JP4681474B2 - Blind signature generation / verification method, blind signature generation apparatus, user apparatus, blind signature verification apparatus, blind signature generation / verification system, blind signature generation program, user program, blind signature verification program - Google Patents

Description

  The present invention relates to an application technical field of cryptographic technology, and more particularly to blind signature technology.

Conventionally, many blind digital signature schemes have been proposed, but most signature schemes (RSA blind signature scheme, DSA blind signature scheme, etc. (see, for example, Non-Patent Document 1)) are secure by using a hash function. Is guaranteed. In this case, the grounds for security depend on the randomness of the hash value, but there is no hash function in which the hash value is completely random.
As a blind signature method that does not use a hash function, there is a method of Juels et al. (See, for example, Non-Patent Document 2).
Chaum, D., "Security without Identification: Transaction Systems to Make Big Brother Obsolete", Communications of the ACM, vol.28, No.10, pp.1030-1044 (1985) Juels, A., Luby, M, and Ostrovsky, R., "Security of Blind Digital Signatures, Proceedings of Crypto'97, LNCS 1294, pp. 150-164 (1997)

However, the method of Juels et al. Is based on a general two-party protocol, and practical efficiency is not considered at all. Therefore, this method has no practicality at all.
The present invention has been made in view of these points, and an object of the present invention is to realize an efficient blind signature with guaranteed security without depending on a hash function.

In the first invention, first, the secret key generation unit of the blind signature generation device generates a secret key xε {0, 1,..., P−1} when p is a prime number, and the public key When the generation unit sets G ₁ and G ₂ as a cyclic group of order p, g ₁ as a generation source of G ₁ , and g ₂ as a generation source of G ₂ , public keys g ₁ , g ₂ , w = g ₂ ^x , uεG ₂ , vεG ₂ are generated. Then, the h calculation unit calculates h = g ₂ ^r (rε {0, 1,..., P−1}), and the transmission unit transmits h to the user device.
Next, the receiving unit of the user device receives h and at least the public keys g ₁ , w, u, v transmitted from the blind signature generation device. Then, the X calculation unit of the user device sets ψ as a mapping ψ (g ₂ ) = g ₁ from G ₂ to G ₁ and sets m∈ {0, 1,..., P−1} as signature object information. X = g ₁ ^m · ψ (u) · ψ (v) ^s · (ψ (w · h)) ^R (s, Rε {0, 1,..., P−1}) And the transmission unit transmits X to the blind signature generation device.

Next, the receiving unit of the blind signature generation apparatus receives X. In addition, the Y calculation unit of the blind signature generation device calculates Y = (X · g ₁ ^{L · z} ) ^{1 / (x + r)} (L, zε {0,1,..., P−1}). The transmitting unit transmits at least Y to the user device.
Next, the reception unit of the user apparatus receives at least Y, and the σ calculation unit performs σ = (Y / g ₁ ^R ) ^{1 / t} (tε {0, 1,..., P−1}). The α calculation unit calculates α = w ^t−1 · h ^t , and the transmission unit transmits the signature target information m and the blind signature (σ, α, β) to the blind signature verification device. To do.

Next, the receiving unit of the blind signature verification device receives the signature object information m and the blind signature (σ, α, β), and the public keys g ₁ , g ₂ , w, transmitted from the blind signature generation device. u and v are received. Then, the signature verification unit of the blind signature verification device, in the case where the e bilinear mapping _{G 1 × G 2 → G T} , σ ≠ 1, α∈G 2, e (σ, w · α) = e It is verified whether (g ₁ , g ₂ ^m · u · v ^β ) (β = s + L mod p) holds.
Here, in the present invention, since a bilinear mapping is used, a blind signature that does not require a hash function can be realized. The security of this blind signature is based on the difficulty of solving the Strong Diffile-Hellman problem and can be said to be secure. Furthermore, the amount of computation required for each process of this blind signature is comparable to that of a widely used RSA signature.

  In the first invention, preferably, the proof result information generation unit of the user device indicates that (m, s, R) is held in the user device without blindly disclosing at least m. Proof result information for proof to the generation device is generated, and the transmission unit transmits the proof result information to the blind signature generation device. Then, the reception unit of the blind signature generation apparatus receives this proof result information, and the proof result verification unit verifies the proof result information. Only when the proof verification unit determines that the proof result information is acceptable, the Y calculation unit of the above-described blind signature generation apparatus executes a process for calculating Y.

As a result, it is possible to prevent the user apparatus from transmitting X that does not correspond to the signature object m to the blind signature generation apparatus and generating an illegal or incorrect blind signature.
Also, in the first invention, preferably, the random number generation unit of the user device randomly selects a ₁ , a ₂ , a ₃ from {0, 1,..., P−1}, and the W calculation unit W = g ₁ ^a1 · ψ (v) ^a2 · (ψ (w · h)) ^a3 (the superscripts a1, a2 and a3 indicate a ₁ , a ₂ and a ₃ respectively) The transmitting unit transmits W to the blind signature generation device. Then, after the reception unit of the blind signature generation device receives W, the random number generation unit randomly selects η from {0, 1,..., P−1}, and the transmission unit uses this η. To the user device. Next, the receiving unit of the user apparatus receives η, and the proof result information generating unit uses z ₁ = a ₁ + η · m mod p, z ₂ = a ₂ + η · s mod p, z as proof result information. ₃ = a ₃ + η · R mod p is generated, and the transmission unit transmits the certification result information to the blind signature generation device. In response to this, the proof result verification unit of the blind signature generation apparatus performs g ₁ ^z1 · ψ (v) ^z2 · (ψ (w · h)) ^z3 ≡W · (X / ψ (u)) ^η (superscript The subscripts z1, z2, and z3 indicate z ₁ , z ₂ , and z ₃ ), respectively, and verify the proof result information.

In the first invention, preferably, map ψ is an isomorphic map from G ₂ to G ₁ .
This enables accurate signature verification.
In the first invention, preferably, when the secret key generation unit of the blind signature generation device generates the secret key x, the secret key zε {0, 1,..., P−1} is also generated. And storing in the storage unit, the public key generated by the public key generation unit of the blind signature generation device is v = g ₂ ^z , and after the step of receiving X by the reception unit of the blind signature generation device Before the step in which the Y calculation unit of the blind signature generation device calculates Y and stores it in the storage unit, the random number generation unit of the blind signature generation device sets L to {0, 1,..., P−1}. The transmission unit of the blind signature generation device transmits L together with Y to the user device, and the reception unit of the user device stores L together with Y. And the receiving unit of the user device receives L along with Y. After the step of receiving, before the step of transmitting the signature object information m and the blind signature (σ, α, β) to the blind signature verification device by the transmission unit of the user device, the β calculation unit of the user device It further has the step which calculates (beta) = s + L mod p and stores it in a memory | storage part.

This further improves the security of the signature.
In the second invention, first, the secret key generation unit of the blind signature generation device generates a secret key x∈ {0, 1,..., P−1} when p is a prime number. When the public key generation unit of the blind signature generation apparatus uses G ₁ and G ₂ as a cyclic group of order p, g ₁ as the generation source of G ₁ , and g ₂ as the generation source of G ₂ key _{g 1, g 2, w =} g 2 x, u∈G 2, to generate a v∈G _2. Then, the reception unit of the user device receives at least the public keys g ₁ , u, v transmitted from the blind signature generation device, and the X calculation unit maps ψ from G ₂ to G ₁ ψ (g ₂ ) = G ₁ and m = signature object information, X = (g ₁ ^m · ψ (u) · ψ (v) ^s ) ^t (s, t∈ {0, 1,..., P -1}), and the transmission unit transmits X to the blind signature generation apparatus.

Next, the reception unit of the blind signature generation apparatus receives X, and the Y calculation unit Y = (X · (ψ (v)) ^L ) ^{1 / (x + r)} (r, Lε {0, 1,. ., P-1}), and the transmission unit transmits at least Y to the user apparatus.
Then, the receiving unit of the user apparatus receives at least Y, receives the public key w transmitted from the blind signature generating apparatus, and the τ calculating unit receives τ = (f · t) ⁻¹ mod p (f∈ { 0, 1,..., P−1}), the σ calculator calculates σ = Y ^τ , and the α calculator calculates α = w ^f−1 · R ^f (R = g ₂ ^r , Rε {0, 1,..., P−1}), and the transmitting unit calculates the signature object information m and the blind signature (σ, α, β) (β = s + L / t mod p). Are transmitted to the blind signature verification device.

Next, the receiving unit of the blind signature verification device receives the signature object information m and the blind signature (σ, α, β), and the public keys g ₁ , g ₂ , w, u transmitted from the blind signature generation device. , v receives the signature verification unit, in the case where the e was bilinear mapping of _{G 1 × G 2 → G T} , σ ≠ 1, α∈G 2, e (σ, w · α) = e ( g ₁ , g ₂ ^m · u · v ^β ) is verified.
Here, in the second invention, since a bilinear mapping is used, a blind signature that does not require a hash function can be realized. The security of this blind signature is based on the difficulty of solving the Strong Diffile-Hellman problem and can be said to be secure. Furthermore, the amount of computation required for each process of this blind signature is comparable to that of a widely used RSA signature.

  In the second invention, it is preferable that at least m is disclosed that the proof result information generation unit of the user apparatus can hold or calculate (m · t mod p, t, s · t mod p). Without generating a certification result information for proof to the blind signature generation device, the transmission unit transmits the certification result information to the blind signature generation device, and the reception unit of the blind signature generation device receives the certification result information. The proof result verification unit verifies the proof result information. The process for the Y calculation unit of the blind signature generation device to calculate Y is executed only when the certification verification unit of the blind signature generation device determines that the certification result information is acceptable.

As a result, it is possible to prevent the user apparatus from transmitting X that does not correspond to the signature object m to the blind signature generation apparatus and generating an illegal or incorrect blind signature.
In the second invention, preferably, the random number generation unit of the user device randomly selects a ₁ , a ₂ , a ₃ from {0, 1,..., P−1}, and the user device. W = g ₁ ^a1 · ψ (u) ^a2 · ψ (v) ^a3 (subscripts a1, a2, and a3 indicate a ₁ , a ₂ , and a ₃ , respectively) The transmission unit of the user device transmits W to the blind signature generation device. Next, the receiving unit of the blind signature generation device receives W, and after W is received, the random number generation unit of the blind signature generation device randomly selects η from {0, 1,..., P−1}. The transmission unit transmits η to the user device, and the reception unit of the user device receives η. The proof result information is z ₁ = a ₁ + η · m · t mod p, z ₂ = a ₂ + η · t mod p, z ₃ = a ₃ + η · s · t mod p, and the blind signature generation device the proof result verification ^{_{unit, g 1 z1 · ψ (u}} ) z2 · ψ (v) z3 ≡W · X η ( superscript z1, z2, z3 represents the _{z 1,} z 2, _{z 3,} respectively The verification result information is verified depending on whether or not

In the second invention, preferably, map ψ is an isomorphic map from G ₂ to G ₁ .
This enables accurate signature verification.
In the second invention, preferably, after the step of receiving X by the reception unit of the blind signature generation device, before the step of transmission of at least Y to the user device by the transmission unit of the blind signature generation device, random number generation The unit randomly selects r, L from {0, 1,..., P−1} and stores them in the storage unit, the R calculator calculates R = g ₂ ^r , and the transmitter R and L are transmitted to the user apparatus together with Y. The receiving unit of the user apparatus also receives R and L together with Y, and the α calculating unit calculates α = w ^f−1 · R ^f using the received R. In addition, after the reception unit of the user apparatus receives both R and L together with Y, the transmission unit of the user apparatus sends the signature object information m and the blind signature (σ, α, β) to the blind signature verification apparatus. Prior to the transmitting step, the β calculator of the user device calculates β = s + L / t mod p.

  This further improves the security of the signature.

  As described above, according to the present invention, it is possible to realize an efficient blind signature with guaranteed security without depending on the hash function.

First embodiment:
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.
[Bilinear map]
The present invention is characterized in that a bilinear map is used. First, the bilinear mapping used in the present invention will be described.
In the present invention, (G ₁ , G ₂ ) is a bilinear group having the following properties.
<Property 1> G ₁ and G ₂ are two cyclic groups having an order p (p is a prime number).

<Properties 2> _{g 2} is a generator of _{G 1, g 2} is a generator of _{G 2.}
The <nature 3> [psi, an isomorphism from _{G 2} to _{G 1,} satisfy _{ψ (g 2) = g 1} .
<Nature 4> e is a bilinear mapping, e: as defined in _{G 1 × G 2 → G T} . “×” indicates a direct product. In addition, the order of the _{G T} also is p. That is, when a, b∈G ₁ , c, d∈G ₂ , the following relationship is established.
e (a ・ b, c) = e (a, c) ・ e (b, c)… (1)
e (a, c ・ d) = e (a, c) ・ e (a, d)… (2)
<Properties 5> _e, ψ, group operation of _{G 1,} G _2, G _T can efficiently computed.

For an example of realizing the bilinear map e as described above using an elliptic curve on a finite field, refer to the document “Boneh, D. and Franklin, M.,“ Identity Based Encryption from the Weil Pairing ”, SIAM. J. of Computing, Vol. 32, No.3 pp.586-615, (2003) ". In addition, the meanings of the above symbols are almost the same as the literature “Boneh, D. and Boyen, X.,“ Short Signature Without Random Oracles ”, Proceedings of Crypto'04, LNCS, Springer-Verlag (2004)”. is there.
〔Constitution〕
Next, the configuration of this embodiment will be described.

FIG. 1 is a block diagram illustrating the overall configuration of a blind signature generation / verification system according to this embodiment. 2 is a block diagram illustrating a detailed configuration of the blind signature generation device, FIG. 3 is a detailed configuration of the user device, and FIG. 4 is a block diagram illustrating a detailed configuration of the blind signature verification device. Hereinafter, the configuration of this embodiment will be described with reference to these drawings.
<Overall configuration>
As illustrated in FIG. 1, the blind signature generation / verification system 1 according to this embodiment includes a blind signature generation device 10, a user device 20, and a blind signature verification device 30. Here, the blind signature generation device 10 and the user device 20, and the user device 20 and the blind signature verification device 30 are connected to each other through a network.

<Configuration of Blind Signature Generation Device>
As illustrated in FIGS. 1 and 2, the blind signature generation apparatus 10 of the present embodiment includes a secret key generation unit 10a, a public key generation unit 10b, a random number generation unit 10c, an h calculation unit 10d, and a storage unit 10e. And a proof result verification unit 10f, a Y calculation unit 10g, a transmission unit 10h, a reception unit 10i, and a control unit 10j.
The blind signature generation apparatus 10 according to the present embodiment includes a CPU (Central Processing Unit), an auxiliary storage device, a RAM (Random Access Memory), a ROM (Read Only Memory), an input / output interface, a NIC (Network Interface Card), and the like. It is constructed by reading a blind signature generation program into a known computer.

  That is, the key generation unit 10a, the public key generation unit 10b, the random number generation unit 10c, the h calculation unit 10d, the proof result verification unit 10f, the Y calculation unit 10g, and the control unit 10j illustrated in FIGS. It corresponds to the read CPU. The transmission unit 10h and the reception unit 10i correspond to a NIC that performs communication processing under the control of the CPU 11 into which the blind signature generation program has been read. The storage unit 10e includes an auxiliary storage device, a RAM, a register, and the like. The blind signature generation apparatus 10 executes each process under the control of the control unit 10j.

<Configuration of user device>
As illustrated in FIGS. 1 and 3, the user device 20 according to the present embodiment includes a receiving unit 20a, a transmitting unit 20b, a random number generating unit 20c, an X calculating unit 20d, a control unit 20e, and proof result information. It has a generation unit 20f, a σ calculation unit 20g, an α calculation unit 20h, a β calculation unit 20i, and a storage unit 20j. Further, as illustrated in FIG. 3, the proof result information generation unit 20f includes a W calculation unit 20fa and a z calculation unit 20fb.
The user device 20 of this embodiment is configured by reading a user program into a known computer as described above. That is, the random number generation unit 20c, the X calculation unit 20d, the control unit 20e, the proof result information generation unit 20f, the σ calculation unit 20g, the α calculation unit 20h, and the β calculation unit 20i correspond to the CPU into which the user program is read. . The receiving unit 20a and the transmitting unit 20b correspond to a NIC that performs communication processing under the control of the CPU in which the user program is read. The storage unit 20j includes an auxiliary storage device, a RAM, a register, and the like. The user device 20 executes each process under the control of the control unit 20e.

<Configuration of blind signature verification device>
As illustrated in FIG. 1 and FIG. 4, the blind signature verification device 30 of this embodiment includes a receiving unit 30a, a signature verification unit 30b, a signature verification result output unit 30c, a control unit 30d, and a storage unit 30e. Have.
The blind signature verification device 30 of this embodiment is configured by reading a blind signature verification program into a known computer as described above. That is, the signature verification unit 30b and the control unit 30d correspond to a CPU into which the blind signature verification program has been read. The receiving unit 30a corresponds to a NIC that performs communication processing under the control of the CPU loaded with the blind signature verification program. The signature verification result output unit 30c corresponds to an input / output interface that outputs data under the control of the CPU loaded with the blind signature verification program. The blind signature verification device 30 executes each process under the control of the control unit 30d.

〔processing〕
Next, the blind signature generation / verification process of this embodiment will be described.
FIG. 5 is a flowchart for explaining the processing of the blind signature generation apparatus 10. FIG. 6 is a flowchart for explaining processing of the user device 20. FIG. 7 is a flowchart for explaining the processing of the blind signature verification apparatus 30. Hereinafter, the blind signature generation / verification processing of this embodiment will be described with reference to these drawings.
<Blind signature generation process>
As a premise of this processing, the secret key generation unit 10a, the random number generation unit 10c of the blind signature generation device 10, the random number generation unit 20c of the user device 20, the proof result information generation unit 20f, and the β calculation unit 20i have a common prime p Set to be available. This may be realized by describing the prime p in the code of the blind signature generation program and the user program, or may be realized by separately reading the data of the prime p into the CPU. Also, signature target information (for example, document) mε {0, 1,..., P−1} is stored in the storage unit 20j of the user device 20. In this embodiment, a blind signature for this signature target information m is generated.

In this embodiment, first, the secret key generation unit 10a of the blind signature generation apparatus 10 (FIG. 2) assigns the secret keys x, y, zε {0, 1,..., P−1} (for example, randomly). Generate and store the secret key (x, y, z) in the storage unit 10e (FIG. 5 / step S1). For generating a random value, for example, a known pseudorandom number generation algorithm is used, but an input value or a predetermined value may be used as a random (arbitrary) value (the same applies to the following).
Next, the public key generation unit 10b of the blind signature generation apparatus 10 reads the secret key (x, y, z) from the storage unit 10e, and public keys g ₁ , g ₂ , w = g ₂ ^x , u = g ₂ ^y , v = g ₂ ^z is generated, and the public key (g ₁ , g ₂ , w, u, v) is stored in the storage unit 10e (step S2).

Next, the random number generation unit 10c randomly selects r from {0, 1,..., P−1} and stores it in the storage unit 10e (step S3). Then, h calculator 10d is, reads the public key _{g 2} r from the storage unit 10e, calculates the h _{= g} ^{2 r,} and stores the h in the storage unit 10e (step S4). Then, h stored in the storage unit 10e is sent to the transmission unit 10h, and the transmission unit 10h transmits h to the user device 20 (step S5).
The user device 20 (FIG. 3) receives h at the receiving unit 20a and stores it in the storage unit 20j (FIG. 6 / step S21). Next, the random number generation unit 20c randomly selects s and R from {0, 1,..., P−1} and stores them in the storage unit 20j (step S22).

Also, the user device 20 transmits public key issue request information from the transmission unit 20b to the blind signature generation device 10 under the control of the control unit 20e. Receiving this, the blind signature generation device 10 transmits the public key (g ₁ , g ₂ , w, u, v) of the storage unit 10 e from the transmission unit 10 h to the user device 20, and the user device 20 receives the reception key. This is received by the unit 20a and stored in the storage unit 20j (step S23). Note that the user device 20 in this example does not use the public key g _2. Therefore, the user device 20 may acquire only the public key (g ₁ , w, u, v).

Next, the X calculation unit 20d of the user device 20 reads the public key (g ₁ , w, u, v), (s, R), h, and the signature target information m from the storage unit 20j.
X = g ₁ ^m・ ψ (u) ・ ψ (v) ^s・ (ψ (w ・ h)) ^R … (3)
And the calculation result X is stored in the storage unit 20j (step S24). Then, this X is sent to the transmission unit 20b, and the transmission unit 20b transmits this X to the blind signature generation device 10 (step S25). This X is received by the receiving unit 10i of the blind signature generating apparatus 10 (FIG. 2) and stored in the storage unit 10e (FIG. 5 / step S6).

Further, the user apparatus 20 (FIG. 3) indicates that it holds (m, s, R) without including at least m (including a configuration in which at least one of s and R is not disclosed). Prove to the generator 10.
[Summary of certification]
First, the certification result information generation unit 20f indicates that (m, s, R) is stored in the storage unit 20j of the user device 20 without disclosing at least m (preferably m, s, A process for proving to the blind signature generation device 10 is executed (without disclosing R), and proof result information for performing the proof is generated and stored in the storage unit 20j (step S26 in FIG. 6). Then, the transmission unit 20b transmits the certification result information to the blind signature generation device 10 (step S27). The receiving unit 10i of the blind signature generation device 10 receives the proof result information, and the proof result verifying unit 10f verifies the proof result information (FIG. 5 / step S7). If the proof result verification unit 10f determines that the proof result information is unacceptable, the control unit 10j of the blind signature generation device 10 terminates the process with an error. On the other hand, if the proof result verification unit 10f determines that the proof result information is acceptable, the processes after step S9 are executed (step S8).

[Specific example of proof (example of proof)]
Next, a specific example of the processing of steps S26, S27 (FIG. 6) and step S7 (FIG. 5) will be described. The present invention is not limited to this specific example.
FIG. 8 is a flowchart for explaining a specific example of the processing in steps S26, S27 and S7. Hereinafter, this specific example will be described according to this flowchart.
First, the random number generation unit 20c of the user device 20 (FIG. 3) randomly selects (a ₁ , a ₂ , a ₃ ) from {0, 1,..., P−1} and stores the storage unit 20j. (Step S51). Next, the W calculation unit 20fa of the proof result information generation unit 20f reads (a ₁ , a ₂ , a ₃ ), g ₁ , v, w, and h from the storage unit 20j.
W = g ₁ ^a1・ ψ (v) ^a2・ (ψ (w ・ h)) ^a3 … (4)
And the calculation result W is stored in the storage unit 20j (step S52). Next, W stored in the storage unit 20j is sent to the transmission unit 20b, and the transmission unit 20b transmits W to the blind signature generation apparatus 10 (step S53).

The receiving unit 10i of the blind signature generation device 10 (FIG. 2) receives this W (step S54). After W is received, the random number generation unit 10c randomly selects η from {0, 1,..., P−1} and stores it in the storage unit 10e (step S55). This η is sent to the transmission unit 10h, and the transmission unit 10h transmits this η to the user device 20 (step S56).
The receiving unit 20a of the user device 20 (FIG. 3) receives this η and stores it in the storage unit 20j (step S57). Next, the z calculation unit 20fb of the proof result information generation unit 20f reads (a ₁ , a ₂ , a ₃ ), η, m, and (s, R) from the storage unit 20j.
z ₁ = a ₁ + η ・ m mod p
z ₂ = a ₂ + η ・ s mod p (5)
z ₃ = a ₃ + η ・ R mod p
And the calculation results (z ₁ , z ₂ , z ₃ ) are stored in the storage unit 20j as proof result information (step S58). Next, the certification result information (z ₁ , z ₂ , z ₃ ) is sent to the transmission unit 20b, and the transmission unit 20b sends the certification result information (z ₁ , z ₂ , z ₃ ) to the blind signature generation device 10. (Step S59).

The receiving unit 10i of the blind signature generation device 10 (FIG. 2) receives the proof result information (z ₁ , z ₂ , z ₃ ) and stores it in the storage unit 10e (step S60). Then, the proof result verification unit 10f reads g ₁ , w, u, v, h, W, X, η, (z ₁ , z ₂ , z ₃ ) from the storage unit 10e,
g ₁ ^z1・ ψ (v) ^z2・ (ψ (w ・ h)) ^z3 ≡W ・ (X / ψ (u)) ^η … (6)
The verification result information is verified depending on whether or not holds (step S61). Here, when Formula (6) is materialized, the certification result verification unit 10f outputs that the certification result is valid (step S62). On the other hand, when Expression (6) is not satisfied, the certification result verification unit 10f outputs that the certification result is invalid (step S63).

Then, when the processing after step S51 described above is repeated a plurality of times and the proof result is output as valid in all the loops, the proof result verification unit 10f determines that the proof result information is acceptable, and once However, if it is output that the proof result is invalid, it is determined that the proof result information is unacceptable (end of explanation of FIG. 5 / step S8 / [specific example of proof (example of proof)]).
When the proof result verification unit 10f determines that the proof result information is acceptable, the random number generation unit 10c of the blind signature generation device 10 randomly selects L from {0, 1,..., P−1}. It stores in the storage unit 10e (step S9). Next, the Y calculation unit 10g reads X, g ₁ , L, z, x, r from the storage unit 10e,
Y = (X ・ g ₁ ^{L ・ z} ) ^{1 / (x + r)} … (7)
Is calculated and stored in the storage unit 10e (step S10). Next, (Y, L) stored in the storage unit 10e is sent to the transmission unit 10h, and the transmission unit 10h transmits this (Y, L) to the user device 20 (step S11).

The receiving unit 20a of the user device 20 (FIG. 3) receives this (Y, L) and stores it in the storage unit 20j (FIG. 6 / step S28). Next, the random number generation unit 20c randomly selects t from {0, 1,..., P−1} and stores it in the storage unit 20j (step S29). Then, sigma calculation unit 20g is, reads the Y and _{g 1} and R and t from the storage unit 20j,
σ = (Y / g ₁ ^R ) ^{1 / t} (8)
And the calculation result σ is stored in the storage unit 20j (step S30). Further, the α calculation unit 20h reads w, h, and t from the storage unit 20j,
α = w ^t-1・ h ^t (9)
And the calculation result α is stored in the storage unit 20j (step S31). Further, the β calculation unit 20i reads s and L from the storage unit 20j,
β = s + L mod p (10)
And the calculation result β is stored in the storage unit 20j (step S32). (Σ, α, β) generated as described above is a blind signature of the signature target information m. The signature target information m and its blind signature (σ, α, β) stored in the storage unit 20j are sent to the transmission unit 20b, and the transmission unit 20b transmits the signature target information m and its blind signature (σ, α). , Β) is transmitted to the blind signature verification device 30 (step S33).

<Blind signature verification process>
The receiving unit 30a of the blind signature verification apparatus (FIG. 4) receives the signature object information m and the blind signature (σ, α, β) and stores them in the storage unit 30e (step S41). In addition, the receiving unit 30a receives the public keys (g ₁ , g ₂ , w, u, v) transmitted from the blind signature generation device 10 and stores them in the storage unit 30w (step S42). Note that the public key delivery request procedure to the blind signature generation apparatus 10 is the same as that of the user apparatus 10 described above, and a description thereof will be omitted.

Next, the signature verification unit 30b reads the signature target information m, its blind signature (σ, α, β) and the public key (g ₁ , g ₂ , w, u, v) from the storage unit 30e,
σ ≠ 1, α∈G ₂ , e (σ, w ・ α) = e (g ₁ , g ₂ ^m・ u ・ v ^β )… (11)
It is verified whether or not all are satisfied (step S43). Here, when Expression (11) is satisfied, the signature verification unit 30b sends information indicating that the signature verification is successful to the signature verification result output unit 30c, and the signature verification result output unit 30c passes the signature verification. A message is output (step S44). On the other hand, when Expression (11) is not satisfied, the signature verification unit 30b sends information indicating that the signature verification is unacceptable to the signature verification result output unit 30c, and the signature verification result output unit 30c does not verify the signature. The fact that it is acceptable is output (step S45).

<Reason for signature verification correctly>
Next, the reason why it can be said that the signature is acceptable when Expression (11) is satisfied will be described.
First, substituting equation (3) into equation (7) above,
Y = (X ・ g ₁ ^{L ・ z} ) ^{1 / (x + r)} = ((g ₁ ^m・ ψ (u) ・ ψ (v) ^s・ (ψ (w ・ h)) ^R ) ・ g ₁ ^{L・ Z} ) ^{1 / (x + r)} … (12)
It becomes. Also, from the foregoing <nature 3>, [psi is isomorphism from _{G 2} to _{G 1,} to satisfy the _{ψ (g 2) = g 1} , formula (12),
Y = g ₁ ^{(m + y + (s + L) ・ z) / (x + r)}・ g ₁ ^R … (13)
And can be transformed.

Then, from the equations (13) and (10), the equation (8) is
σ = (Y / g ₁ ^R ) ^{1 / t} = g ₁ ^{(m + y + (s + L) ・ z) / (t ・ x + t ・ r)} = g ₁ ^{(m + y + β ・ z) / (t ・ x + t ・ r)} … (14)
And can be transformed.
Here, assuming that δ = (t−1) · x + t · r, Equation (14) is
σ = g ₁ ^{(m + y + β ・ z) / (x + ((t-1) ・ x + t ・ r))} = g ₁ ^{(m + y + β ・ z) / (x + δ)} ... ( 15)
It becomes.
In this case, from w = g ₂ ^x (step S2) and h = g ₂ ^r (step S4), equation (9) is
α = w ^t-1・ h ^t = g ₂ ^{(t−1) ・ x + t ・ r} = g ₂ ^δ (16)
It becomes.

From these, the left side of equation (11) is
e (σ, w ・ α) = e (g ₁ ^{(m + y + β ・ z) / (x + δ)} , g ₂ ^{x + δ} )… (17)
And can be transformed. Furthermore, because of <property 4>, e is a bilinear map and satisfies equation (2), so equation (17) is
e (σ, w ・ α) = e (g ₁ ^{(m + y + β ・ z) / (x + δ)} , g ₂ ^{x + δ} )
= e (g ₁ ^{(m + y + β ・ z) / (x + δ)} , g ₂ ) ・ e (g ₁ ^{(m + y + β ・ z) / (x + δ)} , g ₂ ) ・ ・ ・ ・・ E (g ₁ ^{(m + y + β ・ z) / (x + δ)} , g ₂ )… (18)
And satisfying equation (1), equation (18) is
e (σ, w ・ α) = e (g ₁ ^{(m + y + β ・ z)} , g ₂ )
= e (g ₁ , g ₂ ) ・ e (g ₁ , g ₂ ) ・ ・ ・ ・ ・ e (g ₁ , g ₂ )… (19)
And can be transformed. Furthermore, e satisfies the equation (2), and u = g ₂ ^y , v = g ₂ ^z (step S2), the equation (19) is
e (σ, w ・ α) = e (g ₁ , g ₂ ^{(m + y + β ・ z)} )
= e (g ₁ , g ₂ ^m u · v ^β ) = the right side of equation (11).

[Effect of this embodiment]
A hash function is not used in the blind signature of this embodiment. Further, the security of the blind signature generation process and the blind signature verification process of this embodiment is based on the difficulty of solving the Strong Diffile-Hellman problem, and can be said to be safe. Furthermore, the processing speed of the blind signature generation processing and the blind signature verification processing according to the present embodiment is similar to that of the most widely used RSA signature at present, and has high practicality.
For example, in a typical implementation of bilinear mapping, an elliptic curve such that G ₁ = G ₂ is used, and the parameter of this elliptic curve can be set to about 200 bits. The data size of the blind signature (σ, α, β) at this time is about 200 bits (that is, about 600 bits in total for σ, α, β), which is smaller than the data size of the RSA signature.

[Modification]
The present invention is not limited to the embodiment described above. For example, in this embodiment, at step S26, S27 (FIG. 6) and step S7 (FIG. 5), at least m is disclosed that the user device 20 holds (m, s, R). However, only when the certificate is proved to the blind signature generation apparatus 10 and the certification is successful, the processing after step S9 (FIG. 5) is executed. However, the processing after step S9 (FIG. 5) may be executed without performing this proof processing.

In this embodiment, ψ is an isomorphism from G ₂ to G ₁ . However, a configuration in which ψ is a homomorphic map from G ₂ to G ₁ may be used.
In the present embodiment, the blind signature generation device 10 generates the secret key x, y, z, and generates the public key u by u = g ₂ ^y . However, without generating a private key y, may be optionally select consists cyclic group G ₂ a public key u.
In this embodiment, the blind signature generation apparatus 10 sets L to {0, 1,. . . , P−1} are selected at random and transmitted to the user device 20. However, the blind signature generation device 10 may be configured not to select or transmit L. In this case, the blind signature generation device 10 calculates Y = (X · g ₁ ^{L · z} ) ^{1 / (x + r)} using L (including 0) already shared with the user device 20. Then, the user device 20 may calculate β using this L. Here the secret key z if a L = 0 is not required, the blind signature generating apparatus 10, without generating a private key z, may take any To select consists cyclic group G ₂ a public key v. In this case, the user device 20 can also use s as β as it is.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually as required by the processing capability of the apparatus that executes the process, or otherwise. Needless to say, changes can be made without departing from the scope of the present invention.
Second embodiment:
Next, a second embodiment of the present invention will be described with reference to the drawings. In the following description, differences from the first embodiment will be mainly described, and description of parts common to the first embodiment will be simplified.

〔Constitution〕
Next, the configuration of this embodiment will be described.
FIG. 9 is a block diagram illustrating the overall configuration of the blind signature generation / verification system in the present embodiment. FIG. 10 is a block diagram illustrating a detailed configuration of the blind signature generation apparatus, and FIG. 11 is a block diagram illustrating a detailed configuration of the user apparatus. The blind signature verification device 30 is the same as that of the first embodiment. Hereinafter, the configuration of this embodiment will be described with reference to these drawings.

<Overall configuration>
As illustrated in FIG. 9, the blind signature generation / verification system 101 of this embodiment includes a blind signature generation device 110, a user device 120, and a blind signature verification device 30. Here, the blind signature generation device 110 and the user device 120, and the user device 120 and the blind signature verification device 30 are connected to each other through a network.
<Configuration of Blind Signature Generation Device>
As illustrated in FIGS. 9 and 10, the blind signature generation device 110 according to the present exemplary embodiment includes a secret key generation unit 110a, a public key generation unit 110b, a random number generation unit 110c, an R calculation unit 110d, and a storage unit 110e. , A proof result verification unit 110f, a Y calculation unit 110g, a transmission unit 110h, a reception unit 110i, and a control unit 110j.

As in the first embodiment, the blind signature generation apparatus 110 of this embodiment is constructed by reading a blind signature generation program into a known computer.
That is, the key generation unit 110a, the public key generation unit 110b, the random number generation unit 110c, the R calculation unit 110d, the proof result verification unit 110f, the Y calculation unit 110g, and the control unit 110j illustrated in FIGS. It corresponds to the read CPU. The transmission unit 110h and the reception unit 110i correspond to a NIC that performs communication processing under the control of the CPU into which the blind signature generation program is read. The storage unit 110e includes an auxiliary storage device, a RAM, a register, and the like. Note that the blind signature generation apparatus 110 executes each process under the control of the control unit 110j.

<Configuration of user device>
As illustrated in FIGS. 9 and 11, the user device 120 according to the present embodiment includes a receiving unit 120a, a transmitting unit 120b, a random number generating unit 120c, an X calculating unit 120d, a control unit 120e, and proof result information. It has a generation unit 120f, a σ calculation unit 120g, an α calculation unit 120h, a β calculation unit 120i, a storage unit 120j, and a τ calculation unit 120k. Further, as illustrated in FIG. 11, the proof result information generation unit 120f includes a W calculation unit 120fa and a z calculation unit 120fb.

  The user device 120 of this embodiment is configured by reading a user program into a known computer, as in the first embodiment. That is, the random number generator 120c, the X calculator 120d, the controller 120e, the proof result information generator 120f, the σ calculator 120g, the α calculator 120h, the β calculator 120i, and the τ calculator 120k are loaded with user programs. This corresponds to a CPU. The receiving unit 120a and the transmitting unit 120b correspond to a NIC that performs communication processing under the control of the CPU in which the user program is read. The storage unit 120j includes an auxiliary storage device, a RAM, a register, and the like. The user device 120 executes each process under the control of the control unit 120e.

<Configuration of blind signature verification device>
This is as described in the first embodiment. The description is omitted here.
〔processing〕
Next, the blind signature generation process of this embodiment will be described.
FIG. 12 is a flowchart for explaining the process of the blind signature generation apparatus 110. FIG. 13 is a flowchart for explaining processing of the user device 20. Hereinafter, the blind signature generation processing of this embodiment will be described with reference to these drawings. Since the signature verification process is the same as that in the first embodiment, the description thereof is omitted.

<Blind signature generation process>
As a premise of this process, the secret key generation unit 110a, the random number generation unit 110c of the blind signature generation device 110, the random number generation unit 120c of the user device 120, the proof result information generation unit 120f, the β calculation unit 120i, and the τ calculation unit 120k The common prime number p is set so that it can be used. This may be realized by describing the prime p in the code of the blind signature generation program and the user program, or may be realized by separately reading the data of the prime p into the CPU. Also, signature target information (for example, document) mε {0, 1,. . . , P−1} are stored. In this embodiment, a blind signature for this signature target information m is generated.

In this embodiment, first, the secret key generation unit 110a of the blind signature generation device 110 (FIG. 10) generates a secret key xε {0, 1,..., P−1} (for example, randomly), and The secret key x is stored in the storage unit 110e (FIG. 12 / step S101).
Next, the public key generation unit 110b of the blind signature generating device 110 reads the secret key x from the storage unit 110e, a public key _{g 1, g 2, w =} g 2 x, u∈G 2, the V∈G ₂ The public key (g ₁ , g ₂ , w, u, v) is generated and stored in the storage unit 110e (step S102).

Next, the random number generation unit 120c of the user device 120 (FIG. 11) randomly selects s and t from {0, 1,..., P−1}, and stores them in the storage unit 120j (step). S121).
Further, the user device 120 transmits public key issue request information from the transmission unit 120b to the blind signature generation device 110 under the control of the control unit 120e. Receiving this, the blind signature generation device 110 transmits the public key (g ₁ , g ₂ , w, u, v) of the storage unit 110e from the transmission unit 110h to the user device 120, and the user device 120 receives This is received by the unit 120a and stored in the storage unit 120j (step S122). Incidentally, the user device 120 in this example does not use the public key g _2. Therefore, the user device 120 may acquire only the public key (g ₁ , w, u, v).

Next, the X calculation unit 120d of the user device 120 reads the public key (g ₁ , w, u, v), (s, t), and the signature target information m from the storage unit 120j,
X = (g ₁ ^m・ ψ (u) ・ ψ (v) ^s ) ^t … (20)
And the calculation result X is stored in the storage unit 120j (step S123).
Then, this X is sent to the transmission unit 120b, and the transmission unit 120b transmits this X to the blind signature generation device 110 (step S124). This X is received by the receiving unit 110i of the blind signature generating apparatus 110 (FIG. 10) and stored in the storage unit 110e (FIG. 12 / step S103).

Further, the user device 120 (FIG. 11) indicates that it can hold or calculate (m · t mod p, t, s · t mod p) without disclosing at least m (preferably m, (without disclosing s, t))
[Summary of certification]
First, the fact that the proof result information generation unit 120f can hold or calculate (m · t mod p, t, s · t mod p) without disclosing at least m (preferably m, s, Processing for proving to the blind signature generation device 110 is executed (without disclosing t), and proof result information for performing the proof is generated and stored in the storage unit 120j (step S125 in FIG. 13). Then, the transmission unit 120b transmits the certification result information to the blind signature generation device 110 (step S126). The receiving unit 110i of the blind signature generating apparatus 110 receives the proof result information, and the proof result verifying unit 110f verifies the proof result information (step S104 in FIG. 12). If the proof result verification unit 110f determines that the proof result information is unacceptable, the control unit 110j of the blind signature generation device 110 terminates the process with an error. On the other hand, if the proof result verification unit 110f determines that the proof result information is acceptable, the processing after step S106 is executed (step S105).

[Specific example of proof (example of proof)]
Next, a specific example of the processing of steps S125, S126 (FIG. 13) and step S104 (FIG. 12) will be described. The present invention is not limited to this specific example.
FIG. 14 is a flowchart for explaining a specific example of the processing in steps S125, S126, and step S104. Hereinafter, this specific example will be described according to this flowchart.
First, the random number generation unit 120c of the user device 120 (FIG. 11) randomly selects (a ₁ , a ₂ , a ₃ ) from {0, 1,..., P−1} and stores the storage unit 120j. (Step S151). Next, the W calculation unit 120fa of the proof result information generation unit 120f reads (a ₁ , a ₂ , a ₃ ), g ₁ , u, and v from the storage unit 120j,
W = g ₁ ^a1 · ψ (u) ^a2 · ψ (v) ^a3 (21)
And the calculation result W is stored in the storage unit 120j (step S152). Next, W stored in the storage unit 120j is sent to the transmission unit 120b, and the transmission unit 120b transmits W to the blind signature generation apparatus 110 (step S153).

The receiving unit 110i of the blind signature generation device 110 (FIG. 10) receives this W (step S154). After W is received, the random number generation unit 110c randomly selects η from {0, 1,..., P−1} and stores it in the storage unit 110e (step S155). This η is sent to the transmission unit 110h, and the transmission unit 110h transmits this η to the user device 120 (step S156).
The receiving unit 120a of the user device 120 (FIG. 11) receives this η and stores it in the storage unit 120j (step S157). Next, the z calculation unit 120fb of the proof result information generation unit 120f reads (a ₁ , a ₂ , a ₃ ), η, m, and R from the storage unit 120j,
z ₁ = a ₁ + η ・ m ・ t mod p
z ₂ = a ₂ + η ・ t mod p (22)
z ₃ = a ₃ + η ・ s ・ t mod p
And the calculation results (z ₁ , z ₂ , z ₃ ) are stored in the storage unit 120j as proof result information (step S158). Next, the certification result information (z ₁ , z ₂ , z ₃ ) is sent to the transmission unit 120b, and the transmission unit 120b sends the certification result information (z ₁ , z ₂ , z ₃ ) to the blind signature generation device 110. (Step S159).

The receiving unit 110i of the blind signature generation device 110 (FIG. 10) receives the proof result information (z ₁ , z ₂ , z ₃ ) and stores it in the storage unit 110e (step S160). Then, the proof result verification unit 110f reads g ₁ , u, v, W, X, η, (z ₁ , z ₂ , z ₃ ) from the storage unit 110e,
g ₁ ^z1 · ψ (u) ^z2 · ψ (v) ^z3 ≡W · (X) ^η … (23)
The verification result information is verified depending on whether or not holds (step S161). Here, when Formula (23) is materialized, the certification result verification unit 110f outputs that the certification result is valid (step S162). On the other hand, when Expression (23) is not satisfied, the proof result verification unit 110f outputs that the proof result is invalid (step S163).

Then, when the processing after step S151 described above is repeated a plurality of times and the proof result is output as valid in all the loops, the proof result verification unit 110f determines that the proof result information is acceptable, and once However, if it is output that the proof result is invalid, it is determined that the proof result information is unacceptable (end of explanation of FIG. 12 / step S105 / [specific example of proof (example of proof)]).
When the proof result verification unit 110f determines that the proof result information is acceptable, the random number generation unit 110c of the blind signature generation device 110 randomly selects r and L from {0, 1,..., P−1}. And stored in the storage unit 110e (step S106). Next, the Y calculation unit 110g reads X, L, v, x, r from the storage unit 110e,
Y = (X ・ ψ (v) ^L ) ^{1 / (x + r)} (24)
Is calculated and stored in the storage unit 110e (step S107).

In addition, the R calculation unit 110d reads g ₂ and r from the storage unit 110e,
R = g ₂ ^r (25)
Is calculated and stored in the storage unit 110e (step S108).
Next, (Y, R, L) stored in the storage unit 110e is sent to the transmission unit 110h, and the transmission unit 110h transmits this (Y, R, L) to the user device 120 (step S109). . The receiving unit 120a of the user device 120 (FIG. 11) receives (Y, R, L) and stores it in the storage unit 120j (FIG. 13 / step S127). Next, the random number generation unit 120c randomly selects f from {0, 1,..., P−1} and stores it in the storage unit 120j (step S128). Then, the τ calculation unit 120k reads f and t from the storage unit 120j,
τ = (f ・ t) ^-1 mod p (26)
And the calculation result τ is stored in the storage unit 120j (step S129). Also, the σ calculation unit 120g reads Y and τ from the storage unit 120j,
σ = Y ^τ (27)
And the calculation result σ is stored in the storage unit 120j (step S130). Further, the α calculation unit 120h reads w, h, and t from the storage unit 120j,
α = w ^f-1・ R ^f … (28)
And the calculation result α is stored in the storage unit 120j (step S131). Further, the β calculation unit 120i reads s, L, and t from the storage unit 120j,
β = s + L / t mod p (29)
And the calculation result β is stored in the storage unit 120j (step S132). (Σ, α, β) generated as described above is a blind signature of the signature target information m. The signature target information m and its blind signature (σ, α, β) stored in the storage unit 120j are sent to the transmission unit 120b, and the transmission unit 120b transmits the signature target information m and its blind signature (σ, α). , Β) is transmitted to the blind signature verification device 130 (step S133).

<Blind signature verification process>
Even in the blind signature verification process of this embodiment, as in the first embodiment,
σ ≠ 1, α∈G ₂ , e (σ, w ・ α) = e (g ₁ , g ₂ ^m・ u ・ v ^β )… (30)
If is established, it is determined that the signature is acceptable.
<Reason for signature verification correctly>
Next, the reason why it can be said that the signature is acceptable when Expression (30) is satisfied will be described.

First, substituting equation (20) into equation (24) above,
Y = (X ・ ψ (v) ^L ) ^{1 / (x + r)} = ((g ₁ ^m・ ψ (u) ・ ψ (v) ^s ) ^t・ ψ (v) ^L ) ^{1 / (x + r )}
= (g ₁ ^m・ ψ (u) ・ ψ (v) ^{s + L / t} ) ^{t / (x + r)} … (31)
It becomes. Substituting this and equation (26) into equation (27) gives
σ = Y ^τ = Y ^{1 / (f ・ t)} = (g ₁ ^m・ ψ (u) ・ ψ (v) ^{s + L / t} ) ^{1 / (f ・ x + f ・ r)} … (32)
It becomes. Then, substituting equation (29) into equation (32), and further assuming that δ = (f−1) x + f · r mod p,
σ = (g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + (f−1) x + f ・ r)} = (g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + δ)} (33)
It becomes. Also, if w = g ₂ ^x and equation (25) are substituted into equation (28) and expressed using the above δ,
α = w ^f-1・ R ^f = g ₂ ^{f-1 + r} = g ₂ ^{(f-1) x + f ・ r)} = g ₂ ^δ (34)
It becomes.

From these, the left side of equation (11) is
e (σ, w · α) = e ((g ₁ ^m · ψ (u) · ψ (v) ^β ) ^{1 / (x + δ)} , g ₂ ^{x + δ} )… (35)
And can be transformed. Furthermore, because of <property 4>, e is a bilinear map and satisfies equation (2), so equation (35) is
e (σ, w ・ α) = e ((g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + δ)} , g ₂ ^{x + δ} ) = e ((g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + δ)} , g ₂ ) ・ e ((g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + δ)} , g ₂ ) ・ ・ ・ ・ ・ E ((g ₁ ^m・ ψ (u) ・ ψ (v) ^β ) ^{1 / (x + δ)} , g ₂ )… (36)
And satisfying equation (1), equation (36) is
e (σ, w · α) = e (g ₁ ^m · ψ (u) · ψ (v) ^β , g ₂ )… (37)
And can be transformed. Since u, vεG ₂ and u = g ₂ ^y , v = g ₂ ^z can be written (y, zε {0, 1,..., P−1}), equation (37) is
e (σ, w · α) = e (g ₁ ^m · ψ (g ₂ ^y ) · ψ (g ₂ ^z ) ^β , g ₂ )… (37)
Can be written. Further, from <Property 3> described above, ψ is an isomorphism from G ₂ to G ₁ , and further satisfies ψ (g ₂ ) = g ₁ , so Expression (37) is
e (σ, w ・ α) = e (g ₁ ^m・ ψ (g ₂ ^y ) ・ ψ (g ₂ ^z ) ^β , g ₂ ) = e (g ₁ ^{(m + y + β ・ z)} , g ₂ )… (38)
And can be transformed. Furthermore, since Expression (1) is satisfied, Expression (38) is
e (σ, w ・ α) = e (g ₁ , g ₂ ) ・ e (g ₁ , g ₂ ) ・ ・ ・ ・ ・ e (g ₁ , g ₂ )… (39)
And satisfying equation (2), equation (39) is
e (σ, w ・ α) = e (g ₁ , g ₂ ^{(m + y + β ・ z)} )… (40)
And can be transformed. And since u = g ₂ ^y and v = g ₂ ^z are set, Equation (40) becomes
e (σ, w · α) = e (g ₁ , g ₂ ^m u · v ^β ) = the right side of the equation (30).

[Effect of this embodiment]
A hash function is not used in the blind signature of this embodiment. Further, the security of the blind signature generation process and the blind signature verification process of this embodiment is based on the difficulty of solving the Strong Diffile-Hellman problem, and can be said to be safe. Furthermore, the processing speed of the blind signature generation processing and the blind signature verification processing according to the present embodiment is similar to that of the most widely used RSA signature at present, and has high practicality.
[Modification]
The present invention is not limited to the embodiment described above. For example, in this embodiment, the user device 120 can hold or calculate (m · t mod p, t, s · t mod p) in steps S125, S126 (FIG. 13) and step S104 (FIG. 12). This fact is proved to the blind signature generation device 110 without disclosing at least m, and the processing after step S106 (FIG. 12) is executed only when this certification is successful. However, the processing after step S106 (FIG. 12) may be executed without performing this proof processing.

In this embodiment, ψ is an isomorphism from G ₂ to G ₁ . However, a configuration in which ψ is a homomorphic map from G ₂ to G ₁ may be used.
In this embodiment, the blind signature generation apparatus 110 converts r, L into {0, 1,. . . , P−1} are selected at random, R = g ₂ ^r is calculated, and L and R together with Y are transmitted to the user apparatus 120. However, the blind signature generation apparatus 110 may be configured not to select, calculate, or transmit R or L. In this case, for example, it is assumed that the blind signature generation apparatus 110 and the user apparatus 120 share r and L in advance, and the blind signature generation apparatus 110 uses these to generate Y = (X · ψ (v) ^L ) ^{1 / (x + r)} is calculated, and the user apparatus 120 uses these r and L to calculate R = g ₂ ^r , α = w ^f−1 · R ^f and β = s + L / t mod p. calculate.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually as required by the processing capability of the apparatus that executes the process, or otherwise. Needless to say, changes can be made without departing from the scope of the present invention.
The program describing the processing contents of each embodiment can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
As another execution form of such a program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and the program is transferred to the computer from the server computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  Examples of the industrial application field of the present invention include the field of electronic cash and electronic voting.

FIG. 1 is a block diagram illustrating the overall configuration of a blind signature generation / verification system according to the first embodiment. FIG. 2 is a block diagram illustrating a detailed configuration of the blind signature generation apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a detailed configuration of the user device according to the first embodiment. FIG. 4 is a block diagram illustrating a detailed configuration of the blind signature verification apparatus according to the first and second embodiments. FIG. 5 is a flowchart for explaining processing of the blind signature generation apparatus according to the first embodiment. FIG. 6 is a flowchart for explaining the process of the user device according to the first embodiment. FIG. 7 is a flowchart for explaining processing of the blind signature verification apparatus according to the first and second embodiments. FIG. 8 is a flowchart for explaining a specific example of the processing in steps S26, S27 and S7. FIG. 9 is a block diagram illustrating the overall configuration of the blind signature generation / verification system according to the second embodiment. FIG. 10 is a block diagram illustrating a detailed configuration of the blind signature generation apparatus according to the second embodiment. FIG. 11 is a block diagram illustrating a detailed configuration of the user device according to the second embodiment. FIG. 12 is a flowchart for explaining processing of the blind signature generation apparatus according to the second embodiment. FIG. 13 is a flowchart for explaining processing of the user device according to the second embodiment. FIG. 14 is a flowchart for explaining a specific example of the processing of S125, S126, and step S104.

Explanation of symbols

1,101 Blind Signature Generation / Verification System 10, 110 Blind Signature Generation Device 20, 120 User Device 30 Blind Signature Verification Device

Claims (20)

A blind signature generation / verification method executed by a blind signature generation device, a user device, and a blind signature verification device,
A secret key generation unit of the blind signature generation device generates a secret key xε {0, 1,..., P−1} when p is a prime number, and stores it in the storage unit;
When the public key generation unit of the blind signature generation apparatus uses G ₁ and G ₂ as a cyclic group of order p, g ₁ as the generation source of G ₁ , and g ₂ as the generation source of G ₂ and storing keys _{g 1, g 2, w =} g 2 x, u∈G 2, the storage unit generates a v∈G _2,
A step in which the h calculation unit of the blind signature generation device calculates h = g ₂ ^r (rε {0, 1,..., P−1}) and stores it in the storage unit;
A step of transmitting a h to the user device by a transmission unit of the blind signature generation device;
A receiving unit of the user device receiving h;
Receiving a public key g ₁ , w, u, v transmitted from at least the blind signature generation device by a receiving unit of the user device;
When the X calculation unit of the user apparatus sets ψ to G ₂ to G ₁ mapping ψ (g ₂ ) = g ₁ and m is signature object information, X = g ₁ ^m · ψ (u) · calculating ψ (v) ^s · (ψ (w · h)) ^R (s, Rε {0, 1,..., p−1}) and storing it in the storage unit;
A transmitting unit of the user device transmitting X to the blind signature generating device;
A receiving unit of the blind signature generation device receiving X;
The Y calculation unit of the blind signature generation device calculates and stores Y = (X · g ₁ ^{L · z} ) ^{1 / (x + r)} (L, zε {0,1,..., P−1}). A step of storing in the department;
A step of transmitting at least Y to the user device by the transmission unit of the blind signature generation device;
The receiving unit of the user device receives at least Y;
A σ calculation unit of the user device calculates σ = (Y / g ₁ ^R ) ^{1 / t} (t∈ {0, 1,..., P−1}) and stores it in the storage unit;
An α calculation unit of the user device calculates α = w ^t−1 · h ^t and stores it in the storage unit;
A transmitting unit of the user device transmitting the signature object information m and the blind signature (σ, α, β) (β = s + L mod p) to the blind signature verification device;
Receiving a signature target information m and the blind signature (σ, α, β) by a receiving unit of the blind signature verification device;
Receiving a public key g ₁ , g ₂ , w, u, v transmitted from the blind signature generation device by a receiving unit of the blind signature verification device;
Signature verification unit of the blind signature verification device, in the case where the e was bilinear mapping of _{G 1 × G 2 → G T} , σ ≠ 1, α∈G 2, e (σ, w · α) = e (g ₁ , g ₂ ^m · u · v ^β ) holds,
A blind signature generation / verification method comprising: The blind signature generation / verification method according to claim 1,
Certification result information for the certification result information generation unit of the user device to prove to the blind signature generation device without disclosing at least m that the user device holds (m, s, R) Generating and storing it in the storage unit;
A transmitting unit of the user device transmitting the certification result information to the blind signature generating device;
A receiving unit of the blind signature generating device receiving the certification result information;
A verification result verification unit of the blind signature generation device has a step of verifying the verification result information,
The process for the Y calculation unit of the blind signature generation apparatus to calculate Y is as follows:
It is executed only when the proof verification unit of the blind signature generation device determines that the proof result information is acceptable,
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 2,
A step in which a random number generation unit of the user device randomly selects a ₁ , a ₂ , a ₃ from {0, 1,..., P−1} and stores them in the storage unit;
The W calculation unit of the user device W = g ₁ ^a1 · ψ (v) ^a2 · (ψ (w · h)) ^a3 (The superscripts a1, a2, and a3 are a ₁ , a ₂ , a 3, respectively. ₃ ) and storing it in the storage unit;
A transmitting unit of the user device transmitting W to the blind signature generating device;
A receiving unit of the blind signature generation device receiving W;
After W is received, the random number generation unit of the blind signature generation device randomly selects η from {0, 1,..., P−1} and stores it in the storage unit;
A transmission unit of the blind signature generation device transmits η to the user device;
A receiving unit of the user device receives η, and
The above proof result information is
z ₁ = a ₁ + η · m mod p, z ₂ = a ₂ + η · s mod p, z ₃ = a ₃ + η · R mod p,
The proof result verification unit of the blind signature generation device
g ₁ ^z1 · ψ (v) ^z2 · (ψ (w · h)) ^z3 ≡W · (X / ψ (u)) ^η (subscripts z1, z2, and z3 are z ₁ , z ₂ , the proof result information is verified according to whether or not z ₃ is satisfied).
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 1,
The map ψ is an isomorphic map from G ₂ to G ₁ .
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 1,
When the secret key generation unit of the blind signature generation device generates the secret key x, the secret key generation unit further generates a secret key zε {0, 1,..., P−1} and stores it in the storage unit. And
The public key generated by the public key generation unit of the blind signature generation device is v = g ₂ ^z ,
After the step of receiving X by the receiving unit of the blind signature generating device, before the step of calculating the Y by the Y calculating unit of the blind signature generating device and storing it in the storage unit, the random number generating unit of the blind signature generating device, A step of randomly selecting L from {0, 1,..., P−1} and storing it in the storage unit;
The transmission unit of the blind signature generation apparatus transmits L together with Y to the user apparatus,
The receiving unit of the user apparatus receives L together with Y,
After the step in which the receiving unit of the user device receives L together with Y, the step of transmitting the signature object information m and the blind signature (σ, α, β) to the blind signature verification device by the transmitting unit of the user device The β calculation unit of the user device further includes a step of calculating β = s + L mod p and storing it in the storage unit.
A blind signature generation / verification method characterized by the above. A blind signature generator,
A secret key generation unit, a public key generation unit, a transmission unit, a reception unit, an h calculation unit, and a Y calculation unit,
The secret key generation unit generates a secret key xε {0, 1,..., P−1} where p is a prime number,
The public key generation unit, a cyclic group of number digit of _{G 1} and _{G 2} is p, the _{g 1} and a generator of _{G 1,} in the case where the _{g 2} and a generator of _{G 2,} the public key _g 1, ^{_{g 2, w = g 2 x}} , u∈G 2, to generate a v∈G _2,
The transmission unit transmits at least a part of the public keys g ₁ , g ₂ , w, u, v to the user device and the blind signature verification device,
The h calculation unit calculates h = g ₂ ^r (r∈ {0, 1,..., P−1}),
The transmission unit transmits h to the user device,
The receiving unit receives X transmitted from the user device,
The Y calculation unit calculates Y = (X · g ₁ ^{L · z} ) ^{1 / (x + r)} (L, zε {0,1,..., P−1}),
The transmission unit transmits at least Y to the user device;
A blind signature generation apparatus characterized by the above. A user device,
A transmitter, a receiver, an X calculator, a σ calculator, and an α calculator;
The receiving unit receives at least h and public keys g ₁ , w, u, v,
The X calculator, a cyclic group of number digit of _{G 1} and _{G 2} is p, the _{g 1} and a generator of _{G 1,} the _{g 2} is a generator of _{G 2,} the ψ from _{G 2} to _{G 1} X = g ₁ ^m · ψ (u) · ψ (v) ^s · (ψ (w · h)) ^R (s, where m ψ (g ₂ ) = g ₁ and m is signature target information R∈ {0,1, ..., p-1})
The transmission unit transmits X to the blind signature generation device,
The receiving unit receives at least Y transmitted from the blind signature generation device,
The σ calculator calculates σ = (Y / g ₁ ^R ) ^{1 / t} (tε {0, 1,..., P−1}),
The α calculation unit calculates α = w ^t−1 · h ^t ,
The transmission unit displays the signature target information m and the blind signature (σ, α, β) (β = s + L mod p, Lε {0, 1,..., P−1}) as a blind signature verification device. Send to
A user device characterized by that. A blind signature verification device,
A receiving unit and a signature verification unit;
The receiving unit receives the signature object information m, the blind signature (σ, α, β), and the public keys g ₁ , g ₂ , w, u, v,
The signature verification unit, the prime p, the G ₁ and G ₂ and of order is a cyclic group of p, in the case where the e was bilinear mapping of _{G 1 × G 2 → G T} , σ ≠ 1, α It is verified whether or not εG ₂ , e (σ, w · α) = e (g ₁ , g ₂ ^m · u · v ^β ) holds.
A blind signature verification apparatus characterized by the above. A blind signature generation / verification system comprising a blind signature generation device, a user device, and a blind signature verification device,
The blind signature generation apparatus includes a secret key generation unit, a public key generation unit, a transmission unit, a reception unit, an h calculation unit, and a Y calculation unit.
The secret key generation unit generates a secret key xε {0, 1,..., P−1} when p is a prime number, and the public key generation unit ranks G ₁ and G ₂ the number is a cyclic group of p, the _{g 1} and a generator of _{G 1,} in the case where the _{g 2} and a generator of _{G 2,} the public key _{g 1, g 2, w =} g 2 x, u∈G 2, vεG ₂ is generated, and the transmission unit of the blind signature generation device transmits at least part of the public keys g ₁ , g ₂ , w, u, v to the user device and the blind signature verification device, and the h The calculation unit calculates h = g ₂ ^r (rε {0, 1,..., P−1}), the transmission unit transmits h to the user apparatus, and the reception unit uses X transmitted from the user device is received, and the Y calculation unit Y = (X · g ₁ ^{L · z} ) ^{1 / (x + r)} (L, zε {0,1,..., P−1) }) And above Transmission of the blind signature generation apparatus transmits to the user device at least Y,
The user device includes a transmission unit, a reception unit, an X calculation unit, a σ calculation unit, and an α calculation unit, and the reception unit of the user device includes h and public keys g ₁ , w, At least u and v are received, and the X calculation unit X = g ₁ ^m when ψ is a mapping ψ (g ₂ ) = g ₁ from G ₂ to G ₁ and m is signature target information Ψ (u) · ψ (v) ^s · (ψ (w · h)) ^R (s, Rε {0, 1,..., P−1}) The transmission unit transmits X to the blind signature generation device, the reception unit of the user device receives at least Y transmitted from the blind signature generation device, and the σ calculation unit is σ = (Y / g ₁ ^R ) ^{1 / t} (tε {0, 1,..., P−1}), and the α calculation unit calculates α = w ^t−1 · h ^t , and the user device The sending part of Elephant information m, blind signature (sigma, alpha, beta) and sent, the blind signature verification device,
The blind signature verification apparatus includes a receiving unit and a signature verification unit,
The reception unit of the blind signature verification apparatus receives the signature target information m, the blind signature, and the public keys g ₁ , g ₂ , w, u, and v. The signature verification unit sets p as a prime number and G ₁ the _{G 2} and of order is a cyclic group of p and, in the case where the e was bilinear mapping of _{G 1 × G 2 → G T} , σ ≠ 1, α∈G 2, e (σ, w · α) = verify whether e (g ₁ , g ₂ ^m · u · v ^β ) (β = s + L mod p) holds,
This is a blind signature generation / verification system. A blind signature generation / verification method executed by a blind signature generation device, a user device, and a blind signature verification device,
A secret key generation unit of the blind signature generation device generates a secret key xε {0, 1,..., P−1} when p is a prime number, and stores it in the storage unit;
When the public key generation unit of the blind signature generation apparatus uses G ₁ and G ₂ as a cyclic group of order p, g ₁ as the generation source of G ₁ , and g ₂ as the generation source of G ₂ and storing keys _{g 1, g 2, w =} g 2 x, u∈G 2, the storage unit generates a v∈G _2,
Receiving a public key g ₁ , u, v transmitted from at least the blind signature generation device by a receiving unit of the user device;
X = (g ₁ ^m · ψ (u) in the case where the X calculation unit of the user device sets ψ as a mapping ψ (g ₂ ) = g ₁ from G ₂ to G ₁ and m as signature object information. Calculating ψ (v) ^s ) ^t (s, tε {0, 1,..., P−1}) and storing it in the storage unit;
A transmitting unit of the user device transmitting X to the blind signature generating device;
A receiving unit of the blind signature generation device receiving X;
The Y calculation unit of the blind signature generation apparatus calculates Y = (X · (ψ (v)) ^L ) ^{1 / (x + r)} (r, Lε {0, 1,..., P−1}). Storing in the storage unit,
A step of transmitting at least Y to the user device by the transmission unit of the blind signature generation device;
The receiving unit of the user device receives at least Y;
A receiving unit of the user device receiving the public key w transmitted from the blind signature generating device;
A τ calculation unit of the user device calculates τ = (f · t) ⁻¹ mod p (fε {0, 1,..., P−1}) and stores it in the storage unit;
A σ calculation unit of the user device calculates σ = Y ^τ and stores it in the storage unit;
The α calculation unit of the user device calculates α = w ^f−1 · R ^f (R = g ₂ ^r , rε {0, 1,..., P−1}) and stores it in the storage unit. Steps,
Transmitting a signature target information m and a blind signature (σ, α, β) (β = s + L / t mod p) to the blind signature verification device;
Receiving a signature target information m and the blind signature (σ, α, β) by a receiving unit of the blind signature verification device;
Receiving a public key g ₁ , g ₂ , w, u, v transmitted from the blind signature generation device by a receiving unit of the blind signature verification device;
Signature verification unit of the blind signature verification device, in the case where the e was bilinear mapping of _{G 1 × G 2 → G T} , σ ≠ 1, α∈G 2, e (σ, w · α) = e (g ₁ , g ₂ ^m · u · v ^β ) holds,
A blind signature generation / verification method comprising: The blind signature generation / verification method according to claim 10,
The proof result information generation unit of the user device proves to the blind signature generation device that at least m is not disclosed, that (m · t mod p, t, s · t mod p) can be held or calculated. Generating proof result information for storing and storing it in a storage unit;
A transmitting unit of the user device transmitting the certification result information to the blind signature generating device;
A receiving unit of the blind signature generating device receiving the certification result information;
A verification result verification unit of the blind signature generation device has a step of verifying the verification result information,
The process for the Y calculation unit of the blind signature generation apparatus to calculate Y is as follows:
It is executed only when the proof verification unit of the blind signature generation device determines that the proof result information is acceptable,
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 11,
A step in which a random number generation unit of the user device randomly selects a ₁ , a ₂ , a ₃ from {0, 1,..., P−1} and stores them in the storage unit;
The W calculation unit of the user apparatus W = g ₁ ^a1 · ψ (u) ^a2 · ψ (v) ^a3 (superscripts a1, a2, and a3 indicate a ₁ , a ₂ , and a ₃ , respectively) Calculating and storing in the storage unit;
A transmitting unit of the user device transmitting W to the blind signature generating device;
A receiving unit of the blind signature generation device receiving W;
After W is received, the random number generation unit of the blind signature generation device randomly selects η from {0, 1,..., P−1} and stores it in the storage unit;
A transmission unit of the blind signature generation device transmits η to the user device;
A receiving unit of the user device receives η, and
The above proof result information is
z ₁ = a ₁ + η · m · t mod p, z ₂ = a ₂ + η · t mod p, z ₃ = a ₃ + η · s · t mod p,
The proof result verification unit of the blind signature generation device
^{_{g 1 z1 · ψ (u)}} z2 · ψ (v) z3 ≡W · X η ( superscript z1, z2, z3 represents the _{z 1,} z 2, _{z 3,} respectively) depending on whether or not is satisfied , Verify the above proof result information,
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 10,
The map ψ is an isomorphic map from G ₂ to G ₁ .
A blind signature generation / verification method characterized by the above. The blind signature generation / verification method according to claim 10,
After the step of receiving X by the receiving unit of the blind signature generating device, before the step of transmitting at least Y to the user device by the transmitting unit of the blind signature generating device, the random number generating unit of the blind signature generating device uses r, L Are randomly selected from {0, 1,..., P−1} and stored in the storage unit, and the R calculation unit calculates R = g ₂ ^r and stores it in the storage unit. And
The transmission unit of the blind signature generation device transmits R and L together with Y to the user device,
The receiving unit of the user device receives R and L together with Y,
The α calculation unit of the user device calculates α = w ^f−1 · R ^f using the received R,
After the step in which the receiving unit of the user apparatus receives both R and L together with Y, the transmitting unit of the user apparatus transmits the signature object information m and the blind signature (σ, α, β) to the blind signature verification apparatus. Before the step, the β calculation unit of the user apparatus further includes a step of calculating β = s + L / t mod p and storing it in the storage unit.
A blind signature generation / verification method characterized by the above. A blind signature generator,
A secret key generation unit, a public key generation unit, a transmission unit, a reception unit, and a Y calculation unit;
The secret key generation unit generates a secret key xε {0, 1,..., P−1} where p is a prime number,
The public key generation unit, a cyclic group of number digit of _{G 1} and _{G 2} is p, the _{g 1} and a generator of _{G 1,} in the case where the _{g 2} and a generator of _{G 2,} the public key _g 1, ^{_{g 2, w = g 2 x}} , u∈G 2, to generate a v∈G _2,
The receiving unit receives X transmitted from the user device,
The Y calculation unit calculates Y = (X · (ψ (v)) ^L ) ^{1 / (x + r)} (r, Lε {0, 1,..., P−1}),
The transmission unit transmits at least Y to the user device;
A blind signature generation apparatus characterized by the above. A user device,
A transmitter, a receiver, an X calculator, a τ calculator, a σ calculator, and an α calculator;
The reception unit receives at least the public keys g ₁ , u, v transmitted from the blind signature generation device,
The X calculation unit X = (g ₁ ^m · ψ (u) · ψ () when ψ is a mapping ψ (g ₂ ) = g ₁ from G ₂ to G ₁ and m is signature object information. v) Calculate ^s ) ^t (s, tε {0,1, ..., p-1})
The transmission unit transmits X to the blind signature generation device,
The receiving unit receives at least Y transmitted from the brand signature generation device,
The receiving unit receives the public key w transmitted from the blind signature generation device,
The τ calculation unit calculates τ = (f · t) ⁻¹ mod p (fε {0, 1,..., P−1}),
The σ calculation unit calculates σ = Y ^τ ,
The α calculation unit calculates α = w ^f−1 · R ^f (R = g ₂ ^r , r∈ {0, 1,..., P−1}),
The transmission unit transmits the signature target information m and the blind signature (σ, α, β) (β = s + L / t mod p) to the blind signature verification device.
A user device characterized by that. A blind signature generation / verification system comprising a blind signature generation device, a user device, and a blind signature verification device,
The blind signature generation device includes a secret key generation unit, a public key generation unit, a transmission unit, a reception unit, and a Y calculation unit.
The secret key generation unit generates a secret key xε {0, 1,..., P−1} when p is a prime number, and the public key generation unit ranks G ₁ and G ₂ the number is a cyclic group of p, the _{g 1} and a generator of _{G 1,} in the case where the _{g 2} and a generator of _{G 2,} the public key _{g 1, g 2, w =} g 2 x, u∈G 2, vεG ₂ is generated, the reception unit receives X transmitted from the user device, and the Y calculation unit Y = (X · (ψ (v)) ^L ) ^{1 / (x + r)} ( r, Lε {0, 1,..., p−1}), and the transmitting unit transmits at least Y to the user device,
The user device includes a transmission unit, a reception unit, an X calculation unit, a τ calculation unit, a σ calculation unit, and an α calculation unit,
The reception unit receives at least the public keys g ₁ , u, v transmitted from the blind signature generation device, and the X calculation unit maps ψ from G ₂ to G ₁ ψ (g ₂ ) = g ₁ And X = (g ₁ ^m · ψ (u) · ψ (v) ^s ) ^t (s, t∈ {0, 1,..., P−1}) where m is the signature object information. The transmitting unit transmits X to the blind signature generating device, the receiving unit receives at least Y transmitted from the brand signature generating device, and the receiving unit is transmitted from the blind signature generating device. The public key w is received, and the τ calculation unit calculates τ = (f · t) ⁻¹ mod p (fε {0, 1,..., P−1}), and the σ calculation unit. Calculates σ = Y ^τ , and the α calculation unit calculates α = w ^f−1 · R ^f (R = g ₂ ^r , rε {0, 1,..., P−1}). And Serial transmission section transmits the signature target information m, blind signature (sigma, alpha, beta) and (β = s + L / t mod p), the blind signature verification device,
The blind signature verification apparatus includes a receiving unit and a signature verification unit,
The receiving unit receives the signature object information m, the blind signature (σ, α, β), and the public keys g ₁ , g ₂ , w, u, v, and the signature verification unit converts e into G ₁ in case of a bilinear map _{× G 2 → G T, σ} ≠ 1, α∈G 2, e (σ, w · α) = e (g 1, g 2 m · u · v β) is established Verify whether or not
This is a blind signature generation / verification system.   A blind signature generation program for causing a computer to function as the blind signature generation device according to claim 6 or 15.   A user program for causing a computer to function as the user device according to claim 7. A blind signature verification program for causing a computer to function as the blind signature verification apparatus according to claim 8.

Images