H ₁ (m), r _A P) ^k , k = h (md)

Method II: e (T, P) = e (H ₁ (m), r _A P)

Using the limited validator signature method of the present invention described above, the signer can generate a signature so that only the limited validator can verify the signature. And if public verification is needed, the generated limited validator signature can be converted to a generic signature.

Figure 3 shows a flow chart of the step of confirming to the third object in the present invention.

Confirming to the third object, wherein the verifier calculates and transmits the evidence to the third party (S_81);

The third object further includes a step S_82 of verifying the signature of the signer.

In connection with the above equation,

The verifier calculates and sends the proof method I (a = e (s, r _J P)) or method II (a = e (S, r _J P) ^c-1 ) to the third entity (S_81). Calculate the signature of the signer by calculating either Method I (l = (d ^rJ / a) ^k-1 = e (H ₁ (m)) or Method II (a = e (H ₁ (m), r _A P) ^rJ ). Check (S_82).

4 shows a flow chart of public verifying steps in the present invention.

The signer verifier issues a general signature pair (S_91);

All objects further comprise the step of verifying the signature (S_92).

In connection with the above equation,

The signer or verifier issues a common signature pair (S_91), and every entity is represented by method I (d = e (s, P) e (H ₁ (m), r _A P) ^k , k = h (md)) or Verify signature II by calculating method II (e (T, P) = e (H ₁ (m), r _A P)).

The present invention demonstrates that a finite validator signature method can be constructed using the overlapping mapping. At the same time, the random Oracle model provides a very rigorous test of safety against forgery and non-traneferability.

In particular, the verification protocol did not require two-way communication and did not require the cooperation of the original signer to convert to a signature for public verification. And the rejection protocol used in the previous protocol was not needed. This is very efficient compared to the previous method.

In the double-line mapping, a pair of tate or a pair of veils were implemented on an elliptic curve. At this time, the computation of the pair of tate or the bale is relatively complicated, indicating the inefficiency of the operation. However, due to continuous research by cryptographers, the improvement of computation time is steadily being made, and recently, the computation of tate pairs or veil pairs is calculated very efficiently due to the study of algorithms that reduce the amount of computation. Therefore, the present invention can be applied to an asymmetrical situation as well as a situation requiring symmetrical computing power.

Claims (3)

In the digital signature method, The system administrator generating system parameters (S_1); Signer public (r _U P) and secret key (r _U ) Generating a pair (S_2); Signer generates a definitive signature (S_3) The verifier generates a signature S = (c, k, t) (method I) of the message m (S_4); Verifying the received signature by the verifier (S_5); If the verification matches, approving the signature (S_6); If the verification does not match, rejecting the signature and ending (S_7); A verification step (S_8) in which the verifier assures the third object that the signature is generated by the signer; A public verification step S9 in which anyone can be sure that the signer has generated a signature of the message m; Limited validator signature method using a bilinear mapping characterized in that it comprises a. In the digital signature method, The system administrator generating system parameters (S_1); Signer public (r _U P) and secret key (r _U ) Generating a pair (S_2); Signer generates a definitive signature (S_3) The verifier generates C = (kp, U, V, W) (method II) of the message m (S_4); Verifying the received signature by the verifier (S_5); If the verification matches, approving the signature (S_6); If the verification does not match, rejecting the signature and ending (S_7); A verification step (S_8) in which the verifier assures the third object that the signature is generated by the signer; A public verification step S9 in which anyone can be sure that the signer has generated a signature of the message m; Limited validator signature method using a bilinear mapping characterized in that it comprises a. The method according to claim 1 or 2, The verification step (S_8) in which the verifier assures the third object that the signature is generated by the signer is The verifier calculates and transmits the evidence to the third party (S_81); The third object further includes the step of verifying the signature of the signer (S_82), A public verification step (S_9) in which anyone can be sure that the signer has generated the signature of message (m) The signer verifier issues a general signature pair (S_91); And all entities further include verifying the signature (S_92).

Images