JP6216688B2 - Partially disposable signature system and method, signature apparatus, verification apparatus, and program - Google Patents

Description

  The present invention relates to a digital signature.

  The one-time signature scheme (OTS) is a kind of digital signature scheme, and refers to a scheme in which a signature key is disposable, that is, can be used only for one-time signature generation. Non-Patent Document 1 describes a configuration example of OTS using a chameleon hash function.

Payman Mohassel, “One-Time Signatures and Chameleon Hash Functions”, Selected Areas in Cryptography, 2010, p.302-319

  The signature method described in Non-Patent Document 1 is OTS, and all keys must be updated each time a signature is made, which has a problem of poor efficiency.

  An object of the present invention is to provide a partially disposable signature system and method, a signature device, a verification device, and a program that are more efficient than the method described in Non-Patent Document 1.

In the partially disposable signature system according to one aspect of the present invention, (h ₀ , h ₀ ⁻¹ ) is a first set of chameleon hash functions, and (h ₁ , h ₁ ⁻¹ ) is a second set of chameleon hash functions. Pk = (h ₀ , h ₁ ) as a fixed verification key that can be used for multiple signatures and verifications, and sk = (h ₀ ^-1 ) can be used for multiple signatures and verifications. As a possible fixed signing key, m _f is a predetermined value, a random number r ₀ is generated, and z ₀ = h ₀ (m _f , r ₀ ) is calculated, so that the disposable verification key opk = (z ₀ ) and A disposable key generation device that generates a disposable signature key osk = (r ₀ ), and a signature key sk = (h ₀ ⁻¹ ) and a disposable signature key osk = (r ₀ ) are used as a message to be signed. To generate a random number r ₁ ′ and calculate r ₀ ′ = h ₀ ⁻¹ (m _f , r ₀ , h ₁ (M, r ₁ ′)) to obtain the signature σ = (r ₀ ′, r ₁ '), a signing device, a verification key pk = (h ₀ , h ₁ ), a disposable verification key opk = (z ₀ ) A verification device for verifying whether z ₀ matches h ₀ (h ₁ (M, r ₁ ′), r ₀ ′) using message M and signature σ = (r ₀ ′, r ₁ ′) It is equipped with.

In the signing device according to one aspect of the present invention, (h ₀ , h ₀ ⁻¹ ) is a first set of chameleon hash functions, (h ₁ , h ₁ ⁻¹ ) is a second set of chameleon hash functions, pk = (h ₀ , h ₁ ) is a fixed verification key that can be used for multiple signatures and verifications, and sk = (h ₀ ^-1 ) is a fixed key that can be used for multiple signatures and verifications , M _f is a predetermined value, r ₀ is a random number, z ₀ = h ₀ (m _f , r ₀ ), disposable verification key opk = (z ₀ ), and disposable signature key osk = ( r ₀ ), M is used as a message to be signed, a signing key sk = (h ₀ ⁻¹ ) and a disposable signing key osk = (r ₀ ) are used to generate a random number r ₁ ′, and r ₀ ′ The signature σ = (r ₀ ′, r ₁ ′) is generated by calculating = h ₀ ⁻¹ (m _f , r ₀ , h ₁ (M, r ₁ ′)).

In the verification device according to one aspect of the present invention, (h ₀ , h ₀ ⁻¹ ) is a first set of chameleon hash functions, (h ₁ , h ₁ ⁻¹ ) is a second set of chameleon hash functions, pk = (h ₀ , h ₁ ) is a fixed verification key that can be used for multiple signatures and verifications, and sk = (h ₀ ^-1 ) is a fixed key that can be used for multiple signatures and verifications , M _f is a predetermined value, r ₀ is a random number, z ₀ = h ₀ (m _f , r ₀ ), disposable verification key opk = (z ₀ ), and disposable signature key osk = ( r ₀ ), M is the message to be signed, r ₁ 'is a random number, r ₀ ' = h ₀ ^-1 (m _f , r ₀ , h ₁ (M, r ₁ ')) and the signature As σ = (r ₀ ′, r ₁ ′), verification key pk = (h ₀ , h ₁ ), disposable verification key opk = (z ₀ ), message M and signature σ = (r ₀ ′, r ₁ ′) Is used to verify whether z ₀ matches h ₀ (h ₁ (M, r ₁ ′), r ₀ ′).

  By using part of the signature key and the verification key, efficiency can be improved as compared with the method described in Non-Patent Document 1.

The block diagram for demonstrating the example of a partial disposable signature system. The flowchart for demonstrating the example of a partial disposable signature method.

  Embodiments of the present invention will be described below with reference to the drawings.

  As shown in FIG. 1, the partially disposable signature system includes, for example, a key generation device 1, a disposable key generation device 2, a signature device 3, a verification device 4, a transmission device 5, and a reception device 6. The partially disposable signature method is realized by the partially disposable signature system performing the processing from step S1 to step S4 in FIG.

  The present invention constructs a so-called partially disposable signature by using the chameleon hash function CMH.

  Here, Partial One-time Signatures (POS) consists of a long-term key and a disposable key that can be used repeatedly for each signature key and verification key. This means a signature scheme whose part is newly constructed.

The chameleon hash function CMH is composed of a pair of (h, h ⁻¹ ) functions. The functions h and h ⁻¹ have the following properties.

The function h is a function that takes a message M and a random number r as input and outputs a hash value. That is, it is difficult to find a pair (M, r), (M ′, r ′) where h (M, r) = h (M ′, r ′). On the other hand, h ⁻¹ is a function that takes (M, r, M ′) as an input and outputs r ′ that satisfies h (M, r) = h (M ′, r ′). That is, a person who knows the function h ⁻¹ can disclose a hash value for one (M, r) as a hash value for another (M ′, r ′).

The functions h and h ⁻¹ constituting the chameleon hash function CMH used in the present invention may be any as long as they satisfy the above properties.

Hereinafter, an example of the functions h and h ⁻¹ constituting the chameleon hash function CMH is shown.

Let G be a multiplicative group of prime order q. Let g be a generator of group G. For example, G⊂Z _p . Here, p is a prime number and q | p−1. That is, q is divisible by p-1. Further, s is a positive integer from 1 to q-1, and f = g ^s . If G⊂Z _p , then f = g ^s (mod p).

In this case, M, as r ∈ Z _q, the function h (M, r) = a g ^M f ^r. If G⊂Z _p , the function h (M, r) = g ^M f ^r (mod p) is assumed.

At this time, the function h ⁻¹ (M, r, M ′) is a function that outputs r ′ that satisfies M + s · r = M ′ + s · r ′ (mod q). That is, the function h ⁻¹ (M, r, M ′) = (M−M ′) / s + r (mod q) is set.

<Key generation device 1>
The key generation device 1 generates the first pair (h ₀ , h ₀ ⁻¹ ) of the chameleon hash function and the second pair (h ₁ , h ₁ ⁻¹ ) of the chameleon hash function, thereby performing a plurality of times. Generate a fixed verification key pk = (h ₀ , h ₁ ) that can be reused for signing and verification and a fixed signature key sk = (h ₀ ⁻¹ ) that can be reused for multiple signatures and verification (Step S1). The generated verification key pk = (h ₀ , h ₁ ) is disclosed to the whole. The generated signature key sk = (h ₀ ⁻¹ ) is transmitted to the signature device 3.

The processing of the key generation device 1 is performed only once before signature generation, and is not performed every time a signature is generated. Once generated, the verification key pk = (h ₀ , h ₁ ) and the signature key sk = (h ₀ ⁻¹ ) can be used for multiple signatures and verifications.

<Disposable key generation device 2>
The disposable key generation device 2 generates a random number r ₀ with m _f as a predetermined value, and calculates z ₀ = h ₀ (m _f , r ₀ ), whereby the disposable verification key opk = (z ₀ ) and A disposable signing key osk = (r ₀ ) is generated (step S2). The generated disposable verification key opk = (z ₀ ) is publicly disclosed. The generated disposable signature key osk = (r ₀ ) is transmitted to the signature device 3.

m _f may be a predetermined fixed value, or may take a different value every time the disposable signature key osk = (r ₀ ) is generated, similarly to the random number r ₀ . In this case, m _f is a random number, for example. Further, m _f may be a part of the verification key pk = (h ₀ , h ₁ ) or may be a fixed system parameter.

The process of the disposable key generation device 2 is performed every time a signature is generated. When the disposable verification key opk = (z ₀ ) and the disposable signature key osk = (r ₀ ) are used repeatedly, there is a possibility that the security is lowered.

<Signature device 3>
The signing device 3 generates a random number r ₁ ′ by using M as a message to be signed, the signing key sk = (h ₀ ⁻¹ ), and the disposable signing key osk = (r ₀ ), and r ₀ ′. By calculating = h ₀ ⁻¹ (m _f , r ₀ , h ₁ (M, r ₁ ′)), a signature σ = (r ₀ ′, r ₁ ′) is generated (step S3).

  The processing of the signature device 3 is performed, for example, when the transmission device 5 requests the signature device 3 to sign the message M. In this case, the transmission device 5 transmits the message M to be signed to the signature device 3, the signature device 3 generates a signature σ for the received message M, and transmits the generated signature σ to the transmission device 5. Is done.

  Thereafter, the transmission device 5 may transmit the message M and the generated signature σ to the reception device 6.

<Verification device 4>
The verification device 4 uses the verification key pk = (h ₀ , h ₁ ), the disposable verification key opk = (z ₀ ), the message M and the signature σ = (r ₀ ′, r ₁ ′), and z ₀ is h _It is verified whether or not it matches ₀ (h ₁ (M, r ₁ ′), r ₀ ′) (step S4).

  If they match, the signature is valid. If they do not match, it can be determined that the signature σ is not valid. This determination result may be output. For example, if they match, 1 is output, and if they do not match, 0 is output.

If the calculation result of h ₁ (M, r ₁ ′) is outside the domain of the function h ₀ , h ₀ ⁻¹ , h ₀ (h ₁ (M, r ₁ ′), r ₀ ') Cannot be calculated. In this case, the signature device 3 cannot calculate h ₀ ⁻¹ (m _f , r ₀ , h ₁ (M, r ₁ ′)). For this reason, as a mapping of TCH from the range of h ₁ to the domain of definition of h ₀ , h ₀ ⁻¹ , the verification device 4 determines that z ₀ is h ₀ (h ₁ (M, r ₁ ′), r ₀ ′) It may be verified whether z ₀ matches h ₀ (THC (h ₁ (M, r ₁ ')), r ₀ '). In this case, the signing device 3 is not r ₀ '= h ₀ ^-1 (m _f , r ₀ , h ₁ (M, r ₁ ')), but r ₀ '= h ₀ ^-1 (m _f , r ₀ , TCH (h ₁ (M, r ₁ '))) is calculated. Thus, by using TCH to ensure that the calculation result of h ₁ (M, r ₁ ′) is always within the domain of the function h ₀ , h ₀ ⁻¹ , the function h ₀ , It becomes possible to calculate the value of h ₀ ^-1 .

TCH is a function that is a mapping from the range of h ₁ to the domain of definition of h ₀ , h ₀ ⁻¹ , and may be a target collision difficult hash function. That is, it may be a function that makes it difficult to estimate a different input having the same output value as TCH (M) for a given target message M.

  The processing of the verification device 4 is performed, for example, for the transmission device 5 to confirm whether the signature σ generated by the signature device 3 is valid. In this case, the transmission device 5 transmits the message M and the generated signature σ to the verification device 4. The verification device 4 performs the above verification using the received message M and the generated signature σ.

  The processing of the verification device 4 may be performed by the reception device 6 that has received the message M and the generated signature σ from the transmission device 5 to confirm whether the signature σ is valid. In this case, the reception device 6 transmits the message M and the generated signature σ to the verification device 4. The verification device 4 performs the above verification using the received message M and the generated signature σ.

As described above, by using the signature key sk = (h ₀ ⁻¹ ) and the verification key pk = (h ₀ , h ₁ ), which are part of the signature key and the verification key, the method described in Non-Patent Document 1 is used. Efficiency can be improved.

[Variations]
The processes described in the above apparatus and method are not only executed in time series according to the description order, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the process.

  Further, when each process in each device is realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, each process is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

  Needless to say, other modifications are possible without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Key generation apparatus 2 Disposable key generation apparatus 3 Signature apparatus 4 Verification apparatus 5 Transmission apparatus 6 Reception apparatus

Claims (7)

Let (h ₀ , h ₀ ^-1 ) be the first set of chameleon hash functions, (h ₁ , h ₁ ^-1 ) be the second set of chameleon hash functions, and pk = (h ₀ , h ₁ ) As a fixed verification key that can be reused for multiple signatures and verification, and sk = (h ₀ ^-1 ) as a fixed signature key that can be reused for multiple signatures and verification,
The m _f as the predetermined value, generates a random number _{r 0, z 0 = h 0} (m f, r 0) by calculating, disposable verification key opk = (z ₀₎ and disposable signature key osk = (r ₀ ) a disposable key generation device for generating
Using M as a message to be signed, the signing key sk = (h ₀ ⁻¹ ) and the disposable signing key osk = (r ₀ ) are used to generate a random number r ₁ ′, and r ₀ ′ = h ₀ A signature device that generates a signature σ = (r ₀ ′, r ₁ ′) by calculating ⁻¹ (m _f , r ₀ , h ₁ (M, r ₁ ′));
Using the verification key pk = (h ₀ , h ₁ ), the disposable verification key opk = (z ₀ ), the message M and the signature σ = (r ₀ ′, r ₁ ′), z ₀ is h _0. a verification device for verifying whether or not (h ₁ (M, r ₁ '), r ₀ ') matches,
Including partial disposable signature system. The partially disposable signature system of claim 1, wherein
TCH is mapped from the range of h ₁ to the domain of h ₀ , h ₀ ^-1
The signing device generates a random number r ₁ ′ and calculates r ₀ ′ = h ₀ ⁻¹ (m _f , r ₀ , TCH (h ₁ (M, r ₁ ′))), whereby the signature σ = (r ₀ ', r ₁ ')
The verification device verifies whether z ₀ matches h ₀ (THC (h ₁ (M, r ₁ ')), r ₀ ').
Partial disposable signature system. (h _0, h ₀ ^-1) was used as a first set of chameleon hash ^{_{function, (h 1, h 1 -1}} ) was used as a second set of chameleon hash function, turn use the signature and verification of multiple times A fixed verification key pk = (h ₀ , h ₁ ) and a fixed signature key sk = (h ₀ ⁻¹ ) that can be used for multiple signatures and verifications. Means for receiving the fixed signature key sk = (h ₀ ⁻¹ )
The m _f is a predetermined value, the random number _{r 0, z 0 = h 0} (m f, r 0) by calculating, disposable verification key opk = (z ₀₎ and disposable signature key osk = (r ₀ Means for receiving the disposable signing key osk = (r ₀ ) transmitted from the disposable key generating device for generating
Means for generating a random number r ₁ ';
By calculating r ₀ '= h ₀ ^-1 (m _f , r ₀ , h ₁ (M, r ₁ ')) where M is the message to be signed, the signature σ = (r ₀ ', r ₁ ') means to generate
Signature device including (h _0, h ₀ ^-1) was used as a first set of chameleon hash ^{_{function, (h 1, h 1 -1}} ) was used as a second set of chameleon hash function, turn use the signature and verification of multiple times From a key generation device that generates a fixed verification key pk = (h ₀ , h ₁ ) that can be used and a fixed signature key sk = (h ₀ ⁻¹ ) that can be used for multiple signatures and verifications And the fixed verification key pk = (h ₀ , h ₁ ) disclosed to
The m _f is a predetermined value, the random number _{r 0, z 0 = h 0} (m f, r 0) by calculating, disposable verification key opk = (z ₀₎ and disposable signature key osk = (r ₀ ) To generate the disposable verification key opk = (z ₀ ) disclosed to the whole ,
Means for obtaining each of
The fixed verification key pk = (h ₀ , h ₁ ), the disposable verification key opk = (z ₀ ), the message M to be signed, and the random numbers r ₁ ′ and r ₀ ′ = ^{_{h 0 -1 (m f, r}} 0, h 1 (M, r 1 ')) signature sigma = generated by calculating _{(r 0', r 1 '} ) using, z ₀ is h ₀ ( _{h 1 (M, r 1 '} ), r 0' and the means for verifying whether the match with),
Verification device including Let (h ₀ , h ₀ ^-1 ) be the first set of chameleon hash functions, (h ₁ , h ₁ ^-1 ) be the second set of chameleon hash functions, and pk = (h ₀ , h ₁ ) As a fixed verification key that can be reused for multiple signatures and verification, and sk = (h ₀ ^-1 ) as a fixed signature key that can be reused for multiple signatures and verification,
The disposable key generation device generates a random number r ₀ with m _f as a predetermined value, and calculates z ₀ = h ₀ (m _f , r ₀ ), so that the disposable verification key opk = (z ₀ ) and the disposable key are generated. A disposable key generation step for generating a signature key osk = (r ₀ );
The signing device generates a random number r ₁ ′ using M as a message to be signed, the signing key sk = (h ₀ ⁻¹ ) and the disposable signing key osk = (r ₀ ), and r ₀ a signature step for generating a signature σ = (r ₀ ', r ₁ ') by calculating '= h ₀ ^-1 (m _f , r ₀ , h ₁ (M, r ₁ '));
The verification device uses the verification key pk = (h ₀ , h ₁ ), the disposable verification key opk = (z ₀ ), the message M and the signature σ = (r ₀ ′, r ₁ ′), z _{0 h 0 (h 1 (M,} r 1 '), r 0') and the verification step of verifying whether the match and,
Including partial disposable signature method. Program for causing a computer to function as each means of the signature equipment of claim 3. The program for functioning a computer as each means of the verification apparatus of Claim 4.

Images