Digital signature system, method, and program

Abstract

To make it possible to prevent leakage of biometric information for a key and a signature that use information dependent on biometric information, thereby increasing safety.SOLUTION: A signature conversion device (first processing device) receives a first parameter created using a first signing key and first biometric information, a second parameter created using a second signing key and second biometric information, and a second signature for a message created by the second signing key, and performs a process of calculating a first signature for the message that can be verifiable with a first verification key corresponding to the first signing key, using at least the first parameter, the second parameter, and the second signature.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a digital signature system, method, and program. [Background technology]

[0002] Digital signatures are a technology that can verify the creator of a document and that it has not been tampered with since its creation.

[0003] <Digital signature algorithm> Key generation: Generate a pair of signing key (private key) sk and verification key (public key) vk. (sk, vk)←KeyGen(1 κ ) …(1) κ is a security parameter.

[0004] In some cases, instead of the key generation algorithm receiving the security parameters directly, the setup algorithm receives common (public) parameters generated from the security parameters and generates a pair of a signing key (private key) sk and a verification key (public key) vk.

[0005] Signature: Generate a signature σ for a message (document) M using a signing key sk. In other words, generate a signature σ using the signing key (private key) sk for the message M to be signed or the hash value (message digest) obtained by inputting the message M into a hash function. σ←Sign(sk, M) …(2)

[0006] Verification: Verify the correctness of the pair of message (document) M and signature σ using the verification key vk. 0 / 1←Verify(vk, M, σ) …(3) Here, acceptance is set to 1, and rejection is set to 0.

[0007] In a digital signature, if the public key is made public, anyone who obtains the pair of the document and the signature can verify it. In other words, a public verification key is used to verify whether the signature for the document was generated using a signature key, which is a private key that corresponds to the public key. Digital signatures are used for various purposes, such as protecting e-mail (S / MIME (Secure / Multipurpose Internet Mail Extensions)) and electronic contracts. For example, instead of a seal on a written contract, the contracting party's digital signature is added to the electronic data of the contract. In addition, when transferring virtual currency, a message containing information such as "how much to send to which address" and the sender's digital signature for that message are recorded in the blockchain. The transfer process is completed when this signature is correctly verified.

[0008] Digital signatures lose security if the signing key is lost or stolen, but it is difficult for general users to properly manage signing keys. If signing keys are not properly managed, there is a risk that they may be lost or stolen. If signing keys are not properly managed, the "signer" may not be able to generate a correct signature (e.g., if the signing key is lost), or someone other than the "signer" may be able to generate a correct signature (e.g., if the signing key is stolen).

[0009] The security of digital signatures is based on the fact that the signing key is kept secret. If an attacker obtains the signing key, he or she can generate a valid signature. In other words, what a digital signature guarantees is that "someone who holds the signing key has affixed a signature to a document," not that "a 'signer' affixed a signature to a document." The more keys a user has to manage, the more difficult it becomes to manage them.

[0010] A signature using biometric information reduces the risk of losing a key more than a digital signature by using the biometric information instead of a key. However, when using a key that relies on biometric information, leakage of the biometric information means leakage of the key. Since it is difficult to change biometric information, once the biometric information is leaked, the key generated from the biometric information can no longer be used safely. Patent Document 1 proposes a system that can generate a signature for any message (electronic document) using the biometric information itself as a secret key, without requiring data other than the biometric information (such as auxiliary information). [Prior art documents] [Patent documents]

[0011] [Patent Document 1] Patent No. 5707311 Summary of the Invention [Problem to be solved by the invention]

[0012] In digital signatures, the signature and verification key may be made public, and there are many use cases in which a third party verifies the signature. In Patent Document 1 and other documents, a verification key (biometric certificate) including information dependent on biometric information and a signature (biometric signature) including information dependent on biometric information are transmitted to a verification device, and there is a possibility that the biometric information or a part of it may be leaked from this information.

[0013] An object of the present disclosure is to provide a system, method, and program that can prevent leakage of biometric information for keys and signatures that use information dependent on biometric information, thereby enhancing security. [Means for solving the problem]

[0014] One digital signature system provided by the present disclosure includes a first processing device having at least a processor and a communications interface, wherein the first processing device receives first parameters created using a first signing key and first biometric information, second parameters created using a second signing key and second biometric information, and a second signature for a message created by the second signing key, and calculates a first signature for the message using at least the first parameters, the second parameters, and the second signature, which can be verifiable with a first verification key corresponding to the first signing key.

[0015] One digital signature method provided by the present disclosure includes a first node receiving first parameters created using a first signing key and first biometric information, second parameters created using a second signing key and second biometric information, and a second signature for a message using the second signing key, and calculating a first signature for the message using at least the first parameters, the second parameters, and the second signature, which can be verifiable with a first verification key corresponding to the first signing key.

[0016] The program provided by the present disclosure comprises a program that receives first parameters created using a first signing key and first biometric information, second parameters created using a second signing key and second biometric information, and a second signature for a message created by the second signing key, and executes a process of calculating a first signature for the message that can be verifiable using at least the first parameters, the second parameters, the second signature, and a first verification key corresponding to the first signing key. Effect of the Invention

[0017] According to the present disclosure, it is possible to prevent leakage of biometric information for keys and signatures that use information dependent on biometric information, thereby improving safety. [Brief description of the drawings]

[0018] [Figure 1] FIG. 13 is a diagram illustrating a comparative example. [Diagram 2] FIG. 11 is an explanatory diagram for explaining a calculation process of a comparative example. [Diagram 3] FIG. 1 is a diagram illustrating an embodiment of the present disclosure. [Figure 4] FIG. 4 is an explanatory diagram illustrating a calculation process according to an embodiment of the present disclosure. [Diagram 5] FIG. 4 is an explanatory diagram illustrating a calculation process according to an embodiment of the present disclosure. [Figure 6] FIG. 1 is a diagram illustrating a configuration of an embodiment of the present disclosure. [Figure 7] FIG. 2 is a diagram illustrating a processing sequence according to an embodiment of the present disclosure. [Figure 8] FIG. 2 is a diagram illustrating a processing sequence according to an embodiment of the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating a processing sequence according to an embodiment of the present disclosure. [Figure 10] FIG. 11 is an explanatory diagram illustrating another calculation process according to the embodiment of the present disclosure. [Figure 11] FIG. 13 is a diagram illustrating another configuration of the embodiment of the present disclosure. [Figure 12] FIG. 11 is a diagram illustrating another processing sequence according to an embodiment of the present disclosure. [Figure 13] FIG. 6 is an explanatory diagram for explaining a modified example of the calculation process (FIG. 5) according to the embodiment of the present disclosure. [Figure 14] 10 is an explanatory diagram illustrating a modified example of another arithmetic process (FIG. 10) according to the embodiment of the present disclosure. FIG. [Figure 15] 13(A) and 13(B) are diagrams for explaining an example of implementation on a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] An exemplary embodiment of the present disclosure will be described. First, a comparative example will be described with reference to FIG. 1. FIG. 1 has been newly created to contribute to understanding the premise of the present disclosure. The comparative example of FIG. 1 can also be made to correspond to the disclosure of Patent Document 1 and the like. Referring to FIG. 1, a signature system (biometric signature system) 200 of the comparative example includes a key generation device 210, a signature generation device 220, and a verification device 230. The key generation device 210 generates a pair of a first signature key x and a first verification key v, generates a first parameter s (also called a "registration commitment") using biometric information for registration (first biometric information) w and the first signature key x, and transmits a verification key (s, v) (also called a "biometric certificate") including the first parameter to the verification device 230. The signature generating device 220 generates a pair of a second signing key x' and a second verification key v', generates a second signature σ' by the second signing key x' for a message M, generates a second parameter s' (also called a "signing commitment") by using biometric information for signing (second biometric information) w' and the second signing key x', and transmits the message M and a signature (s', v', σ') (also called a "biometric signature") including the second parameter to the verification device 230. The verification device 230 verifies whether the pair of the message M and the second signature σ' is correct by using the second verification key v', and verifies whether the difference between the first signing key x and the second signing key x' calculated from the first parameter s and the second parameter s' corresponds to the relationship between the first verification key v and the second verification key v'.

[0020] 2 is a diagram for explaining an example of the computation process of each device in FIG. 1. The key generation device 210 acquires biometric information for registration (first biometric information) w (1). The key generation device 210 generates a pair (x, v) of a first signature key x and a first verification key v (2). The key generation device 210 inputs the first signature key x to an encoding function Encode to obtain an encoded value ENC(x), and calculates a first parameter s using the ENC(x) and the biometric information for registration (first biometric information) w (3). The key generation device 210 transmits a verification key (s, v) (biometric certificate) including the first parameter s (information dependent on the biometric information) to the verification device 230 (4).

[0021] The signature generation device 220 acquires biometric information for signing (second biometric information) w' (1). The signature generation device 220 acquires a message M (electronic document) (2). The signature generation device 220 generates a pair of a second signature key x' and a second verification key v' (3). The signature generation device 220 inputs the second signature key x' to an encoding function Encode to obtain an encoded value ENC(x'), and calculates a second parameter s' using ENC(x') and the biometric information for signing (second biometric information) w' (4). The signature generation device 220 generates a second signature σ' (=Sign(x',M)), which is a digital signature for the message M using the second signature key x' (5). The signature generation device 220 transmits a signature (s', v', σ') (a signature including the parameter s') including the second parameter s', the second verification key v', and the second signature σ', and the message M to the verification device 230 (6).

[0022] The verification device 230 receives a verification key (s, v) (biometric certificate) including a first parameter s (information dependent on the first biometric information w) (1). The verification device 230 receives a signature (s', v', σ') including a second parameter s' (information dependent on the second biometric information w') and a message M (2).

[0023] The verification device 230 verifies the correctness of the set of the message M and the digital signature (second signature) σ′ using the second verification key v′ (3). 0 / 1←Verify(v', M, σ') …(4)

[0024] The verification device 230 calculates a key difference (differential key) Δ between the first signature key x and the second signature key x′ from the first parameter s and the second parameter s′ (4). Δ←Diff(s, s') …(5) Here, Diff is a function that takes s and s' as input and returns the difference between the first signing key x and the second signing key x'.

[0025] The verification device 230 verifies whether the key difference (differential key) Δ between the first signature key x and the second signature key x′ and the correspondence between the first verification key v and the second verification key v′ are correct (5). 0 / 1←DiffVer(v, v', Δ) ​​…(6) Here, DiffVer is a function that returns 1 if the correspondence between the difference key Δ and the first and second verification keys v and v′ is correct, and returns 0 otherwise.

[0026] These devices may be configured to be communicatively connected via a network (eg, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0027] In Patent Document 1, the biometric certificate T consists of T = (user ID, public key KPe, registration commitment Ce, S (electronic signature for a pair of user ID and biometric public key (KPe, Ce)), but in Figure 2, this biometric certificate is (s, v). s and v can be made to correspond to the registration commitment Ce and public key KPe of the biometric certificate in Patent Document 1, respectively. Also, in Patent Document 1, the biometric signature consists of (user ID, temporary public key KPs, signing commitment Cs, digital signature σ'), but in Figure 2, the biometric signature is (s', v', σ'). s', v', σ' can be made to correspond to the signing commitment Cs, temporary public key KPs, and digital signature σ' of the biometric signature in Patent Document 1, respectively.

[0028] The parameters s and s' included in the biometric certificate and biometric signature are secure sketches. It is known that biometric information is partially leaked in secure sketches. In applications such as blockchain (public blockchain), it is clear that the signature and verification key publicly stored in the ledger should be information that does not leak biometric information, and more strictly, it is desirable that the information to be made public does not depend on the biometric information. That is, in the comparative example, in (s', v', σ') (signature including parameter s') and verification key (s, v) (verification key including parameter s) transmitted to the verification device, the first parameter s and the second parameter s' are information that depends on the biometric information w and w', respectively, and if these are made public, there is a possibility that part of the biometric information may be leaked.

[0029] For example, according to Reference 1, the probability of predicting a random value (e.g. guessing a secret key) is expressed as the max a Pr[A = a], and the min-entropy H ∞ (A) is given by: H ∞ (A)=-log(max a Pr[A = a]) …(7) The minimum entropy of a probability distribution represents how many nearly uniform random bits can be extracted from it. The security property is that for any distribution w (e.g., the biometric information in this application) on a metric space M with minimum entropy m, the value of w can be decoded by an attacker who observes s in a way that is smaller than 2^(- ~ m) (^ is the power operator) or higher probability of recovery. ~ H ∞ (w|SS(w))>= ~ m …(8) It is. Here, SS(w) generates a sketch (parameter) s from w (s ← SS(w)). ~ m is the residual (min) entropy of the secure sketch. ~ H ∞ is the average min-entropy ( ~ H ∞ is the chance that an attacker will succeed in predicting A when he finds the value b of B for random variables A and B. For example, the average (E b←B [max a Pr[A = a|B = b]]).

[0030] λ = m - ~m is called the entropy loss of the secure sketch. For the minimum entropy m of the biometric information alone, ~m is the minimum entropy of the biometric information under the condition that the attacker knows the parameter s (sketch). If the attacker knows the parameter s, m-m' bits of information about the biometric information will be known. In the case of the code-offset based secure sketch (Hamming code) adopted in the biometric signature method, ~m=m - (n - k)f …(9) and There is a possibility that about λ = m - ~m = (n - k)f bits of information may be leaked. In equation (9), f is log2(|F|) (|F| is the order of the field F, and the Hamming metric space is F^ n The field F is, for example, {0,1}), n is the code length, and k is the number of information bits.

[0031] In code-offset based secure sketch, for input w (e.g. biometric information), a random x is selected, codeword c = C(x) is calculated, and sketch SS(w) is the shift required to get from c to w (s ← SS(w) = w -c). In function Rec(w', s), which restores w from s and w', c' is obtained by subtracting the shift s from w', and c' is decoded to obtain c (note that since dis(w',w) ≦ t, the distance d(c',c) between c' and c is also the same), and s is added to this to calculate w (w = c + s).

[0032] As with the above-mentioned secure switch, if a commitment in which a private key is encoded and embedded in biometric information (the above-mentioned registration commitment or signature commitment) is made public, there is a possibility that part of the biometric information may be leaked. In other words, there is a security problem in using a signature or verification key that includes the parameters (information dependent on biometric information) of the comparative example described with reference to Figures 1 and 2 for a signature or verification key recorded in the public ledger of a blockchain.

[0033] 3 is a diagram for explaining an example of a digital signature system according to the present disclosure. Referring to FIG. 3, the digital signature system 100 includes a key generation device 110, a signature generation device 120, a verification device 130, and a signature conversion device 140.

[0034] The key generation device 110 does not transmit the verification key (s, v) including information dependent on biometric information (first parameter s) to the verification device 130, but transmits a first verification key v (a verification key not including information dependent on biometric information) to the verification device 130. The key generation device 110 transmits the first parameter s as a transformed key to the signature conversion device 140. Note that the key generation device 110 may transmit the first verification key v to a key server (public key database) not shown, and the verification device 130 may acquire the first verification key v from the key server not shown.

[0035] Similar to signature generation device 220 in FIG. 1, signature generation device 120 generates a signature (s', v', σ') (signature including second parameter s') including second parameter s', second verification key v', and second signature σ' (digital signature), but transmits the signature including second parameter s' and message M to signature conversion device 140 instead of verification device 130.

[0036] Based on the first parameter s received from the key generation device 110 and the second parameter s' included in the signature (s', v', σ') including the second parameter s' received from the signature generation device 120, the signature conversion device 140 converts the second signature σ' for the message M using the second signing key x' into a first signature σ (a signature that does not include information that depends on the biometric information) for the message M that can be verified with the first verification key v corresponding to the first signing key x, and transmits the message M and the first signature σ (a signature that does not include information that depends on the biometric information) to the verification device 130.

[0037] The verification device 130 uses the first verification key v received from the key generation device 110 to verify the correctness of the pair of the message M and the first signature σ (signature not including a parameter) received from the signature conversion device 140. 0 / 1←Verify(v, M, σ) …(10)

[0038] However, in the signature conversion device 140, the destination of the first signature σ is not limited to the verification device 130, and may be any device (node) not shown. That is, the destination of the first signature σ is not limited to the verification device 130, and a set of the first signature σ and the message M may be sent to and stored in a device other than the verification device 130, and the set of the first signature σ and the message M stored in the other device may be acquired by a device performing the verification (which may be the other device) to verify the signature. In this case, there is a difference in timing between the generation and verification of the signature, and multiple signatures may be verified together. For example, in a blockchain network (P2P (peer to peer) network), a set of a signature and a message is sent to, for example, the nearest node and temporarily stored, and the signature is verified by the node, and when it is accepted, it is propagated to other nodes. This procedure is repeated. According to the present disclosure, since the signature, etc. publicly stored in the distributed ledger does not include parameters, etc. that depend on biometric information, a part of the biometric information is not leaked at the verification node, etc.

[0039] The signature generating device 120 may be configured to receive an ID from a user, and transmit (ID, s', v', σ') to the signature converting device 140 as a signature including the second parameter s'. In this case, the signature converting device 140 may store and manage the first parameter s corresponding to the ID, and upon receiving the message M and a signature including the parameter s' from the signature generating device 120, obtain the first parameter s corresponding to the ID.

[0040] Fig. 4 is a diagram for explaining the calculation process of each device in Fig. 3. In the key generating device 110, the processes (1) to (3) are the same as those in Fig. 2, and therefore the explanation will be omitted. The first verification key v is transmitted to the verification device 130 (4), and the first parameter s (the transformed key including the parameter) is transmitted to the signature conversion device 140 (5).

[0041] In signature generation device 120, processes (1) to (5) are the same as those in Fig. 2, and therefore description thereof will be omitted. Signature generation device 120 transmits message M and a signature (s', v', σ') including second parameter s' to signature conversion device 140 (6).

[0042] The signature conversion device 140 receives a first parameter s (a transformed key including a parameter) from the key generation device 110 (1). The signature conversion device 140 receives a message M and a signature (s', v', σ') including a second parameter s' from the signature generation device 120 (2). The signature conversion device 140 converts a second signature σ' for the message M using the second signature key x' into a first signature σ (a signature not including a parameter) for the message M using the first signature key x, based on the first parameter s and the second parameter s' (3).

[0043] The signature conversion device 140 transmits the message M and the parameter-free signature (the first signature σ) to the verification device 130 (4).

[0044] Verification device 130 receives a first verification key v from key generation device 110 (1). Verification device 130 receives a message M and a signature (first signature σ) that does not include a parameter from signature conversion device 140 (2). Verification device 130 uses first verification key v to verify the correctness of the pair of message M and first signature σ (3).

[0045] Fig. 5 is a diagram for explaining an embodiment of the calculation process in each device in Fig. 4. The key generating device 110 acquires the first biometric information w (1).

[0046] The key generating device 110 generates a private key sk and a public key vk from the security parameters κ using a key generating algorithm KeyGen (2). (sk, vk)←KeyGen(1 κ ) …(11)

[0047] The key generating device 110 or any device (node) not shown may execute a setup algorithm of the digital signature method in advance, and determine a parameter pp in advance according to a security parameter κ and make it public to the user (setup). pp ← Setup(1 κ ) …(12)

[0048] The parameters pp are composed of information related to groups, hash functions, etc., and are parameters common to the system, and are referred to here as public parameters. The setup may be performed, for example, before the system is operated, and each of the devices 110, 120, 130, and 140 in the digital signature system 100 can use (share) the public parameters pp. (sk,vk) ← KeyGen(pp) …(13)

[0049] The key generation algorithm KeyGen returns a pair of the private key sk and the public key vk as return values ​​at the same time. Note that KeyGen may receive common parameters generated from security parameters by the setup algorithm, and generate a pair of the private key sk and the public key vk. In key generation, the public key vk may be generated from the private key sk using a one-way hash function (cryptographic hash function, linear hash function). Alternatively, the public key vk may be generated by vk=g^φ(sk) using a generator g of a multiplicative group G of a prime order p and a mapping φ (a mapping from a set to which the private key sk belongs to Z (Z is a set of all integers)). Alternatively, a keyed hash function or the like may be used. In the following, the private key sk and the public key vk are referred to as the first signature key x and the first verification key v. The key generation device 110 and the verification device 130 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN (Local Area Network), a wireless LAN, a WAN (Wide Area Network), a mobile communication network, a virtual network, and the like). The first verification key v is not transmitted to the verification device 130, but may be registered and stored in a key server (public key database) (not shown) in association with a key ID, etc., and the verification device 130 may obtain it from the key server (public key database) etc. as necessary.

[0050] The key generating device 110 applies an encoding function (encoding algorithm) (Encode, ENC) to the first signing key x to convert it into an encoded key ENC(x), and generates a first parameter s by synthesizing (for example, by addition or exclusive OR) the encoded key ENC(x) with the first biometric information w. The first parameter s obtained by encoding the first signing key x and embedding it in the first biometric information w is also called a first key parameter (it can also correspond to the sketch in Reference 1, the commitment in Patent Document 1, etc.). s:=ENC(x)+w …(14)

[0051] The encoding function Encode converts plaintext m contained in the source space into code c. The decode function Decode converts code c back into plaintext m. c←Encode(m) …(15) m← Decode(c) …(16)

[0052] Here, for a code c' whose difference from c, which is the code of any plaintext m included in the information source space, is within the correction capability, m = DEC(c') ... (17) needs to be true.

[0053] As will be described below, the embodiment uses a linear code, which has linearity with respect to the code.

[0054] Linearity: ENC(m1) + ENC(m2) …(18) is the codeword of m1+m2, i.e., m1 + m2 = DEC(ENC(m1) + ENC(m2)) …(19) In formula (19), the “+” on the left and right sides do not have to be the same operator.

[0055] Regarding the coding, for example, an error-correcting code (Hamming code, BCH (Bose-Chaudhuri-Hocquenghem code), RS (Reed-Solomon) code, LDPC (low-density parity-check code), etc.) may be used. Alternatively, for example, lattice coding may be used. More specifically, methods using integer lattices, methods using triangular lattices, and methods using more complicated lattices are known (see Reference 3, etc.).

[0056] The key generation device 110 transmits the first verification key v to the verification device 130 (4), and transmits the first parameter s to the signature conversion device 140 (5).

[0057] The key generating device 110 and the signature converting device 140 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like). The application of an encoding function (Encode) / decoding function (Decode) is referred to as encoding / decoding. In Fig. 4 and Fig. 5, the arrows to which information to be transmitted, such as the first parameter s and the first verification key v, are attached are a schematic representation of an example of the transmission of the information (handshaking between the sender and the destination is omitted), and of course do not mean that the communication between the sender and the destination is one-way communication. The same applies to the subsequent drawings.

[0058] In the signature generation device 120, in the stage of actually signing (signature phase), second biometric information w' is obtained (1), and a message M for signing is obtained (2). Furthermore, a pair of a second signature key x' and a second verification key v' is generated (3).

[0059] The signature generating device 120 calculates a second parameter s' by combining (for example, by addition or exclusive OR) the encoding key ENC(x') obtained by applying an encoding function (Encode) to the second signature key x' with the second biometric information w' (4). s'=ENC(x')+w' …(20)

[0060] Signature generating device 120 uses second signature key x' to generate (calculate) second signature σ' (digital signature) for message M (5). Note that, in contrast to a biometric signature, this is called a digital signature to clarify that this signature does not use (does not depend on) biometric information in the signature key. σ'←Sign(x', M) …(21)

[0061] The signature generation device 120 transmits the message M, the second parameter s' (=ENC(x')+w'), the second verification key v', and the second signature σ' to the signature conversion device 140. The signature generation device 120 and the signature conversion device 140 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0062] The signature conversion device 140 receives and stores the first parameter s (=ENC(x)+w) (1). The signature conversion device 140 receives the message M, the second parameter s' (=ENC(x')+w'), the second verification key v', and the second signature σ' from the signature generation device 120 (2).

[0063] The signature conversion device 140 verifies the correctness of the pair of the message M and the second signature σ′ by using the second verification key v′ (3). 0 / 1←Verify(v', M, σ')

[0064] The signature conversion device 140 inputs the difference between the first parameter s and the second parameter s' into a decryption function (Decode) (denoted as DEC) to calculate a key difference (differential key) Δ between the first signature key x and the second signature key x' (4). Δ←DEC(s-s') …(22)

[0065] Regarding formula (22), s-s'=ENC(x)-ENC(x')+w-w' …(23) twist, DEC(s-s')=DEC(ENC(x)-ENC(x')+w-w') …(24) Due to the linearity of the encoding function ENC, ENC(x)-ENC(x')=ENC(x-x'). Therefore, DEC(s-s')=DEC (ENC(x-x') + w-w') …(25) If the difference w-w' between the first biometric information w and the second biometric information w' is included in the correction capability of the Decode function of the linear code, then from equation (25), Δ=DEC(ENC(x-x'))=x-x' …(26)

[0066] Signature conversion device 140 uses the difference key Δ and the second signature σ' for message M created by the second signing key x' to convert the second signature σ' into a first signature σ for message M created by the first signing key x (5). σ(=Sign(x,M))← KHom(Δ, σ') …(27)

[0067] The signature conversion device 140 transmits the message M and the first signature σ to the verification device 130 (6).

[0068] Key homomorphic operation: σ ← KHom(Δ, σ') indicates that an algorithm can be constructed to generate a signature σ for a message M using a first signing key x from a second signature σ' for the message M using a second signing key x' (=x-Δ) and a differential key Δ. Here, a brief explanation of key homomorphism is given. As an example, Schnorr signature, which has key homomorphism, is used for explanation (see Reference 2). In the following, the private key sk and public key pk in Reference 2 are written as the signing key sk and the verification key vk, respectively.

[0069] <Example 1: Schnorr signature> set up : Setup(1 κ ), we consider a prime number p (i.e., TIFF2025030942000002.tif6150TIFF2025030942000003.tif12153However, TIFF2025030942000004.tif18153 is a ceiling function that represents rounding up to an integer value), and select g uniformly at random from G (g← R G), hash function H : G × {0, 1} * → {0, 1} n Let us consider the family of hash functions {H k} k Let (G, g, H) be the public parameters pp, chosen uniformly at random from pp ← (G,g,H) …(29)

[0070] key generation : In KeyGen(pp), a signing key and a verification key are generated according to the public parameters pp. x is chosen uniformly at random from Zp (the set of integers 0 to p (=Z / pZ)). x← R Zp …(30) The verification key and signing key are determined and output as follows: Verification key: vk ← g x , Signing key: sk ← x …(31)

[0071] signature : In Sign(sk, M), r is chosen uniformly at random from Zp (r← R Zp), and output the signature σ calculated as follows: c ← H(g r ,M) y ← r + x c mod p σ ← (c, y) …(32)

[0072] verification : In Verify(vk,M,σ), c = H(((g x ) -c g y ), M) …(33) If true, output 1; if false, output 0.

[0073] Key homomorphic operations : If signature σ (=Sign(sk, M)= (c, y)) is a correct signature for message M under verification key vk, then the new signature calculated using σ and Δ is: σ' ← (c, y') y' ← y + Δ c mod p …(34) is the verification key vk'=g x+Δ …(35) It can be seen that this is a valid signature for message M under the above conditions. That is, the following holds: H(vk' -c g y' , M) =H({g (x+Δ)} -c ·g {r+(x+Δ)c} , M) =H(g -(x+Δ)c ·g r ·g (x+Δ)c , M) =H(g r , M)=c …(36)

[0074] Reference 2 discloses an algorithm Adapt that includes a conversion process for converting a signature σ based on a signing key sk into a signature σ' based on sk+Δ. In this embodiment, an algorithm for converting a second signature σ' based on a second signing key x' (=x-Δ) for a message M into a first signature σ based on a first signature x (=(x-Δ)+Δ) for the message M is called KHom. Although KHom does not match Adapt in Reference 2, the shift Δ in Adapt may be made to correspond to the differential key Δ in this embodiment (if sk in Adapt in Reference 2 is made to correspond to x-Δ, KHom can be made to correspond partially to Adapt in Reference 2).

[0075] The signature generating device 120 transmits the first signature σ and the message M to the verification device 130. However, the destination of the first signature σ is not limited to the verification device 130, and may be any device (node) not shown. In other words, the destination of the first signature σ is not limited to the verification device 130, and a pair of the signature and the message may be transmitted to and stored in a device other than the verification device 130, and the pair of the signature and the message stored in the other device may be acquired by a device performing the verification (which may be the other device) and the signature may be verified. In this case, there is a difference in timing between the generation and verification of the signature, and multiple signatures may be verified together. For example, in a blockchain network, the pair of the signature and the message is transmitted to, for example, the nearest node and temporarily stored, and the signature is verified by the node, and when it is accepted, the procedure of propagating it to other nodes is repeated.

[0076] Verification device 130 receives and registers the first verification key v from key generation device 110. Verification device 130 receives the first signature σ and message M transmitted from signature conversion device 140. Verification device 130 verifies the correctness of the pair of message M and first signature σ using the first verification key v. 0 / 1 ←Verify(v, M, σ) …(37) In the case of accept, it is set to 1, and in the case of reject, it is set to 0. The verification device 130 may transmit the verification result to, for example, the signature conversion device 140 which is the sender of the first signature σ. The signature conversion device 140 and the verification device 130 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0077] Fig. 6 is a diagram for explaining an example of the configuration of each device described with reference to Fig. 5. The key generation device 110 includes a biometric information acquisition unit 111 having a sensor (not shown) for acquiring first biometric information w of a user (or an interface for receiving the first biometric information w acquired by an external sensor via a network such as a communication line), a signature key / verification key generation unit 112 for generating a first signature key x and a first verification key v, a first parameter generation unit 113 for generating a first parameter s using the first signature key x and the first biometric information w, a first verification key transmission unit 114 for transmitting the first verification key v to the verification device 130, and a first parameter transmission unit 115 for transmitting the first parameter s to the signature conversion device 140. The first verification key transmission unit 114 may transmit the verification key v to a key server (public key database) or the like.

[0078] The signature generation device 120 includes a biometric information acquisition unit 121 having a sensor (not shown) or the like for acquiring a user's second biometric information w', a message acquisition unit 122 for acquiring a message M to be signed, a second signature key / second verification key generation unit 123 for generating a second signature key x' and a second verification key v', a second parameter generation unit 124 for generating a second parameter s' using the second signature key x' and the second biometric information w', a second signature generation unit 125 for generating a second signature (digital signature) for the message M using the second signature key x', and a message / second parameter / second verification key / second signature transmission unit 126 for transmitting the message M, the second parameter s', the second verification key v', and the second signature σ' to the signature conversion device 140. The order of transmission, such as whether messages M and (s', v', σ') are transmitted individually or collectively, is arbitrary depending on an agreement (protocol) with signature conversion device 140. Note that the sensor (not shown) in biometric information acquisition unit 121 preferably has the same configuration (same specifications such as performance, resolution, and the like) as the sensor (not shown) in biometric information acquisition unit 121 of key generation device 110.

[0079] The signature conversion device 140 includes a first parameter receiving unit 141 that receives a first parameter s transmitted from the key generation device 110, a storage unit 142 that stores the first parameter s received by the first parameter receiving unit 141, a message / second parameter / second verification key / second signature receiving unit 143 that receives a message M, a second parameter s', a second verification key v', and a second signature σ' transmitted from the signature generation device 120, and The verification device 130 includes a second signature verification unit 144 that verifies the correctness of the set of the first and second signature keys σ', a differential key calculation unit 145 that calculates a differential key Δ that is the difference between the first signature key x and the second signature key x' using a first parameter s and a second parameter s', a first signature generation unit 146 that calculates a first signature σ for a message M by the first signature key x using the differential key Δ and the second signature σ', and a message and first signature transmission unit 147 that transmits the message M and the first signature σ to the verification device 130. The order of transmission, such as whether the message M and the first signature σ' are transmitted individually or together, is arbitrary depending on, for example, an agreement (protocol) between the signature conversion device 140 and the verification device 130.

[0080] The verification device 130 includes a first verification key receiving unit 131 that receives a first verification key v generated by the key generating device 110, a storage unit 132 that stores the received first verification key v, a message and first signature receiving unit 133 that receives a message M and a first signature σ transmitted from the signature conversion device 140, and a first signature verification unit 134 that verifies the correctness of a set of the message M and the first signature σ by using the first verification key v. The first verification key receiving unit 131 may receive the first verification key v from a key server (public key database) or the like (not shown). The message and first signature receiving unit 133 may receive the message M and the first signature σ from a node (not shown).

[0081] Fig. 7 is a diagram for explaining an example of a processing operation at the key registration stage in the present embodiment shown in Fig. 6. The biometric information acquisition unit 111 of the key generation device 110 acquires first biometric information w for user registration (step A1).

[0082] First signature key / first verification key generation unit 112 of key generation device 110 generates a pair of a first signature key x and a first verification key v corresponding to the first signature key x (step A2).

[0083] The first parameter generation unit 113 of the key generation device 110 encodes the first signature key x, combines the encoded encoding key ENC(x) with the first biometric information w, and generates a first parameter s s := ENC(x) + w …(38) (Step A3).

[0084] In the following, as a non-limiting example, equation (38) will be described based on an example in which a square lattice is used for encoding (Patent Document 1, etc.). The first biometric information w and the second biometric information w' are n-dimensional real vectors. w = (w1, …, w n ), w' = (w'1,…, w' n ) …(39)

[0085] The distance between the first biometric information w and the second biometric information w' is, for example, L ∞ Distance (L ∞ Norm: Maximum norm) is expressed as follows: d (n) ∞ (w,w') = max {|w i -w' i |, i=1,…,n}…(40) Distance d (n) ∞ (w, w') is a given threshold t h Below(d (n) ∞ (w,w')≦t h ) then it is considered a match (same organism).

[0086] The lattice point set L is defined as follows. L = {Y = (y1, ..., y n )| y i is a non-negative integer, 0≦y i ≦K} …(41) Here, K is t h ya|wi | is a predetermined integer that is sufficiently larger than

[0087] The function int() that corresponds to an integer z for an N-dimensional integer vector Y∈L is defined as follows. z←int(Y)=Σ[i=1, n]y i (2K) i-1 …(42) Inverse function int -1 () is the function that maps an integer z to an n-dimensional integer vector Y. Y ← int -1 (z) …(43)

[0088] The first signing key x (an integer) is converted to the inverse function int -1 When input into (), you get an n-dimensional integer vector A. A = (a1, …, a n )←int -1 (x) …(44)

[0089] Here, we use the encoding function Encode() as h *int -1 (), the encoding key c obtained by encoding the first signing key x is an n-dimensional vector given by: c = (c1, …, c n )←Encode(x)=2t h *int -1 (x)=2t h *(a1,…, a n ) …(45)

[0090] Therefore, the first parameter s is given by: s := ENC(x) + w = ​​2t h *(a1,…, a n )+(w1,…, w n ) =(2t h *a1+w1,…,2t h *a n +w n ) …(46)

[0091] The first verification key transmission unit 114 of the key generation device 110 transmits the generated first verification key v to the verification device 130 (step A4). Note that the key generation device 110 may upload the first verification key v to a key server (public key database) (not shown) or the like and make it public on the Internet or the like.

[0092] The first parameter transmitting unit 115 of the key generating device 110 transmits the first parameter s to the signature conversion device 140 (step A5). Note that the order of steps A4 and A5 may be reversed.

[0093] The first verification key receiving unit 131 of the verification device 130 receives the first verification key v (step D1) and stores the first verification key v in the storage unit 132 (step D2). The first verification key receiving unit 131 of the verification device 130 may receive and store the first verification key v from a key server (not shown) or the like that registers the verification key.

[0094] The first parameter receiving unit 141 of the signature conversion device 140 receives the first parameter s transmitted from the key generation device 110 (step B1), and stores it in the storage unit 142 (step B2).

[0095] FIG. 8 is a diagram for explaining an example of the processing operation at the signature creation stage in the present embodiment shown in FIG.

[0096] The biometric information acquisition unit 121 of the signature generating device 120 acquires second biometric information w' for a user's signature (step C1).

[0097] The message acquisition unit 122 of the signature generation device 120 acquires the message M (step C2).

[0098] The second signature key / second verification key generation unit 123 of the signature generation device 120 generates a second signature key x' and a second verification key v' (step C3).

[0099] The second parameter generation unit 124 of the signature generation device 120 generates a second parameter s' by combining a value ENC(x') obtained by encoding the second signature key x' with the second biometric information w' (step C4). s':=ENC(Δ)+w' …(47)

[0100] As a non-limiting example, if a square lattice is used as the encoding as well as the first parameter s, c' = (c'1, ..., c' n )←Encode(Δ)=2t h *int -1 (x)=2t h *(a'1,…, a' n ) …(48) Therefore, the second parameter s' is an n-dimensional real-valued vector. s':= 2t h *int -1 (Δ)+w' = 2t h *(a'1,…, a' n )+(w'1,…,w' n ) =(2t h *a'1+w'1,…,2t h *a' n +w' n ) …(49)

[0101] Second signature generation unit 125 of signature generation device 120 generates a second signature σ′ for message M using second signature key x′ (step C5).

[0102] The message / second parameter / second verification key / second signature transmission unit 126 of the signature generation device 120 transmits the message M, the second parameter s', the second verification key v', and the second signature σ' to the signature conversion device 140 (step C6).

[0103] The message / second parameter / second verification key / second signature receiving unit 143 of the signature conversion device 140 receives the message M, the second parameter s', the second verification key v', and the second signature σ' sent from the signature generation device 120 (step B3).

[0104] The second signature verification unit 144 of the signature conversion device 140 verifies the correctness of the pair of the message M and the second signature σ' using the second verification key v' (step B4). If the verification result is not acceptable, the signature conversion device 140 aborts the process (step B9). If the verification result is acceptable, the differential key calculation unit 145 of the signature conversion device 140 inputs the difference s-s' between the first parameter s and the second parameter s' to the decryption function Decode to obtain the difference Δ=x-x' between the first signature key x and the second signature key x' (step B6). Δ←Decode(s-s') …(50)

[0105] As a non-limiting example, a square lattice is used for encoding, and the encoding function Encode is 2t h *int -1 When () is used, the decryption function Decode is Decode(c) = int(c / 2t h ) …(51) It is also possible to use the following.

[0106] In this case, Decode(s-s') is given by: int -1 (x)-int -1 (x')=int -1 Since (x-x') holds, TIFF2025030942000005.tif25156 …(52) is given by:

[0107] Regarding the first biometric information w and the second biometric information w', d (n) ∞ (w,w')=max { |w i -w' i |, i=1,…,n} ≦t h …(53) Then, in equation (52), n-dimensional vector (w-w') / 2t h Each component of is less than ±1 / 2, so equation (52) int(int -1 (x-x'))=xx' Therefore, the value Δ of Decode(s-s') in equation (50) is Δ = int(int -1 (x-x'))=xx' …(54) It becomes.

[0108] From the above, it can be confirmed that the difference x-x' between the first signing key x and the second signing key x' is correctly restored by the decryption function Decode. That is, since the first parameter s and the second parameter s' are respectively obtained by combining the encoding keys ENC(x) and ENC(x') obtained by encoding the first signing key x and the second signing key x' and the first and second biometric information w and w' by vector addition, the signature conversion device 140 can calculate the difference key Δ, which is the difference x-x' between the first signing key x and the second signing key x', by decrypting the subtraction result of the first parameter s and the second parameter s'.

[0109] The first signature generation unit 146 of the signature conversion device 140 performs key homomorphic computation using the second signature σ′ and the differential key Δ. σ←KHom(Δ,σ') …(55) A first signature σ for message M using the first signature key x (a first signature for message M that can be verified with the first verification key v) is generated from the second signature σ' for message M using the second signature key x' (step B7).

[0110] FIG. 9 is a diagram for explaining an example of the operation of the signature verification process in the present embodiment shown in FIG.

[0111] The message / first signature transmission unit 147 of the signature conversion device 140 transmits the message M and the first signature σ to the verification device 130 (step B8).

[0112] The message / first signature receiving unit 133 of the verification device 130 receives the message M and the first signature σ transmitted from the signature conversion device 140 (step D3).

[0113] The first signature verification unit 134 of the verification device 130 verifies the correctness of the pair of the message M and the first signature σ using the first verification key v (step D4).

[0114] The verification device 130 may transmit the verification result (acceptance / rejection notification) to the signature conversion device 140, which is the sender of the first signature σ (step D5). In this case, the signature conversion device 140 receives the acceptance / rejection notification (step B10). The verification result (acceptance / rejection notification) may be transmitted to the signature generation device 120.

[0115] The timing of the verification process is arbitrary. For example, when a stored message M is to be used, the signature stored together with the message M can be verified to verify that the message M has not been tampered with, including during storage. Also, one pair of message M and signature may be verified multiple times.

[0116] FIG. 10 is a diagram for explaining another embodiment. Referring to FIG. 10, the system configuration of this embodiment is basically the same as the configuration shown in FIG. 5, but the signature generating device 120 does not include the second verification key v' in the signature including the second parameter s' to be transmitted to the signature converting device 140 together with the message M, and transmits the message M, the second parameter s', and the second signature σ' to the signature converting device 140, which is different from FIG. 5. That is, in FIG. 10, the signature generating device 120 transmits the message M, the second parameter s', and the second signature σ' to the signature converting device 140 in process (6). Also, different from FIG. 5, the signature converting device 140 performs process (4) of calculating the second verification key v' from the first verification key v and the difference key Δ. Therefore, the signature converting device 140 in FIG. 10 has a different order of processes from those in FIG. 5.

[0117] 10, the signature conversion device 140 receives a first parameter s and a first verification key v from the key generation device 110 (1). The signature conversion device 140 may obtain the first verification key v from a key server. Alternatively, the key generation device 110 may include the first verification key v in public parameters known to the signature conversion device 140.

[0118] The signature conversion device 140 receives the message M, the second parameter s', and the second signature σ' from the signature generation device 120 (2). The signature conversion device 140 calculates a difference key Δ between the first signature key x and the second signature key x' using the first parameter s and the second parameter s' (3). This process corresponds to the process (4) of the signature conversion device 140 in FIG. 5. Δ← DEC(s-s') …(56)

[0119] The signature conversion device 140 calculates a second verification key v' using the first verification key v and the difference key Δ (4). v':=VKShift(v, Δ) …(57) VKShift is a function that receives a first verification key v and a differential key Δ as input and returns a second verification key v′.

[0120] For example, in Schnorr signature, if the signing key is x, the verification key is given by v = g^x (g is the generator of the group of prime numbers, and ^ is the exponentiation operator). Therefore, if the first and second verification keys are v and v', the first signing key is x, and the second signing key x' is x-x'=Δ, so x'=x-Δ v'=g^x'=g^(x-Δ)=(g^x)·(g^(-Δ))=v / (g^Δ) …(58)

[0121] The signature conversion device 140 verifies the correctness of the pair of the message M and the second signature σ′ by using the second signature key x′ (5). This process corresponds to the process (3) of the signature conversion device 140 in FIG. 0 / 1←Verify(v', M, σ') …(59)

[0122] Signature conversion device 140 converts the second signature σ' for message M using the second signature key x' into a first signature (digital signature) σ for message M using the first signature key x (6). This process corresponds to process (6) of signature conversion device 140 in FIG. 5. σ ← KHom(Δ, σ') …(60)

[0123] The signature conversion device 140 transmits the message M and the first signature (digital signature) σ to the verification device 130 (7). This process corresponds to the process (6) of the signature conversion device 140 in FIG.

[0124] Fig. 11 is a diagram showing an example of the configuration of each device in Fig. 10, and corresponds to Fig. 6. The same elements as in Fig. 6 are given the same reference symbols, and their explanations are omitted. Referring to Fig. 11, signature conversion device 140 includes a second verification key calculation unit 148 in addition to the configuration in Fig. 6.

[0125] The message / second parameter / second signature transmission unit 126 A of the signature generation device 120 transmits the message M, the second parameter s′, and the second signature σ′ to the signature conversion device 140 .

[0126] The message / second parameter / second signature receiving unit 143 A of the signature conversion apparatus 140 receives the message M, the second parameter s′, and the second signature σ′ transmitted from the signature conversion apparatus 140 .

[0127] The second verification key calculation unit 148 executes the process (4) of the signature conversion device 140 in FIG. 10 to calculate the second verification key v'.

[0128] Fig. 12 is a diagram for explaining an example of a processing operation at the signature creation stage in another embodiment described with reference to Fig. 10 and Fig. 11. The key generation phase and the verification phase are the same as those in Fig. 7 and Fig. 9. In Fig. 12, the message / second parameter / second signature transmission unit 126A of the signature generation device 120 transmits the message M, the second parameter s', and the second signature σ' to the signature conversion device 140 (step C6).

[0129] Message / second parameter / second signature receiving unit 143A of signature conversion apparatus 140 receives message M, second parameter s', and second signature σ' transmitted from signature generation apparatus 120 (step B3).

[0130] The differential key calculation unit 145 of the signature conversion device 140 inputs the difference s-s' between the first parameter s and the second parameter s' to the decryption function Decode, and obtains the difference Δ=x-x' between the first signature key x and the second signature key x' (step B6). Δ←Decode(s-s') …(61)

[0131] The second verification key calculation unit 148 of the signature conversion device 140 calculates the second verification key v' using the first verification key v and the difference key Δ (step B12). v' = VKShift(v, Δ) … (62)

[0132] The second signature verification unit 144 of the signature conversion device 140 verifies the correctness of the pair of the message M and the second signature σ' by using the second verification key v' (step B4). If the verification result is not acceptable, the signature conversion device 140 suspends the process (step B9). If the verification result is acceptable, the first signature generation unit 146 of the signature conversion device 140 uses the second signature σ' and the difference key Δ to perform the key homomorphic operation σ←KHom(Δ,σ') ... (63) Then, a first signature σ for message M using the first signature key x (=x'+Δ) is generated from the second signature σ' for message M using the second signature key x' (step B7), and message M and the first signature σ are transmitted to verification device 130 (step B8).

[0133] The key homomorphic algorithm for converting the second signature σ' for message M using the second signing key x' into the first signature σ for message M using the first signing key x (=x' + Δ) may be σ ← KHom(Δ,σ') depending on the signature algorithm. It may also be one including Δ, σ', and message M as in equation (64) (Reference 2: 4.7 Randomizable SPS by Abe et al.), or one including the differential key Δ, the second signature σ', message M, and the first verification key v as in equation (65) (Reference 2: 4.8 Ghadafi's Short SPS). σ← KHom(Δ,σ', M) …(64) σ← KHom(Δ,σ', M, v) …(65)

[0134] Fig. 13 is a diagram for explaining a modification of the arithmetic processing of the embodiment described with reference to Fig. 5 etc. In this modification, the signature conversion device 140 does not verify the second signature σ' using the second verification key v'. The arithmetic processing and configurations of the key generation device 110, the signature generation device 120, and the verification device 130 are similar to those in Figs. 5 and 6.

[0135] In the above embodiment described with reference to Fig. 5, Fig. 6, and Fig. 8, the signature conversion device 140 receives the signature (s', v', σ') including the second parameter s' transmitted from the signature generation device 120 and the message M, verifies the second signature σ' using the second signature key x', and if the verification result is acceptable, generates a difference key Δ, and generates a first signature σ for the message M that can be verified with the first verification key v using the difference key Δ and the second signature σ'. That is, the signature conversion device 140, which is an intermediate node between the signature generation device 120 and the verification device 130, verifies the second signature σ' to verify the non-tampering of the message M, and if the verification result is unacceptable, does not generate the first signature σ or transmit it to the verification device 130. In this way, verifying the second signature σ' using the second signature key x' prior to verification by the verification device 130 contributes to strengthening security, and in the case where the verification result is unacceptable, it is possible to avoid unnecessary calculations, transmissions, etc., thereby contributing to reducing, for example, the processing load and network load. However, since the verification device 130 finally verifies the correctness of the pair of the message M and the first signature σ using the first verification key v, it can be said that it is not necessarily necessary for the signature conversion device 140 to verify the correctness of the pair of the message M and the second signature σ' using the second signature key x'. Therefore, this modified example may be used.

[0136] 13, in this modification, the process of verifying the correctness of the pair of message M and second signature σ' using the second verification key v' in signature conversion device 140 (process (3) of signature conversion device 140 in FIG. 5) is deleted, and process (4) and subsequent processes of signature conversion device 140 in FIG. 5 are brought forward. Also, in this modification, as the configuration and processing steps of signature conversion device 140, second signature verification unit 144 in FIG. 6 is deleted (the rest remains the same as in FIG. 6), and steps B4, B5, and B9 in FIG. 8 are deleted (the rest remains the same as in FIG. 8).

[0137] FIG. 14 is a diagram for explaining a modified example of another arithmetic process of the embodiment described with reference to FIG. 10 and the like. In this modified example, like FIG. 13, the signature conversion device 140 does not necessarily verify the second signature σ' using the second verification key v'. Referring to FIG. 14, in this modified example, the signature conversion device 140 deletes the process of verifying the correctness of the pair of the message M and the second signature σ' using the second verification key v' (process (5) of the signature conversion device 140 in FIG. 10), and the process (6) and subsequent processes of the signature conversion device 140 in FIG. 10 are brought forward. In this modified example, as the configuration and process steps of the signature conversion device 140, the second signature verification unit 144 in FIG. 11 is deleted (the rest remains the same as in FIG. 11), and steps B4, B5, and B9 in FIG. 12 are deleted (the rest remains the same as in FIG. 12).

[0138] In the following, as another non-limiting example, a case where biometric information is binary coded into binary data will be described. · Number of bits in the codeword: n, - Number of allowable error bits: D, The first parameter generation unit 113 of the key generation device 110 may encode the first signature key x and generate a first parameter s by bitwise exclusive or (xor) the encoding key ENC(x) and the first biometric information w (n-bit binary data). s:=ENC(x) xor w …(66)

[0139] The first parameter generation unit 113 inputs the first signature key x (L bits) to an error correction encoding algorithm (Encode) and executes it to obtain an encoding key c (n bits). c = [c1, …, c n ] ← Encode(x) …(67) ci (i = 1, ... n) is the value of the i-th bit of c.

[0140] The coding key c for error correction coding may have a sum of the length of the information bits and the code bits of n bits. For example, in the Hamming code, the code length n = 2 k−1, and the length of information bits L=nk. The first parameter generation unit 113 calculates the exclusive OR of the first biometric information w (n bits) and the encoding key c for each bit, and outputs the result as the first parameter s (n bits). s := w xor c = [w1xor c1,…, w n xor c n ] …(68)

[0141] The second parameter generation unit 124 of the signature generation device 120 may generate the second parameter s' from a bit-by-bit exclusive OR of the value ENC(x') obtained by encoding the second signature key x' and the second biometric information w'. s':=ENC(v') xor w' …(69)

[0142] That is, the second parameter generation unit 124 inputs the second signature key x' (L bits) to the encoding algorithm (Encode) of the error-correcting code and executes it, resulting in an n-bit encoding key c'. As described above, in the case of the Hamming code, the length of the codeword (information bits + code bits) n = 2 k −1 (k is an integer equal to or greater than 3), and the length of the information bits is L. c' = [c'1, …, c' n ] ← Encode(x') …(70) c' i (i=1,…,n) is the value of the i-th bit of c'.

[0143] Next, the second parameter generation unit 124 calculates the exclusive OR of the second biometric information w' (n bits) and the encoding key c' for each bit, and outputs the result as a second parameter s' (n bits). s'← w' xor c' = [w'1xor c'1, w'2xor c'2,…, w' n xor c' n ] …(71)

[0144] The message / second parameter / second verification key / second signature transmission unit 126 of the signature generation device 120 transmits the message M, the second parameter s′, the second verification key v′, and the second signature σ′ to the signature conversion device 140.

[0145] The differential key calculation unit 145 of the signature conversion device 140 performs a bitwise exclusive OR operation on the first parameter s and the second parameter s′: t:=s xor s' …(72) The decrypted value is set as the differential key Δ (step B6 in FIG. 8). Δ←DEC(t) …(73)

[0146] t=s xor s' =[w1xor c1, …, w n xor c n ] xor [w'1 xor c'1,…, w' n xor c' n ] = [(w1xor c1) xor (w'1xor c'1), …, (w n xor c n ) xor (w' n xor c' n )] =[w1xor w'1, …, w n xor w' n ] xor [c1 xor c'1, …, c n xor c' n ] = (w xor w') xor (ENC(x) xor ENC(x')) …(74)

[0147] Since we use linear codes, equation (72) becomes t= (w xor w') xor ENC(x xor x') …(75) It becomes.

[0148] When the difference (Hamming distance) between the first biometric information w and the second biometric information w′ is equal to or smaller than the error correction capability D of the linear code, the distance between ENC(x xor x′) and t is also equal to or smaller than D.

[0149] because, ENC(x xor x') xor t =ENC(x xor x') xor ((w xor w′)xor ENC(x xor x')) =w xor w′ …(76) This is because the difference between ENC(x xor x') and t is equal to the difference (Hamming distance) between the first biometric information w and the second biometric information w'. Therefore, (x xor x') is restored by executing the restoration algorithm Decode(t) from t whose difference from the codeword ENC(x xor x') obtained by encoding (x xor x') is less than or equal to D. Δ=(x xor x')←DEC(t) …(77)

[0150] That is, it can be confirmed that the differential key Δ=x xor x′ is calculated by the bitwise exclusive OR operation of the first parameter s and the second parameter s′.

[0151] FIG. 15 is a schematic diagram for explaining an example in which each device (110, 120, 130, 140) of the above-mentioned digital signature system 100 is implemented by a computer having a communication function and communicatively connectable with each other via a network. In FIG. 15(A), each device (110, 120, 130, 140) includes a processor 301, a storage device 302, an input device / output device 303, and a communication interface 304. The storage device 302 may be configured to include semiconductor storage such as a RAM (Random Access Memory), a ROM (Read Only Memory), or an EEPROM (Electrically Erasable and Programmable ROM), a HDD (Hard Disk Drive), a CD (Compact Disc), a DVD (Digital Versatile Disc), etc. The processor 301 executes a program (not shown) stored in the storage device 302 to realize the processing and functions of each device. The input device / output device 303 may be configured to include a keyboard and a display. For example, the signature generating device 120 may be configured to display and output the verification result (acceptance / rejection) in the verification device 130 on an output device such as a display. In addition, in the key generating device 110 and the signature generating device 120 that acquire biometric information, the input device / output device 303 may be configured to include a sensor that acquires the biometric information. In this case, the sensor may be an image sensor (camera) when the biometric information is a face, iris, etc., or a fingerprint sensor when the biometric information is a fingerprint, or a near-infrared camera that captures the light that has passed through the finger when the biometric information is a fingerprint. The sensor may be, for example, an LED (Light Emitting Diode) that irradiates near-infrared rays and a near-infrared camera that captures the light that has passed through the finger, etc. Note that the sensor may be a removable sensor such as a USB (Universal Serial Bus) device. The communication interface 304 may be configured to include a network interface card, a transceiver (transmitter / receiver), etc., and to be communicatively connected to each other via a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, a wireless LAN, a mobile communication network, etc.In addition, the communication interface 304 may be configured to include an interface in the key generating device 110 or the signature generating device 120 that is communicatively connected to an external sensor (such as a Bluetooth (registered trademark) type sensor) and receives biometric information acquired by the external sensor.

[0152] FIG. 15B is a diagram for explaining an example in which the above-mentioned devices (110, 120, 130, 140) of the digital signature system 100 are implemented as virtual machines using a server virtualization technology. A plurality of virtual machines VM303 run on a virtualization platform 402 such as a hypervisor implemented on a physical machine 401 of a server 400. One or more of the devices (110, 120, 130, 140) of the digital signature system 100 may be implemented as the virtual machine VM303. Although there is one physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine VM303 is preferably set to operate in an isolated environment in memory space. In this case, in the virtual machine VM303, a program for realizing the processing of any one of the devices (110, 120, 130, 140) runs on the virtual OS (Operating System) of the virtual machine. A virtual machine VM that virtually realizes any of the devices (110, 120, 130, 140) may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices (110, 120, 130, 140) via a physical interface (communication interface) of the physical machine 401 via a LAN, a WAN such as the Internet, or the like.

[0153] In the above embodiment, a system that performs processing based on biometric information has been described as an example, but the present disclosure is not limited to biometric information and can be realized using fuzzy information other than biometric information. For example, the present disclosure may be applied to a PUF (Physically Unclonable Function: a technology that uses individual differences that occur during the manufacturing process of IC chips to identify individuals (IC chips) like human fingerprints) that identifies semiconductor devices (IC (Integrated Circuit) chips.

[0154] Although the example of using a square lattice for encoding in equations (38), (47), etc. has been described as a non-limiting example, it is of course possible to use error correction codes such as RS codes, BCH codes, etc. Furthermore, the biometric information is not limited to real vectors, and it is of course possible to use integer vectors.

[0155] The above-described embodiment is supplemented as follows (but is not limited to the following).

[0156] (Supplementary Note 1) A digital signature system includes a first processing device having at least a processor and a communication interface, wherein the first processing device receives first parameters created using a first signing key and first biometric information, second parameters created using a second signing key and second biometric information, and a second signature for a message by the second signing key, and performs a process of calculating a first signature for the message that can be verifiable by a first verification key corresponding to the first signing key, using at least the first parameters, the second parameters, and the second signature.

[0157] (Supplementary Note 2) In the digital signature system of Supplementary Note 1, the first processing device uses the first parameter and the second parameter to calculate a differential key, which is the difference between the first signature key and the second signature key, and performs a process of calculating the first signature using at least the differential key and the second signature.

[0158] (Supplementary Note 3) In the digital signature system of Supplementary Note 1, the first processing device receives a second verification key corresponding to the second signing key, and verifies the second signature using the second signing key.

[0159] (Supplementary Note 4) In the digital signature system of Supplementary Note 1, the first processing device performs a process of calculating a difference key, which is the difference between the first signature key and the second signature key, using the first parameter and the second parameter, and calculating a second verification key corresponding to the second signature key using the difference key and the first verification key.

[0160] (Supplementary Note 5) In the digital signature system of Supplementary Note 1, the first signature is a signature on the message by the first signature key.

[0161] (Supplementary Note 6) In any one of Supplementary Notes 1 to 5, the digital signature system includes at least a processor and a communication interface, and includes a process for generating a pair of the first signature key and a first verification key corresponding to the first signature key, and a process for acquiring the first biometric information; a second processing device that executes a process of generating the first parameter by combining the first signature key and the first biometric information, and a process of transmitting the first parameter to the first processing device; and a third processing device having at least a processor and a communication interface, and executing a process of acquiring the second biometric information, a process of generating a pair of the second signing key and a second verification key corresponding to the second signing key, a process of combining the second signing key and the second biometric information to generate the second parameters, a process of generating the second signature for the message using the second signing key, and a process of transmitting the message, the second parameters, and the second signature to the first processing device.

[0162] (Appendix 7) In the digital signature system of Appendix 6, the second processing device transmits the first verification key to a device or key server that performs signature verification, and the first processing device transmits the first signature to the device that performs signature verification.

[0163] (Supplementary Note 8) A signature conversion device includes at least a processor and a communication interface, and performs a process of receiving a first parameter created using a first signature key and first biometric information; The method performs the following steps: receiving, together with the message, a set of second parameters created using a second signing key and second biometric information as a signature including parameters, and a second signature which is a digital signature for the message by the second signing key; converting the second signature for the message by the second signing key based on the first parameters and the second parameters into a first signature for the message which can be verified by a first verification key corresponding to the first signing key; and transmitting the first signature as a signature not including parameters to a node which verifies the first signature with the first verification key.

[0164] (Supplementary Note 9) A digital signature method includes a first node receiving first parameters created using a first signing key and first biometric information, second parameters created using a second signing key and second biometric information, and a second signature for a message using the second signing key, and calculating a first signature for the message using at least the first parameters, the second parameters, and the second signature, which can be verifiable with a first verification key corresponding to the first signing key.

[0165] (Supplementary Note 10) In the digital signature method of Supplementary Note 9, the first node uses the first parameter and the second parameter to calculate a difference key, which is the difference between the first signing key and the second signing key, and calculates the first signature using at least the difference key and the second signature.

[0166] (Supplementary Note 11) In the digital signature method of Supplementary Note 9 or 10, the first node receives a second verification key corresponding to the second signing key, and verifies the second signature with the second verification key.

[0167] (Supplementary Note 12) In any of the digital signature methods of Supplementary Notes 9 to 11, the first node uses the first parameter and the second parameter to calculate a difference key which is the difference between the first signature key and the second signature key, and uses the difference key and the first verification key to calculate a second verification key corresponding to the second signature key.

[0168] (Supplementary Note 13) In the digital signature method according to any one of Supplementary Notes 9 to 12, the first signature is a signature for the message made by the first signature key.

[0169] (Supplementary Note 14) In any of the digital signature methods of Supplementary Notes 9 to 13, a second node executes a process of generating a pair of the first signing key and a first verification key corresponding to the first signing key, a process of acquiring the first biometric information, a process of combining the first signing key and the first biometric information to generate the first parameter, and a process of transmitting the first parameter to the first node, and a third node executes a process of acquiring the second biometric information, a process of generating a pair of the second signing key and a second verification key corresponding to the second signing key, a process of combining the second signing key and the second biometric information to generate the second parameter, a process of generating the second signature for the message using the second signing key, and a process of transmitting the message, the second parameter, and the second signature to the first processing device.

[0170] (Supplementary Note 15) A program that causes a computer to execute the following processes: receiving first parameters created using a first signing key and first biometric information; receiving, together with a message, a set of second parameters created using a second signing key and second biometric information as a signature including parameters, and a second signature that is a digital signature for the message by the second signing key; converting, based on the first parameters and the second parameters, the second signature by the second signing key for the message into a first signature for the message that can be verified with a first verification key corresponding to the first signing key; and transmitting the first signature as a signature not including parameters to a node that verifies the first signature with the first verification key.

[0171] [Reference 1] Yevgeniy Dodis, et al. "Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data," SIAM Journal on Computing, 38(1):97-139, 2008 [Reference 2] David Derler, et al., "Key-Homomorphic Signatures: Definitions and Applications to Multiparty Signatures and Non-Interactive Zero-Knowledge," Designs, Codes and Cryptography 87, 1372-1413, 2019 [Reference 3] JP 2021-087167 A

[0172] The disclosures of Patent Document 1 and References 1-3 are incorporated herein by reference. Modifications, adjustments, and combinations of the embodiments and examples are possible within the scope of the disclosure of this application (including the scope of claims), and further based on the basic technical ideas. Furthermore, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims of this disclosure. In other words, this disclosure naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure, including the scope of claims, and the technical ideas. [Explanation of symbols]

[0173] 100 Digital Signature System 110 Key generation device 111 Biometric information acquisition unit 112 First signature key / first verification key generation unit 113 First parameter generation unit 114 First verification key transmission unit 115 First parameter transmission unit 120 Signature generator 121 Biometric information acquisition unit 122 Message Acquisition Unit 123 Second signing key / second verification key generation unit 124 Second parameter generation unit 125 Second Signature Generation Unit 126 Message · Second parameters · Second verification key · Second signature transmission part 126A Message, second parameter, second signature transmission part 130 Verification Device 131 First verification key receiving unit 132 Storage section 133 Message 1st Signature Receiving Part 134 First Signature Verification Unit 140 Signature conversion device 141 First parameter receiving unit 142 Storage section 143 Message · Second parameter · Second verification key · Second signature receiving part 143A Message·Second parameter·Second signature receiver 144 Second Signature Verification Unit 145 Differential key calculation section 146 First Signature Generation Unit 147 Message - First Signature Transmission Part 148 Second verification key calculation unit 200 Signature System (Biometric Signature System) 210 Key generation device 220 Signature generator 230 Verification Device 300 Computers 301 Processor 302 Storage device 303 Input Device / Output Device 304 Communication Interface 400 Servers 401 Physical Machines 402 Virtualization Platform 403 Virtual Machine

Claims

1. a first processing device having at least a processor and a communication interface; The first processing device includes: a first parameter generated using a first signature key and first biometric information; a second parameter generated using a second signature key and second biometric information; and a second signature on the message with the second signing key; and Received a first signature for the message, the first signature being verifiable with a first verification key corresponding to the first signing key, the second parameters being used to calculate the first signature for the message using at least the first parameters, the second parameters, and the second signature;

2. the first processing device calculates a difference key, which is a difference between the first signing key and the second signing key, using the first parameter and the second parameter; The digital signature system of claim 1 , further comprising: a process for calculating the first signature using at least the difference key and the second signature.

3. 2. The digital signature system of claim 1, wherein the first processing device receives a second verification key corresponding to the second signing key and verifies the correctness of the message and the second signature set using the second verification key.

4. the first processing device calculates a difference key, which is a difference between the first signature key and the second signature key, using the first parameter and the second parameter; The digital signature system according to claim 1 , further comprising a process for calculating a second verification key corresponding to the second signature key using the difference key and the first verification key.

5. The digital signature system of claim 1 , wherein the first signature is a signature on the message by the first signature key.

6. comprising at least a processor and a communication interface; generating a pair of the first signature key and a first verification key corresponding to the first signature key; A process of acquiring the first biological information; a process of generating the first parameter by combining the first signature key and the first biometric information; transmitting the first parameter to the first processing device; and a second processing unit that executes comprising at least a processor and a communication interface; A process of acquiring the second biometric information; generating a pair of the second signature key and a second verification key corresponding to the second signature key; a process of generating the second parameter by combining the second signature key and the second biometric information; generating the second signature for the message using the second signing key; sending the message, the second parameters, and the second signature to the first processing device; 2. The digital signature system of claim 1, further comprising a third processor for executing:

7. The second processing device transmits the first verification key to a device or key server that performs signature verification; The digital signature system of claim 6 , wherein the first processing device transmits the first signature to the device that performs verification of the signature.

8. comprising at least a processor and a communication interface; A process of receiving a first parameter created using a first signature key and first biometric information, and a process of receiving, together with the message, a set of a second parameter created using a second signature key and second biometric information as a signature including the parameter, and a second signature which is a digital signature for the message by the second signature key, and a process of converting the second signature for the message by the second signing key based on the first parameter and the second parameter into a first signature for the message that can be verified by a first verification key corresponding to the first signing key; sending the first signature as a parameter-free signature to a node that verifies the first signature with the first verification key; A signature conversion device that performs the above.

9. The first node is a first parameter generated using a first signature key and first biometric information; a second parameter generated using a second signature key and second biometric information; and a second signature on the message with the second signing key; and Received 20. The digital signature method of claim 19, further comprising: computing a first signature for the message using at least the first parameters, the second parameters, and the second signature, the first signature being verifiable with a first verification key that corresponds to the first signing key.

10. the first node calculates a difference key, which is a difference between the first signing key and the second signing key, using the first parameter and the second parameter; The digital signature method of claim 9 , further comprising: calculating the first signature using at least the difference key and the second signature.

11. 10. The digital signature method of claim 9, wherein the first node receives a second verification key corresponding to the second signing key and verifies correctness of the message and the second signature set using the second verification key.

12. The first node, calculating a difference key, which is a difference between the first signing key and the second signing key, using the first parameter and the second parameter; 10. The digital signature method of claim 9, further comprising: calculating a second verification key corresponding to the second signature key using the difference key and the first verification key.

13. 10. The digital signature method of claim 9, wherein the first signature is a signature on the message by the first signature key.

14. The second node generating a pair of the first signature key and a first verification key corresponding to the first signature key; A process of acquiring the first biological information; a process of generating the first parameter by combining the first signature key and the first biometric information; transmitting the first parameter to the first node; Run A third node: A process of acquiring the second biometric information; generating a pair of the second signature key and a second verification key corresponding to the second signature key; a process of generating the second parameter by combining the second signature key and the second biometric information; generating the second signature for the message using the second signing key; and transmitting the message, the second parameter, and the second signature to the first node.

15. receiving a first parameter generated using a first signature key and first biometric information; a process of receiving, together with the message, a set of second parameters created using a second signature key and second biometric information as a signature including parameters, and a second signature that is a digital signature for the message by the second signature key; a process of converting the second signature for the message by the second signing key based on the first parameter and the second parameter into a first signature for the message that can be verified by a first verification key corresponding to the first signing key; sending the first signature as a parameter-free signature to a node that verifies the first signature with the first verification key; A program that causes a computer to execute the following.

Images