Signature generation apparatus, signature verification apparatus, signature generation method, signature verification method, signature generation program, and signature verification program

Abstract

To constitute a digital signature system capable of securing safety even when a quantum computer appears and shortening a key length.SOLUTION: In a signature generation device, a secret key input unit accepts input of secret keys which are n polynomials of m variables on a polynomial ring Fp [t] of one variable. Note that the variables of the private key are m independent variables, and the private key is the zero point of the public key as a polynomial with n + m variables on the 1-variable polynomial ring Fp [t]. The hash value calculation unit calculates a hash value h (M) of a plaintext M. The hash value polynomial generation unit generates m hash value polynomials hi (t) from the hash value h (M). The signature generation unit generates a signature curve σ (t) by substituting m hash value polynomials hi (t) into independent variables of n m-variable polynomials constituting a secret key, and generates, as a signature, a set of signature points on the signature curve σ (t) obtained by substituting a random value into a variable t of the m hash value polynomials hi (t).SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] An embodiment of the present invention relates to a signature generation device, a signature verification device, a signature generation method, a signature verification method, a signature generation program, and a signature verification program. [Background technology]

[0002] Encryption and authentication technologies have been known for some time to prevent the leakage and tampering of digital data and ensure the safety of the networked society. However, even the currently widely used RSA encryption and elliptic curve cryptography are at risk of being decrypted when quantum computers emerge. Currently, widely used digital signatures include RSA signatures based on RSA encryption and ECDSA (Elliptic Curve Digital Signature Algorithm), which supports elliptic curve cryptography. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 4575251 [Patent Document 2] Patent No. 5132724 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with conventional technology, it has been difficult to create a digital signature scheme that can ensure security even in the face of the emergence of quantum computers and that can shorten the key length. [Means for solving the problem]

[0005] The signature generation device of the embodiment includes a private key input unit, a plaintext input unit, a hash value calculation unit, a hash value polynomial generation unit, a random value generation unit, a signature generation unit, and a signature output unit. The private key input unit is a finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. pThe one-variable polynomial ring F defined above p The input of a private key is an m-variable polynomial over [t], where the variables of the private key are the m independent variables, and the private key is a polynomial ring F p The plaintext input unit receives input of plaintext M to be signed. The hash value calculation unit calculates a hash value h(M) of the plaintext M. The hash value polynomial generation unit generates m hash value polynomials h(M) from the hash value h(M). i (t) (i=1, , m). p The signature generation unit generates random values ​​without overlapping. The signature generation unit generates random values ​​without overlapping. The signature generation unit generates random values ​​without overlapping. The signature generation unit generates random values ​​without overlapping. i (t) (i=1, , m) to generate a signature curve σ(t), and i A signature output unit generates a set of signature points on the signature curve σ(t) obtained by substituting the random value for a variable t in (t) (i=1, , m), and outputs the signature. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 3 is a diagram showing an example of system parameters according to the first embodiment. [Figure 2] FIG. 3 is a diagram showing an example of setting system parameters according to the first embodiment. [Figure 3] FIG. 2 is a diagram showing an example of the functional configuration of a key generation device according to the first embodiment. [Figure 4] 4 is a flowchart showing an example of processing by the key generating device of the first embodiment. [Figure 5] FIG. 2 is a diagram showing an example of the functional configuration of a signature generating device according to the first embodiment. [Figure 6] 4 is a flowchart showing an example of processing by the signature generating device of the first embodiment. [Figure 7] FIG. 2 is a diagram showing an example of the functional configuration of a signature verification device according to the first embodiment. [Figure 8]4 is a flowchart showing an example of processing by the signature verification device of the first embodiment. [Figure 9A] 10 is a flowchart showing an example of processing by a key generating device according to the second embodiment. [Figure 9B] 10 is a flowchart showing an example of processing by a key generating device according to the second embodiment. [Figure 10] 10 is a flowchart showing an example of processing by a signature generating device according to the second embodiment. [Figure 11] 10 is a flowchart showing an example of processing by a signature verification device according to the second embodiment. [Figure 12] FIG. 2 is a diagram showing an example of the hardware configuration of a key generation device, a signature generation device, and a signature verification device. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, with reference to the accompanying drawings, embodiments of a signature generation device, a signature verification device, a signature generation method, a signature verification method, a signature generation program, and a signature verification program will be described in detail.

[0008] In modern society, most administrative procedures are now electronic. Although people still need to enter data once using a personal computer (PC) or smartphone, they can then use the Internet to access appropriate services, even from remote locations, as long as their identity is confirmed using a password or other means. Service providers can also automatically obtain each individual's usage history.

[0009] There are also devices that generate data semi-automatically, such as sensors. For example, internet-connected electricity meters (smart meters) periodically measure the amount of electricity consumed at home or in the workplace. The measured amount of electricity is digitized and sent to the power company via the internet. The power company uses this energy data to calculate each household's electricity bill, and by continuously tracking power consumption, they can operate power generation systems efficiently and contribute to the realization of a low-carbon society.

[0010] Because the Internet is an open network, if no information security measures are taken, this digital data can be easily viewed and, depending on the circumstances, even tampered with. If the power data transmitted from a smart meter installed in a home to the power company can be viewed, the amount of power consumed in that home over a certain period of time can be determined, and by comparing this with the power consumption of that home over other periods of time, it can be determined whether or not the home is at home.

[0011] Furthermore, if the amount of electricity consumed is falsified, electric power companies will not be able to accurately grasp the status of power consumption, which will not only prevent them from collecting electricity bills appropriately, but will also have a serious impact on the power generation system and could lead to major blackouts due to power shortages. Encryption and authentication technologies are technologies that prevent the leakage and falsification of digital data and ensure the safety of the network society.

[0012] Among cryptographic technologies, public key cryptography can encrypt data using only public information (public key) without using specific secret information (private key), so it is essential for services and systems that target an unspecified number of people, such as those mentioned above.Taking the above-mentioned smart meter as an example, if a common private key is set between the electric power company and the smart meter for confidential communications with the electric power company, confidentiality cannot be achieved if the private key is leaked from the smart meter in a home, and if the leak cannot be detected, personal information will be leaked for a long period of time.

[0013] In contrast, public key cryptography uses a public key for encryption, so even if the public key is leaked, confidentiality is not affected in any way. Furthermore, by actively disclosing the public key, it becomes possible to collect data from an unspecified number of people and devices while keeping the contents confidential. In other words, public key cryptography is an essential technology for using the Internet with an unspecified number of people and devices, and it is no exaggeration to say that the Internet has developed to this point thanks to public key cryptography.

[0014] The unique property of public key cryptography, which allows security to be maintained even when the public key is made public, is evidenced by the fact that although there are methods for deriving the private key from the public key, the process of deriving the private key from the public key takes an enormous amount of time. In other words, public key cryptography is designed so that the process (calculation) of deriving the private key from the public key is equivalent to the process (calculation) of solving a certain computationally difficult problem. The computationally difficult problem referred to here is called an NP problem, which is a problem that requires computational time exponentially with the size of the problem.

[0015] The NP problem will be explained using the prime factorization problem as an example. Prime factorization is easy if the bit length of the natural number N in question is small, but it is known that the computational complexity increases sub-exponentially with current computers when the bit length is large. RSA cryptography bases its security on this prime factorization problem. In addition, in elliptic curve cryptography, public key cryptography is constructed based on the security of an NP problem called the discrete logarithm problem on an elliptic curve. The discrete logarithm problem on an elliptic curve is easy if the bit length of the finite field that defines the elliptic curve is small, but it is known that it becomes exponentially more difficult to compute as the bit length increases.

[0016] Meanwhile, digital signatures, a tamper-proof technology, are also based on the principles of public key cryptography. That is, on the signature generation side, a signature is generated using a private key for the plain text to which the signature is to be attached. On the signature verification side, the validity of the signature is verified using a public key based on the sent signature and plain text. Signature verification requires that the signature satisfy the signature verification conditions through calculation, and in most digital signatures, a signature verification formula is calculated to confirm that the signature verification conditions are satisfied.

[0017] In other words, only the sender (signature generator) who has the private key can create a signature that satisfies the signature verification conditions for the plaintext, so it is possible to indirectly prove that the plaintext sent has not been tampered with.Currently, RSA signatures based on RSA encryption and ECDSA, which supports elliptic curve cryptography, are widely used as digital signatures.

[0018] However, these RSA encryption and signatures and elliptic curve cryptography (and ECDSA) are at risk of being decrypted (tampered with) with the advent of quantum computers. A quantum computer is a computer that can perform massively parallel calculations (based on a different principle from current computers) by utilizing the physical phenomenon known as entanglement, which is known from quantum mechanics. Until now, quantum computers have been considered hypothetical computers whose operation has only been confirmed at the experimental level, but in recent years, quantum computers have been shown to have performance that exceeds that of classical computers (quantum supremacy), and efforts to realize them are progressing rapidly.

[0019] In 1994, Shor demonstrated that quantum computers can be used to construct algorithms that efficiently solve prime factorization and discrete logarithm problems. In other words, if quantum computers are realized, RSA encryption and signatures based on prime factorization, and elliptic curve cryptography (and ECDSA) based on the discrete logarithm problem (on elliptic curves) can be decrypted (or tampered with in the case of signatures).

[0020] Given this situation, research into public key cryptography, which has the potential to maintain security even when quantum computers are realized, has been actively conducted in recent years. One public key cryptography that is currently feasible and is considered difficult to decipher even with a quantum computer is lattice cryptography. Lattice cryptography is a type of public key cryptography that bases its security on the problem of finding the point closest to the origin among all points other than the origin in a discrete n-dimensional vector space (linear space) called a lattice (shortest vector problem).

[0021] Although the shortest vector problem is an NP problem, it is a linear problem, so small problems can be easily solved. Therefore, in order to achieve security, it is necessary to increase the number of dimensions, which increases the key sizes of public and private keys. This raises concerns about its applicability to low-end devices with many restrictions on memory and computing power, and narrowband wireless communications with narrow transmission bandwidths. Lattice signatures, which base their security on the shortest vector problem like lattice cryptography, are known, but they have the same issues as lattice cryptography due to their large key sizes.

[0022] The following section focuses on digital signatures based on public key cryptography, and explains the current status and challenges of digital signatures that cannot be forged even by quantum computers. First, digital signatures based on public key cryptography have traditionally required large circuit scales and long processing times, meaning that they have either not been possible to implement in low-power environments such as mobile devices, or even if they were, the processing time has been long. For this reason, there is a demand for digital signatures that can be implemented in low-power environments.

[0023] Generally, digital signatures are constructed by finding a computationally difficult problem (such as the prime factorization problem or the discrete logarithm problem) and generating a signature corresponding to plaintext (without knowing the private key) is equivalent to solving that computationally difficult problem. However, even if a computationally difficult problem is identified, it does not necessarily mean that a digital signature can be easily constructed that bases its security on that problem. This is because if security is based on a problem that is too difficult to compute, the problem of generating the key for that problem will also be difficult and unrealizable.

[0024] On the other hand, if the problem is made easy enough to generate a key, it also becomes easy to forge a signature. Therefore, constructing a digital signature requires creativity, not only to find a computationally difficult problem, but also to redesign it so that it strikes the perfect balance: easy enough to generate a key, but not so easy that it can be forged (without knowing the generated private key). Because of the difficulty of constructing this part, only a handful of digital signatures have been proposed to date.

[0025] In this situation, digital signatures (Patent Documents 1 and 2) have been proposed, which may not be able to be efficiently decrypted even by calculations using a quantum computer, and which are expected to be able to be processed quickly even in low-power environments.

[0026] The digital signature above is F p [t]For the 3-manifold A(x1,x2,y)=0 defined above, let us call this F p Polynomial solution when viewed as an indeterminate equation A'(x1,x2)=0 on [t][y] (x1,x2)=(u1(y,t),u2(y,t)) When the private key is A(x1, x2, y) and the public key is a 3-dimensional manifold A(x1, x2, y), the signature generation of this digital signature requires a means to calculate the hash value h(M) of plaintext M and a means to convert this hash value h(M) into F. p A method for embedding the hash value h(M) into the coefficients of the hash value polynomial h(t) on [t], and substituting the hash value polynomial h(t) with the hash value h(M) embedded into the variable y of the polynomial solution (x1, x2) = (u1(y, t), u2(y, t)), which is the private key, for signing. σ=(σ1(t),σ2(t))=((u2(h(t),t),u2(h(t),t)) The present invention is characterized by comprising a process for generating the above.

[0027] This signature is composed of a univariate polynomial, and is geometrically a curve. Therefore, we will refer to this as the signature curve below. Signature verification requires a means to calculate the hash value h(M) of plaintext M and a means to convert this hash value h(M) into F. p A means of embedding the signature σ=(σ1(t),σ2(t)) and the hash value h(M) into the coefficients of the hash value polynomial h(t) on [t], and substituting the hash value polynomial h(t) with the given signature σ=(σ1(t),σ2(t)) and the hash value h(M) into the variables x1, x2, y of the three-dimensional manifold A(x1, x2, y), which is the public key, respectively; A(σ1(t),σ2(t),h(t)) and a determining means for accepting the request when the result of the calculation is 0, and for rejecting the request when the result is other than 0.

[0028] This digital signature is a set of polynomials, and the secret key (x1,x2)=(u1(y,t),u2(y,t)) Since the hash value polynomial h(t) is substituted for the variable y in (t), the following attacks exist: The private key is written as the following equation (1).

[0029]

number

[0030] where d is the degree of the solution with respect to the variable y, and i The one-variable polynomial β in the above equation (1) has the same degree. i,k If each coefficient of (t) (i=1,2) is set as a variable and h(t) is substituted for y, a signature σ=(σ1(t),σ2(t)) is generated as shown in the following equation (2).

[0031]

number

[0032] Here, each component of the signature σ i Comparing the coefficients of the indeterminate element t on both sides of the following equation (3) for (t) (i=1,2), we find that the polynomial β i,k A linear equation with the coefficient of (t) as a variable is obtained.

[0033]

number

[0034] The number of equations obtained here is the degree of the left side plus 1, resulting in equation (4) below.

[0035]

number

[0036] Here, the coefficient β i,k If the degree of (t) is constant regardless of i and k and is written as degβ(t), the number of equations is degβ(t)+d·degh(t)+1 On the other hand, the number of variables is β i,k Since it is the number of coefficients of (t), for each component, (d+1)·(degβ(t)+1) That is, β obtained by comparing the coefficients of each component of equation (2) i,kIf the number of equations in a linear simultaneous equation with coefficients (i=1,2,k=0,...,d) as variables is equal to or exceeds the number of variables, the likelihood of finding a unique solution increases, allowing the private key to be recovered. This is called a coefficient comparison attack.

[0037] In order to provide resistance to this coefficient comparison attack, the number of variables in the simultaneous equations generated from the signature σ by the above-mentioned means must exceed the number of equations, degβ(t)>degh(t)-1 However, this is a condition to ensure that the private key cannot be restored from a single signature. Now, if L(≧1) signatures are obtained, then from them, L (degβ(t)+d degh(t)+1) On the other hand, since the number of variables does not change, in order to prevent the private key from being recovered even if L signatures are given, L<(d+1)(degβ(t)+1) / (degβ(t)+d·degh(t)+1) This condition means that there is a limit to the number of signatures that can be made.

[0038] Increasing the maximum number of signatures L imposes restrictions on degβ(t) and degh(t), which leads to problems such as an increase in the length of the private key. For example, when L=d, degβ(t)>d 2 degh(t)-1 This is the condition for avoiding this attack, and it becomes necessary to set the degree of the private key coefficient β(t) very large relative to the degree of the hash value polynomial h(t), which increases the size of the private key. As the private key becomes larger, the public key also inevitably becomes larger, which creates the problem of a large key size, similar to lattice cryptography.

[0039] In Patent Documents 1 and 2, the set of polynomials that is the secret key is (x1,x2)=(u1(y,t),u2(y,t)) In the embodiments of Patent Documents 1 and 2, when generating a signature, one polynomial is randomly selected from a set of multiple polynomials, and then the signature is created. Therefore, in order to make this coefficient comparison attack successful, it is necessary to collect signatures generated from the same private key, and if the probability of collecting L signatures generated from the same private key is negligibly small, the restriction on the number of signatures can be removed. However, even in this case, if the signature is a signature curve, there is a problem in that the key size becomes large.

[0040] In the embodiment described below, in view of the current situation, we will explain an embodiment that configures a digital signature scheme that can ensure security even in the event of the emergence of quantum computers and that has a shorter key length by providing resistance to the coefficient comparison attacks described above.

[0041] First, as a preliminary step, the algebra and notation used in this embodiment will be defined. First, as a mathematical preliminary step, the mathematical concepts and notation used in this embodiment will be explained.

[0042] [algebra] First, we define the algebra used in this embodiment. First, let us denote the set of integers by Z, and let us denote the coset of integer Z at natural number p by Z. p It is written as Z. p is a coset, so usually, Z p ={[0],[1],...,[p-1]} Here, Z p Since each element of satisfies the following properties, addition, subtraction, and multiplication are defined. [a]+[b]=[a+b] [a]-[b]=[ab] [a]·[b]=[a·b]

[0043] A set in which addition, subtraction, and multiplication can be defined, the associative law holds, and which contains the additive identity element 0 and has an inverse element [-x] ([x]+[-x]=[0]) that equals 0 when added to any element x other than 0 is called a ring.

[0044] A ring that, in addition to these properties, also has the commutative law ([a]+[b]=[b]+[a], [a]·[b]=[b]·[a]) is called a commutative ring, and if it also has a multiplicative identity [1], it is called a commutative ring with identity.

[0045] Regarding division, it can only be defined for [b] where there exists an element [x] that satisfies [b]·[x]=[x]·[b]=[1]. When such an element [x] exists, [x] is called the inverse of [b], and -1 ]. For [b] where an inverse exists, the division [a] / [b] is [b]·[b -1 ]=[1] The inverse element [b -1 ] multiplied by [a] ([a]·[b -1 ])

[0046] Z p element [b] to the inverse element [b -1 ] exists if and only if GCD(b,p)=1. That is, Z p An element b of is inverse element [b -1 For example, when p=5, b=3 has the same meaning as [3 -1 ]=[2]. However, if p=6, then GCD(3,6)=3, which means they are not mutually prime and there is no inverse, so division cannot be performed.

[0047] Now, [0] represents the set that leaves a remainder of 0 when divided by p. If we write it explicitly, [0]={···,-2p,-p,0,p,2p,···} It means Z p When defining the operation on Z, since the answer will be the same regardless of which element of the set [0] is used for the calculation, for simplicity, we will use one element (representative) included in the set [0] as a representative. This representative can be any element included in this set (due to its nature), but in this embodiment, for simplicity, we will use 0 as a representative. Similarly, we will represent [1] with the smallest positive integer such as 1 and [2] with the smallest positive integer such as 2, and use Z pLet be represented by {0, 1, , p-1}.

[0048] Here, if p is a prime number, all representatives other than 0 are relatively prime to p, and division can be defined. That is, if p is a prime number, then Z p In this way, a commutative ring with an identity element and a set in which elements other than 0 have a multiplicative inverse is called a field. In particular, when p is a prime number, Z p A field consisting of a finite number of elements is called a finite field. The number of elements in a finite field is either a prime number or a power of a prime number, and the former is called a prime field. That is, Z mentioned here p is a prime field. To clarify that it is a finite field, we will use F p It is written as follows.

[0049] Next, we present notations and definitions related to polynomials. p Let F be a set of univariate polynomials with coefficients. p It is written as [t]. p Although [t] can be added, subtracted, and multiplied, division of polynomials is not possible because there is no inverse except for non-power constant polynomials consisting only of constant terms.

[0050] Next, we define terminology and notation for multivariate polynomials.

[0051] [Two-variable polynomial notation] Univariate polynomial ring F p The two-variable polynomial on [t] is written as the following equation (5).

[0052]

number

[0053] where τ i,j (t) is a univariate polynomial ring F p It is an element of [t]. The set Γ(ξ) is the set of pairs of exponents (i(x-index), j(y-index)) of non-zero monomials contained in the polynomial ξ(x,y), and is called the term set of the two-variable polynomial ξ(x,y).

[0054] For example, the term set of the polynomial on Z7 in the following formula (6) is the following formula (7).

[0055]

number

[0056]

number

[0057] Here, the number of elements of Γ(ξ) is the same as the number of monomials in the two-variable polynomial ξ(x,y). In the following, when it is clear that it is a two-variable polynomial, ξ(x,y) may be written simply as ξ.

[0058] In this embodiment, for simplicity, the term set of a two-variable polynomial of degree D that has the largest number of elements is called the maximal term set of degree D, and Γ D That is, when D=2, the following formula (8) is obtained, and when D=3, the following formula (9) is obtained.

[0059]

number

[0060]

number

[0061] This Γ3 is the term set Γ in the above formula (7). ξ as a subset. This includes the above Γ(ξ) as a subset. D can generally be written as the following equation (10).

[0062]

number

[0063] term set Γ D Given this term set ΓD A univariate polynomial ring F with p A set of two-variable polynomials on [t] is defined by the following equation (11).

[0064]

number

[0065] where a i,j (t) is F p It is an element on [t]. When the coefficient ring is clear, the left side of the above formula (11) can be simply written as F ΓD Also, the coefficient a i,j When the degree of (t) is limited to d or less, we write it as the following formula (12), and similarly, when the coefficient ring is clear, we simply write F ΓD,d It is written as follows.

[0066]

number

[0067] [Notation for n-variable polynomials] Univariate polynomial ring F p The notation for n-variable polynomials on [t] is defined similarly, i.e., written as the following equation (13).

[0068]

number

[0069] where μ i1,i2,···,in (t) is a univariate polynomial ring F p The set Γ(ξ) is an element of [t]. The set Γ(ξ) is a polynomial ξ(x1,x2,...,x n ) contains the set of exponents (i1,i2,...,i n ), the set of n-variable polynomial expressions ξ(x1,x2, ,x n ) is called the term set of

[0070]

number

[0071] Here, the number of elements of Γ(ξ) is the n-variable polynomial ξ(x1,x2, ,x n ) is the number of monomials included in the polynomial. In the following, if it is clear that the polynomial is an n-variable polynomial, n ) is simply written as ξ.

[0072] In addition, for n-variable polynomials, the term set Γ is the same as for two-variable polynomials. D is defined as the maximum term set of total degree D (the following formula (15)).

[0073]

number

[0074] term set Γ D Given this term set Γ D A univariate polynomial ring F with p A set of n-variable polynomials on [t] is defined by the following equation (16).

[0075]

number

[0076] where a i1,i2,···,in (t) is F p [t]. When the coefficient ring is clear, the left side of the above equation (16) can be simply written as F ΓD Also, the coefficient a i1,i2,···,in When the degree of (t) is limited to d or less, we write it as the following equation (17), and similarly, when the coefficient ring is clear, we simply write F ΓD,d It is written as follows.

[0077]

number

[0078] [(n,m)-variable polynomial notation] In this embodiment, the variables are classified into dependent variables (x1, x2, . . . , x n ) and the independent variables (y1, y2, ,y m ) divided into polynomials η(x1,x2, ,x n ,y1,y2,···,y m ) and called an (n,m)-variable polynomial. An (n,m)-variable polynomial deals with the dependent variables (x i ) i=1,···,n and the independent variable (y j ) j=1,···,m The total degree of D x , D y This is expressed as the following equation (18).

[0079]

number

[0080] Here, the total degree of the dependent variables is D x The total degree of the independent variables is D y A set of (n, m) variable polynomials is written on the left side of the following equation (19) and defined on the right side of the following equation (19).

[0081]

number

[0082] where a i1,···,in,j1,···,jn (t) is F p It is an element of [t]. When the coefficient ring is clear, the left side of the above equation (19) can be simply written as F ΔDx,Dy Also, the coefficient a i1,···,in,j1,···,jn When the degree of (t) is limited to d or less, we write it as the following equation (20), and similarly, when the coefficient ring is clear, we simply write F Dx,Dy,d It is written as follows.

[0083]

number

[0084] where the independent variable y j The only polynomial is D x= 0, and write it as the following equation (21).

[0085]

number

[0086] Conversely, the dependent variable x i The only polynomial is D y = 0, and write it as the following equation (22).

[0087]

number

[0088] In the following, for (n,m)-variable polynomials, the dependent variable x i The notation of the following equation (23) focusing on the independent variable y j We use the notation of the following equation (24) which focuses on

[0089]

number

[0090]

number

[0091] Here, A in the above formula (23) i1,···,ivx (y1,...,y vy ) is F p [t][y1, ,y vy ], A in the above equation (24) j1,···,jvy (x1,...,x vx ) is F p [t][x1, ,x vx These are merely differences in notation, and the more clear one is used in each case.

[0092] [Solutions and Zeros] In this embodiment, a one-variable polynomial ring F p Equation on [t] A(x1, ,x n ,y1,···,y m )=0 Let F be the (m+1)-variable polynomial ring p [t][y1, ,y m ]This can be considered as the equation shown in equation (25) below.

[0093]

number

[0094] The following n-dimensional vector (x1,...,x n )=(u1(y1, ,y m ),···,u n (y1,...,y m )) When satisfies the above equation (25), this n-dimensional vector is called the solution of equation A. That is, A(u1(y1, ,y m ),···,u n (y1,...,y m ))=0

[0095] Also, A(x1, ,x n ) into the polynomial ring F p [t][y1, ,y m ], the solution to the above equation (25) is the polynomial A(x1, ,x n ) is called the zero point.

[0096] [Indeterminate equations and their solutions] An indeterminate equation can be defined as an equation in which the number of variables is greater than the number of expressions (contained in the equation). Indeterminate equations have few constraints, but the degree of freedom in the solution is large, so if they have solutions, they often have multiple (sometimes infinite) solutions (this is what "indeterminate" means). In fact, there are an infinite number of real solutions (or complex solutions) for indeterminate equations with integer coefficients, and it is easy to find some of them as approximate solutions.

[0097] On the other hand, such methods cannot be used for equations that have solutions in a discrete set, such as integer solutions to indeterminate equations with integer coefficients. Therefore, some theoretical narrowing down is necessary, but even if such narrowing down is performed, it is generally known that it is not possible to determine the existence or non-existence of a solution in a finite number of attempts (unsolvable problem).

[0098] In this embodiment, the indeterminate equation signature is a polynomial ring F p [t][y1, ,y m ]The indeterminate equation A(x1, ,x n The basis of its security is the problem of finding the solution to the following polynomial equation for ∑ ... (x1,...,x n )=(u1(y1, ,y m ),···,u n (y1,...,y m ))

[0099] polynomial ring F p [t][y1, ,y m ]The problem of solving the indeterminate equation above is defined as follows.

[0100] Definition 1 (polynomial ring F p [t][y1, ,y m ]) polynomial ring F p [t][y1, ,y m ]The indeterminate equation A(x1, ,x n ) = 0, the polynomial solution (u1(y1, ,y m ),···,u n (y1,...,y m )) into a polynomial ring F p [t][y1, ,y m ]This is called the problem of solving the indeterminate equation above.

[0101] (First embodiment) Regarding the first embodiment, the specific algorithm is a key, a parameter, a key generation algorithm, The algorithm will be explained in the order of the signature generation algorithm, signature verification algorithm, and signature verification algorithm. The signature scheme of this embodiment is characterized in that, in order to enhance resistance to coefficient comparison attacks compared to conventional techniques, the signature is not a curve including a polynomial, but a point on this curve. In this way, the information of the private key disclosed as the signature is reduced, and resistance to coefficient comparison attacks starting from the signature is enhanced. Note that, although simple numerical examples corresponding to the algorithm are shown below, these numerical examples are intended to aid in understanding the algorithm and do not necessarily ensure security.

[0102] [Keys and parameters] The parameters required to configure the signature scheme of this embodiment are listed below. x dependent variables x1, ,x vx and, v y Independent variables y1, ,y vy The public key of this signature scheme is given by the indeterminate equation A(x1, ,x vx ,y1,···,y vy ) which is expressed by the following equation (26).

[0103]

number

[0104] where PDX and PDY are the total degrees of the dependent variables and the independent variables in the public key, respectively, and their coefficients α i1,···,ivx,j1,···,jvy The degree of (t) is uniformly set to Pdt regardless of the term.

[0105] The private key of this signature scheme is the public key of the indeterminate equation A(x1, ,x vx ,y1,···,y vy )=0 is the following solution. (x1,...,x vx )=(u1(y1, ,y vy ),···,u vx (y1,...,y vy ))

[0106] A detailed look at each of these components gives the following formula (27).

[0107]

number

[0108] where SDY is the independent variable in the private key (y j ) j=1,···,vy The total degree of the coefficient β 1,j1,···,jvy The degree of (t) is uniformly set to Sdt regardless of the term. p The parameters are the order p of the hash value polynomial h(t), the degree Hdt of the hash value polynomial h(t), and the number of points NSP that make up the signature. These parameters are summarized in Figure 1.

[0109] Fig. 1 is a diagram showing examples of system parameters in the first embodiment. In the following, the parameters in Fig. 1 are set to values ​​shown in Fig. 2. Fig. 2 is a diagram showing an example of setting system parameters in the first embodiment. The key generation process, signature generation process, and signature verification process in the first embodiment will be described with specific examples in which the parameters are set to the values ​​shown in Fig. 2.

[0110] [Key generation algorithm] The key generation algorithm is an algorithm that generates a public key and a private key using the parameters shown in FIG. 1 as input. vx ,y1,···,y vy ) is required to have the private key at its zero point, but since it is computationally difficult to find a solution from an indeterminate equation, the key generation algorithm generates an indeterminate equation from its zero point. That is, first, v shown in the above equation (27) x The following private key of the pair is taken as parameters p,v x ,v y , SDY and Sdt are generated uniformly at random. (x1,...,x vx )=(u1(y1, ,y vy ),···,u vx (y1,...,y vy ))

[0111] Specifically, in the example parameters in Table 2 above, v x = 3, the three sets of polynomials in the following equation (28) are generated as the private key.

[0112]

number

[0113] Next, a public key is generated with the zeros of these three polynomials at x1, x2, and x3 coordinates. The public key is generated by i This is expressed by the following equation (29), which focuses on

[0114]

number

[0115] constant term A 0,···,0 (y1,...,y vy ) are generated randomly according to the parameters p, PDY, and Pdt, for example, as shown in the following equation (30).

[0116]

number

[0117] In this case, the constant term is calculated using the secret key using the following equation (31).

[0118]

number

[0119] Specifically, the constant term is calculated using a secret key, for example, using the following equation (32).

[0120]

number

[0121] If we use the following formula (33), this private key (u1, ,u vx ) is A(u1, ,u vx ,y1,···,y vy )=0.

[0122]

number

[0123] In this way, the indeterminate equation A(x1, . . . , x vx ,y1,···,y vy ) is generated, for example, as shown in the following formula (34).

[0124]

number

[0125] [Signature generation algorithm] The signature generation algorithm for the indeterminate equation signature of this embodiment is as follows: A signature σ is generated from plaintext M through the following signature generation steps 1 to 4.

[0126] 1. The hash value H(M) of plaintext M is calculated using an arbitrary hash function, for example, as follows: where (11) at the end is the hash value of the finite field F p indicates the order p of the number, and indicates that this notation is in base 11. H(M)=(4,4,1,10) (11)

[0127] 2. The hash value H(M) is v y hash value polynomial h i (t)(i=1, ,v y ) is embedded in the coefficients as follows: (h1(t),h2(t))=(4t+4,t+10)

[0128] 3. Hash value polynomial (h1(t), ,h vy(t)) is the private key (u1(y1, ,y vy ),···,u vx (y1,...,y vy )) independent variables y1, ,y vy and the signature curve σ(t) is calculated by the following equation (35).

[0129]

number

[0130] Specifically, the signature curve σ(t) is calculated, for example, as shown in the following equation (36).

[0131]

number

[0132] 4.F p Former k (k=1, . . . , NSP) are randomly extracted so as not to overlap, and a signature is obtained by generating a point set from these elements using the following formula (37).

[0133]

number

[0134] Specifically, the signature σ is expressed as follows, for example: σ=[(10,4,5,1),(7,1,4,7),(1,9,6,5), (10,10,0,9),(7,4,3,6)] Here, the points included in the signature σ are called signature points.

[0135] [Signature verification algorithm] The signature verification algorithm for the indeterminate equation signature in this embodiment is as follows: A signature σ of plaintext M is verified in the following signature verification steps 1 to 7.

[0136] 1. The hash value H(M) of plaintext M is calculated using an arbitrary hash function, for example, as follows: where (11) at the end is the hash value of the finite field F p indicates the order p of the number, and indicates that this notation is in base 11. H(M)=(4,4,1,10) (11)

[0137] 2. The hash value H(M) is v y hash value polynomial h i (t)(i=1, ,v y ) is embedded in the coefficients as follows: (h1(t),h2(t))=(4t+4,t+10)

[0138] 3. The hash value polynomial is substituted into the indeterminate equation that is the public key. Specifically, the hash value polynomial (h1(t), ,h vy (t)) is the public key A(x1, ,x vx ,y1,···,y vy ) independent variable (y j ) j=1,···,vy is substituted into the indeterminate equation A of the following equation (38) corresponding to the hash value H(M) of the plaintext M. H is generated.

[0139]

number

[0140] Indeterminate equation A of the above formula (38) H is expressed by, for example, the following equation (39).

[0141]

number

[0142] 4. In this step, indeterminate equation A HA simultaneous equation is set up to find the signature curve σ(t) for this signature scheme. The signature curve σ(t) of this signature scheme is found as follows. Each component of the signature curve σ(t) can be written as the following equation (40), as shown in equation (27) above.

[0143]

number

[0144] Here, the unknown variable is β i,j1,···,jvy (t) alone, which can be written as equation (41) below.

[0145]

number

[0146] where β (k) i,j1,···,jvy is F p is a variable that takes on values ​​(j1, ,j vy ) there are Sdt+1 for each . Substituting this into the above equation (40), we get the following equation (42), which shows that the degree of the signature curve is SDY Hdt+Sdt.

[0147]

number

[0148] Therefore, in order to obtain the signature curve, the signature curve is set as the following equation (43), and τ i,k Consider the problem of finding (i=1,···,vx,k=0,···,SDY·Hdt+Sdt).

[0149]

number

[0150]

number

[0151] The number of variables in this equation is given by (45) below.

[0152]

number

[0153] When solving the above equation (45), an equation is set up by comparing coefficients for the indeterminate element t, so the number of equations is as follows: (PDY·Hdt+Pdt)+PDX·(SDY·Hdt+Sdt)+1

[0154] In the case of the numerical example of this embodiment, the number of variables is 12, the number of equations is 8, and the following simultaneous equations (46) are obtained.

[0155]

number

[0156] 5. In this step, we derive a relational expression for finding the signature curve from the signature point σ. The signature point is a point on the signature curve (if the signature is verifiable and correct). Therefore, we use the hash value polynomial h as the independent variable of the public key. i (t)(i=1, ,v y ) is substituted into the indeterminate equation A H (x1,...,x vx ) (the above equation (38)) is substituted with the signature points to derive a simultaneous equation. That is, the following equation (47) is derived.

[0157]

number

[0158] The above equation (47) is based on the variable β (k) j1,···,jvy In the case of the signature points shown in the numerical example of this embodiment, the simultaneous linear equations of the following equation (48) are obtained.

[0159]

number

[0160] 6. The above equations (46) and (48) are combined to generate an S-polynomial in order to calculate the Groebner basis of the set of polynomials that make up the simultaneous equations for determining the signature curve. That is, S-polynomials up to degree 1 are calculated for the set of polynomials generated by the nonlinear polynomial obtained in signature verification step 4 and the linear polynomial obtained in signature verification step 5.

[0161] 7. If the polynomial set obtained in signature verification step 6 is not an empty set, the signature is accepted, and if it is an empty set, the signature is rejected. In the case of the numerical example of this embodiment, the polynomial set is not an empty set, so the signature is accepted.

[0162] For example, when the following signature σ including a signature point not on the signature curve is input, the above simultaneous equations (48) become simultaneous equations (49). σ=[(5,9,5,9),(6,7,4,4),(7,8,2,3), (9,1,0,2),(5,0,8,5)]

[0163]

number

[0164] When the above simultaneous equation (49) is combined with the above simultaneous equation (46) to generate the S polynomial of the polynomial set that constitutes the simultaneous equations for finding the signature curve, the result is an empty set, so a signature σ that includes a signature point that is not on the signature curve is rejected.

[0165] In this signature verification process, it is confirmed that the set of points obtained as a signature is on the signature curve up to the early stage of a signature curve derivation attack, which will be described in detail below. In other words, if all of the signature points are on the signature curve, the simultaneous equations derived for the purpose of deriving the signature curve have a solution, and the polynomial set does not become an empty set during processing up to that point. On the other hand, if the signature points are not on the signature curve, the simultaneous equations have no solution, and the polynomial set becomes an empty set in the early stage of a signature curve derivation attack.

[0166] Furthermore, since the polynomial derived from the signature points is a linear polynomial, this can be determined using S-polynomial calculations up to the first degree, and the calculation is completed in polynomial time with respect to the number of variables. Also, if the system parameters are selected appropriately, the possibility of determining the signature curve using S-polynomial calculations up to the first degree is almost zero, so the possibility of deriving the signature curve through a signature curve derivation attack and forging the signature can be ignored.

[0167] (Modification 1 of the first embodiment) Modification 1 of the first embodiment will be described. In the description of Modification 1, the same description as in the first embodiment will be omitted, and only differences from the first embodiment will be described. Modification 1 describes a variation in which overlapping of signature points is checked during signature verification.

[0168] In the signature generation algorithm of the first embodiment described above, in the signature generation step 4, a finite field F is selected so that the NSP signature points are distinct points. p Former k Therefore, in the signature verification algorithm, the last component t of the signature σ in the following formula (50) is extracted. k A step is added to determine whether the signatures are different, and a process is added to reject the signature if there is an overlap.

[0169]

number

[0170] According to the first modification, it becomes possible to quickly repudiate a forged signature, and signature verification can be performed more efficiently.

[0171] (Modification 2 of the first embodiment) Modification 2 of the first embodiment will be described. In the description of Modification 2, the same explanation as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. Modification 2 describes a variation for confirming the validity of the signature point in signature verification.

[0172] In the signature generation algorithm of the first embodiment, a point on the signature curve is selected as the signature point in the signature generation step 4. The signature point is not only on the signature curve but also satisfies the indeterminate equation A H (x1,...,x vx )=0.

[0173] To confirm that the signature point is a point on the signature curve, it is necessary to set up simultaneous equations and verify them as in the signature verification algorithm of the first embodiment. H If you just want to check that the signature point satisfies A, H and confirming that it is 0. This calculation requires an overwhelmingly smaller amount of computation than the signature verification process, which verifies that the signature point is a point on the signature curve.

[0174] Therefore, in an environment where there are many forged signatures (for example, an environment where the number of forged signatures detected per unit time is greater than a threshold), if the verification process of variant example 2 is performed before confirming that the signature point is a point on the signature curve, the signature verification algorithm of the digital signature of the first embodiment can be speeded up.

[0175] (Modification 3 of the first embodiment) Modification 3 of the first embodiment will be described. In the description of Modification 3, the same description as in the first embodiment will be omitted, and only differences from the first embodiment will be described. In Modification 3, a variation of the Groebner basis calculation performed in signature verification will be described.

[0176] In the signature verification process of the first embodiment, if the signature point set is correct, all of the signature points included in the signature point set are points on the signature curve σ(t) generated from the private key, so when equation F that derives the signature curve σ(t) and equation G obtained from each of the above signature points are formulated simultaneously, a solution always exists.

[0177] On the other hand, if the signature is forged, by appropriately setting parameters, it becomes difficult for a third party who does not know the signature curve σ(t) to construct a signature point set from only points on the signature curve σ(t). In this case, when the equation F is combined with the equation G obtained from the signature points included in the signature point set, no solution exists. The signature scheme of this embodiment is characterized in that the difference between these two equations can be determined by solving the simultaneous equations.

[0178] On the other hand, if the signature curve σ(t) is found from the set of signature points, there is a possibility of signature forgery, so the key is set and the number of signature points is determined so that the signature curve σ(t) cannot be found in the end, and the presence or absence of the solution is determined by executing the solution process for the equation partway. The simultaneous equations for finding the signature curve σ(t) in this embodiment are multivariable nonlinear simultaneous equations, and Groebner basis calculation is generally used for their solution.

[0179] Groebner basis calculation is a calculation method for simplifying polynomials that appear in simultaneous equations into a form that makes the equations easier to solve. Groebner basis calculation is composed of S-polynomial calculations for the above-mentioned simplification. S-polynomial calculations are operations that select two polynomials from a polynomial set and perform their simplification, starting with calculations between polynomials of low degree and gradually progressing to calculations between polynomials of higher degree.

[0180] In the first embodiment, the presence or absence of a solution was determined using S polynomial calculations up to degree 1, but this is because the degree of the simultaneous equations arising from the signature points is linear. If appropriate parameters are selected, S polynomial calculations up to degree 1 can be sufficient for determination, but if verification errors occur, it is also possible to increase the degree to 2 or more. By configuring in this way, the time required for signature verification processing will increase, but signature verification with fewer verification errors can be achieved.

[0181] Furthermore, considering that the signature verification operation is a Groebner basis calculation of the polynomial set constituting the simultaneous equations, it is also possible to determine the target polynomial set by simply simplifying it, rather than using the S-polynomial. While this may increase the number of verification errors, it is possible to shorten the time required for the signature verification process. In this way, the Groebner basis calculation for the polynomial set is stopped at an appropriate step depending on the tolerance for signature verification errors, and signature verification is performed based on whether the output polynomial set is empty. This is another feature of this embodiment, allowing the signature verification process time to be appropriately adjusted.

[0182] (Fourth modification of the first embodiment) Modification 4 of the first embodiment will be described. In the description of Modification 4, the same explanation as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. Modification 4 describes variations in the determination of whether to accept or reject a signature in signature verification.

[0183] In the signature verification algorithm of the first embodiment, a simultaneous equation F is generated to find a signature curve σ(t) on an indeterminate equation obtained by substituting a hash value polynomial generated based on a hash value calculated from plaintext into the public key, and a simultaneous equation G is generated that holds when it is assumed that the set of signature points obtained as a signature are points on the signature curve.If the simultaneous equations F and G have a solution, the signature is accepted, and if there is no solution, the signature is rejected.

[0184] Here, since the signature point set of a valid signature is composed only of points that exist on the signature curve σ(t), a solution always exists and the signature will be accepted. On the other hand, the signature point set of an invalid signature contains signature points that are not included in the signature curve σ(t). For this reason, the simultaneous equation formed by combining the equation F and the equation G generated from the signature point set of the invalid signature does not have a solution. However, as shown in the third modification example, when the Groebner basis calculation is stopped at a predetermined step, the polynomial set does not become empty, and there is a possibility that the signature will be accepted, resulting in a verification error.

[0185] To solve this problem, the third modification takes a measure to change the step at which the Groebner basis calculation is stopped, but another possible measure is to repeat signature verification several times as follows. That is, in this signature verification method, K times the number of signature points NSP is generated as a signature, signature verification is repeated K times, and if it is rejected even once, it is rejected. Although this measure increases the size of the signature, it can dramatically reduce verification errors and greatly improve the reliability of signature authentication.

[0186] Even if K times NSP signature points are obtained, by randomly extracting NSP points from them and performing a single signature verification process, signature verification can be performed more than K times, and the same level of reliability can be achieved with a smaller signature size. In this way, by repeatedly performing the signature verification process on different sets of signature points, the reliability of the signature verification process can be significantly improved. Note that this variation requires that the number of signature points included in the signature be larger than usual, which requires a corresponding change to the signature generation algorithm.

[0187] Since the above-mentioned variations 1 to 4 are each independent, one of the variations 1 to 4 may be applied to the first embodiment, or two or more variations may be applied to the first embodiment simultaneously.

[0188] [Safety Considerations] Next, we will explain the security of the signature scheme of the first embodiment. There are three attacks on this signature scheme (coefficient comparison attack, key recovery attack, and signature curve derivation attack).

[0189] [Coefficient comparison attack] The above-mentioned coefficient comparison attack, which restores a private key by comparing the coefficients of multiple signatures and the private key, will be explained based on the basic algorithm of the digital signature in the first embodiment. The private key of this signature scheme is as follows: (x1,...,x vx )=(u1(y1, ,y vy ),···,u vx (y1,...,y vy ))

[0190] Each component on the right side of this equation is written as in the above equation (27). Also, the digital signature generated from this private key is given by the following equation (51).

[0191]

number

[0192] By substituting the above formula (51) into the private key together with the hash value polynomial obtained from the plaintext, one relational formula (52) is obtained for each component.

[0193]

number

[0194] The above relational expression (52), when combined with the above-mentioned expression (27), can be written as the following expression (53) for each component.

[0195]

number

[0196] Both sides of the above equation (53) are polynomials of t. For simplicity, let x i (i=1,...,v x) components individually, omitting i, we obtain the following equation (54).

[0197]

number

[0198] Here, the unknown variable is β j1,···,jvy (t) only, β j1,···,jvy (t) is written as the following equation (55).

[0199]

number

[0200] where β (k) j1,···,jvy is F p is a variable that takes on values ​​(j1, ,j vy ) there are Sdt+1 pieces for each. By substituting the above formula (55) into the above formula (54), the following formula (56) is obtained.

[0201]

number

[0202] set Δ 0,SDY The number of elements is given by the following formula (57).

[0203]

number

[0204] Therefore, the number of variables is as follows: (Sdt+1){((v y +SDY)!) / (v y !SDY!)}

[0205] On the other hand, the number of equations matches the number of signature points, which is NSP. Therefore, if there are L signatures, L·NSP equations are obtained. A linear simultaneous equation can be uniquely solved in polynomial time if the rank of the matrix derived from the linear simultaneous equation matches the number of variables. Therefore, if the number of equations exceeds the number of variables, there is a possibility that a unique solution can be found in polynomial time. In other words, if there are L equations generated from the same secret key, If it is possible to obtain L or more signatures (expression (58) below), it becomes possible to recover the private key.

[0206]

number

[0207] Conversely, if L or more signatures (the above formula (58)) cannot be obtained, a solution space with a certain dimension is formed, and it becomes necessary to search through that space by brute force, so security is ensured if the number of dimensions is large enough relative to the security parameter λ. Comparing this relationship between the number of variables and the number of formulas with the digital signature in Patent Document 1, the number of variables does not increase, but the number of formulas goes from Sdt+Hdt·SDY+1 to NSP.

[0208] Here, the parameter Sdt needs to be large to provide resistance to other attack methods such as key recovery attacks, whereas the parameter NSP only needs to be large enough for signature verification and tends to be smaller, which is the effect of the first embodiment.

[0209] [Key recovery attack] We will explain an attack that restores the private key from only the public key information. This attack aims to solve the problem of solving the indeterminate equation, which is the basis for the security of this signature scheme. The public key of this signature scheme is the following indeterminate equation (59).

[0210]

number

[0211] Here, we will use the above equation (59) as the independent variable yj Focusing on this, it is expressed as the following equation (60).

[0212]

number

[0213] Moreover, the private key corresponding to the public key is given by the following formula (61).

[0214]

number

[0215] Here, β (k) i,j1,···,jvy (i=1,...,v x ) is F p The above equation (61) is converted into x1, ,x in the above equation (60). vx Substituting into, we obtain the following equation (62).

[0216]

number

[0217] The left side of the above equation (62) contains the indeterminate elements y1, ,y vy and the variables y1, y vy The number of monomials is (u1(y1,...,y vy ),···,u vx (y1,...,y vy )) also has variable y j Considering that the variable (y j ) j=1,···,vy There are only monomials related to PDX·Sdt+Pdt, as shown in the following equation (63), and each of these has a coefficient of order PDX·Sdt+Pdt, so the number of equations is as shown in the following equation (64).

[0218]

number

[0219]

number

[0220] On the other hand, the variable β (k) i,j1,···,jvy are respectively (Sdt+1) vy+1 H SDY Since there are , the number of variables is as shown in the following equation (65), and generally the number of equations is greater than the number of variables.

[0221]

number

[0222] When PDX≧2, this simultaneous equation (65) becomes a nonlinear simultaneous equation, so there is no guarantee that it can be solved in polynomial time even if the number of equations exceeds the number of variables. A common solution method is Groebner basis calculation, but in many cases it takes exponential time. Also, the amount of calculation required for Groebner basis calculation increases when the number of equations and the number of variables are close. In the first embodiment, the system parameter v x There are as many variables as there are variables, and v x By increasing the size of the signature, it is possible to design a digital signature that is resistant to key recovery attacks.

[0223] [Signature curve derivation attack] From the following indeterminate equation (66) corresponding to the hash value H of the plaintext M, the signature curve (x1, ,x vx )=(σ1(t), ,σ vx We will explain an attack to derive (t).

[0224]

number

[0225] The signature curve of this signature method is given by the following equation (67).

[0226]

number

[0227] There may be signature curves other than the above equation (67), and their solutions also function as signature curves. Note that, since part of the signature curve derivation attack is the signature verification process, that part will be repeated in the following explanation.

[0228] In a signature curve derivation attack, the aim is to derive a signature curve by solving the indeterminate equation in the above equation (66) in the same manner as in a key recovery attack. Here, each component of the signature σ can be written as in the above equation (56), so the degree of the signature is SDY·Hdt+Sdt. Therefore, in a signature curve derivation attack, the signature is written as the following equation (68), and τ that satisfies equation (69) is i,k (i=1,...,v x Consider the problem of finding ( ,k=0,···,SDY·Hdt+Sdt).

[0229]

number

[0230]

number

[0231] The number of variables in this equation (69) is given by the following equation (70):

[0232]

number

[0233] When solving the above formula (70), an equation is formulated by comparing coefficients for the indeterminate element t, so the number of equations is the degree of t on the left side of the above formula (69) plus 1. Therefore, we find the degree of t on the left side of the above formula (69).

[0234] Here, when the following formula (71) is written as the following formula (72), the following formulas (73) and (74) are obtained.

[0235]

number

[0236]

number

[0237]

number

[0238]

number

[0239] Therefore, in the following, the following equation (75) is obtained in accordance with the above-mentioned [Key Generation Algorithm], and the degree of the following equation (76) is derived.

[0240]

number

[0241]

number

[0242] From the degree of the above equation (76), the number of equations is as follows: (PDY·Hdt+Pdt)+PDX·(SDY·Hdt+Sdt)+1

[0243] On the other hand, since this equation (69) is nonlinear, it is solved based on Groebner basis calculations, which takes exponential time.

[0244] From the above considerations, it is clear that the amount of calculation increases exponentially in any of the existing attacks, and the digital signature of the first embodiment has sufficient security.

[0245] [Specific configuration] Next, specific configurations of the key generation device, signature generation device, and signature verification device in the digital signature of the first embodiment, as well as algorithms for the key generation process, signature generation process, and signature verification process will be described.

[0246] 3 is a diagram showing an example of the functional configuration of a key generation device 10 according to the first embodiment. The key generation device 10 according to the first embodiment includes a system parameter input unit 1, a control unit 2, a random value generation unit 3, a polynomial generation unit 4, a polynomial operation unit 5, an indeterminate equation generation unit 6, and a key output unit 7.

[0247] 4 is a flowchart showing an example of processing by the key generation device 10 of the first embodiment. The processing flow of the key generation device 10 of the first embodiment will be described along the flowchart shown in FIG. 4 with reference to the example of the functional configuration shown in FIG.

[0248] The process of the key generation device 10 of the first embodiment is performed by inputting the above-mentioned system parameters p and v from the system parameter input unit 1. x ,v y , PDX, PDY, Pdt, SDY and Sdt are input (step S1).

[0249] The system parameter input unit 1 sends the system parameters input in step S1 to the control unit 2. The control unit 2 performs the following processes in cooperation with other processing units based on the input system parameters.

[0250] First, the control unit 2 assigns the secret key to the system parameters p, v x ,v y , SDY and Sdt (step S2). Specifically, the control unit 2 randomly generates the parameters p, v x ,v y , SDY, Sdt are input to the polynomial generator 4, and F p[t][y1, ,y vy ], the polynomials in which the variable y i (i=1,...,v y ) total degree is SDY and coefficient degree is Sdt v x This indicates the generation of polynomials (77).

[0251]

number

[0252] The polynomial generator 4 outputs v x (Sdt+1){((v y +SDY)!) / (v y !SDY!) number of integers between 0 and p-1. The random value generator 3 generates v x (Sdt+1){((v y +SDY)!) / (v y !SDY!)} random numbers from 0 to p-1 are generated, and the generated random numbers are input to the polynomial generator 4.

[0253] The polynomial generator 4 generates the input v x (Sdt+1){((v y +SDY)!) / (v y !SDY!)} random numbers are generated by the polynomial u xi (i=1,...,v x ) contains the coefficient β 1,j1,···,jvy (t) as coefficients of polynomial u xi (i=1,...,v x The polynomial generator 4 generates the generated polynomial u xi (i=1,...,v x ) is input to the control unit.

[0254] The control unit 2 calculates the generated polynomial u xi (i=1,...,v x ) is stored in memory as a private key.

[0255] On the other hand, in order to generate the indeterminate equation A of the following equation (78) which is the public key, the control unit 2 randomly generates coefficients other than the constant term of the indeterminate equation A (step S3).

[0256]

number

[0257] Specifically, all terms other than the constant term are {((v x +PDX)!) / (v x !PDX!)}-1, each coefficient A i1,···,ivx (y1,...,y vy ) is expressed as the following equation (79).

[0258]

number

[0259] The control unit 2 determines the system parameters p and v x ,v y , PDX, PDY, and Pdt are input to the polynomial generation unit 4, and the polynomial generation unit 4 is instructed to generate these polynomials. The polynomial generation unit 4 calculates the coefficients α j1,···,jvy Since the degree of (t) is Pdt, the random value generation unit 3 is instructed to generate random values ​​from 0 to p-1 only in accordance with the following formula (80).

[0260]

number

[0261] The random value generation unit 3 generates these random values ​​and inputs the generated random values ​​to the polynomial generation unit 4. The polynomial generation unit 4 uses the random values ​​to calculate the coefficient α of the coefficients other than the constant term of the indeterminate equation A. j1,···,jvy By embedding it into the coefficients of (t), coefficients other than the constant term of the indeterminate equation A are generated. The polynomial generation unit 4 inputs the generated coefficients other than the constant term to the control unit. The control unit 2 generates terms other than the constant term of the indeterminate equation A according to the following equation (81).

[0262]

number

[0263] Note that the sum of the right side of the above formula (81) starts from 1. Next, to find the constant term of the indeterminate equation A, the control unit 2 calculates the terms other than the constant term (the above formula (81)) and the private key u xi (y1,...,y vy )(i=1, ,v x ) is input to the indeterminate equation generating unit 6, and an instruction is given to generate the indeterminate equation A, which is the public key.

[0264]

number

[0265] The indeterminate equation generator 6 calculates the secret key by dividing the variables x1, . . . , x in the terms other than the constant term (the above equation (81)). vx and perform the calculation of the following equation (82) to find the constant term A 0,···,0 (y1,...,y vy ) is calculated (step S4).

[0266] constant term A 0,···,0 (y1,...,y vy The polynomial calculation required to obtain (x, y) is executed by issuing an instruction from the indeterminate equation generating unit 6 to the polynomial calculation unit 5 each time.

[0267] Next, the indeterminate equation generating unit 6 generates an indeterminate equation A according to the following equation (83) (step S5), and inputs the generated indeterminate equation A to the control unit 2 as a public key.

[0268]

number

[0269] When the control unit 2 outputs the public key (indeterminate equation A) generated in step S5 together with the private key generated in step S2 from the key output unit 7, the key generation process ends.

[0270] Next, a signature generation device that executes the signature generation process of the first embodiment will be described.

[0271] 5 is a diagram showing an example of the functional configuration of the signature generation device 20 of the first embodiment. The signature generation device 20 of the first embodiment includes a plaintext input unit 21, a hash value calculation unit 22, a hash value polynomial generation unit 23, a system parameter storage unit 24, a private key input unit 25, a signature generation unit 26, a random value generation unit 27, a polynomial operation unit 28, and a signature output unit 29.

[0272] 6 is a flowchart showing an example of processing by the signature generating device 20 according to the first embodiment. The processing flow of the signature generating device 20 according to the first embodiment will be described with reference to the example of the functional configuration shown in FIG.

[0273] The process of the signature generation device 20 of the first embodiment starts when the plaintext input unit 21 acquires plaintext M from an application or the like (step S21). The plaintext acquired in step S21 is sent from the plaintext input unit 21 to the hash value calculation unit 22.

[0274] The hash value calculation unit 22 calculates a hash value h(M) corresponding to the plaintext based on a predetermined hash function (step S22). The hash value h(M) calculated in step S22 is sent from the hash value calculation unit 22 to the hash value polynomial generation unit 23.

[0275] The hash value polynomial generation unit 23 receives p, v from the system parameter storage unit 24. y , Hdt (step S23), and the hash value h(M) calculated in step S22 is read as v y hash value polynomial h i (t)(i=1, ,v y ) (step S24).

[0276] For this reason, the hash value polynomial generation unit 23 performs p-adic expansion of the hash value h(M) to obtain v y The hash value h(M) is embedded in the coefficients of the (Hdt+1) hash value polynomial in a predetermined order. Here, the length of the hash value h(M) as a p-adic number is v y If the length is shorter than (Hdt+1), the hash value polynomial has excess coefficients. In this case, the hash value polynomial generation unit 23 embeds a predetermined p-adic pattern, such as making all coefficients zero, into the excess coefficients.

[0277] Conversely, if the length of the hash value h(M) as a p-adic number is v, y If it is longer than (Hdt+1), the hash value polynomial generation unit 23 truncates the remaining hash value.

[0278] However, to maintain a certain level of security, the length of the hash value as a p-adic number must be v y It is desirable that the system parameters be adjusted to match (Hdt+1).

[0279] Generated hash value polynomial h i (t)(i=1, ,v y ) is input to the signature generation unit 26.

[0280] Next, the private key input unit 25 receives the private key u from the key generation device 10 or the like. i (y1,...,y vy )(i=1, ,v x ) is obtained (step S25). i (y1,...,y vy )(i=1, ,v x ) is input to the signature generation unit 26, the generation of the signature is started.

[0281] The signature generation unit 26 receives the system parameters p and v from the system parameter storage unit 24. x ,v y , Hdt and NSP, and the private key u i (y1,...,y vy)(i=1, ,v x ) variables y1, ,y vy hash value polynomial h i (t)(i=1, ,v y ) to generate a signature curve of the following equation (84) (step S26).

[0282]

number

[0283] Here, the substitution operation is executed by the signature generation unit 26 instructing the polynomial operation unit 28 to perform the operation each time.

[0284] Next, the signature generation unit 26 generates NSP different random values ​​t ranging from 0 to p−1 in the random value generation unit 27. k (k=1, . . . , NSP). The random value generator 27 generates a random value t k (k=1,···,NSP) (i.e., F P Former k randomly extracted) (step S27), and input it to the signature generation unit 26.

[0285] The signature generator 26 generates NSP random values ​​t k (k=1, . . . , NSP) to generate a signature σ of the following formula (85) (step S28).

[0286]

number

[0287] When the signature generating unit 26 outputs the signature σ of the above formula (85) via the signature output unit (step S29), the signature generating process ends.

[0288] Next, the signature verification device 30 that executes the signature verification process of the first embodiment will be described.

[0289] 7 is a diagram showing an example of the functional configuration of a signature verification device 30 according to the first embodiment. The signature verification device 30 according to the first embodiment includes a public key input unit 31, a signature input unit 32, a plaintext input unit 33, a hash value calculation unit 34, a hash value polynomial generation unit 35, a system parameter storage unit 36, a signature verification unit 37, a polynomial substitution unit 38, a polynomial operation unit 39, an equation generation unit 40, an S polynomial operation unit 41, and a verification result output unit 42.

[0290] 8 is a flowchart showing an example of processing by the signature verification device 30 according to the first embodiment. The flow of signature verification processing according to the first embodiment will be described along the flowchart shown in FIG. 8 with reference to the example of the functional configuration shown in FIG.

[0291] The process of the signature verification device 30 of the first embodiment is as follows: public key A(x1, . . . , x vx ,y1,···,y vy ) is input (step S31). The input public key A is input from the public key input unit 31 to the signature verification unit 37. The signature verification unit 37 holds the input public key A in a memory.

[0292] Next, the signature σ of the following formula (86) is input to the signature input unit 32 from an application or the like (step S32).

[0293]

number

[0294] The signature σ input in step S32 is input to the signature verification unit 37. The signature verification unit 37 stores the input signature σ in a memory.

[0295] Furthermore, plaintext M is input to the plaintext input unit 33 from an application or the like (step S33). The input plaintext M is sent from the plaintext input unit 33 to the hash value calculation unit .

[0296] The hash value calculation unit 34 calculates a hash value h(M) corresponding to the plaintext M based on a predetermined hash function (step S34). The calculated hash value h(M) is sent to the hash value polynomial generation unit 35.

[0297] The hash value polynomial generation unit 35 receives p, v from the system parameter storage unit 36. y and Hdt (step S35), and the hash value h(M) is calculated by v y hash value polynomial h i (t)(i=1, ,v y ) (step S36). A detailed description of this process is omitted here because it is the same as the process of the signature generating device 20. i (t)(i=1, ,v y ) is input to the signature verification unit 37.

[0298] The signature verification unit 37 starts the signature verification process with the public key A and the signature σ stored in the memory.

[0299] The signature verification unit 37 reads the system parameters p and v from the system parameter storage unit 36. x ,v y , Hdt and NSP (step S35). The signature verification unit 37 reads the public key A and the hash value polynomial h i (t)(i=1, ,v y ) and the system parameters p,v x and v y and the variables y1, . . . , y vy hash value polynomial h i (t)(i=1, ,v y ) is assigned.

[0300] The polynomial substitution unit 38 instructs the polynomial operation unit 39 to perform a polynomial operation, and then calculates the indeterminate equation A H (x1,...,x vx )=A(x1, ,x vx ,h1(t),···,h vy(t)) is derived (step S37). The polynomial substitution unit 38 substitutes the derived indeterminate equation A H (x1,...,x vx ) is input to the signature verification unit 37.

[0301] The signature verification unit 37 calculates the indeterminate equation A H (x1,...,x vx ) is input to the equation generating unit 40 to instruct the generation of an equation for determining the signature curve.

[0302] The equation generation unit 40 generates simultaneous equations F for finding the signature curve based on the method shown in signature verification step 4 of the above-mentioned signature verification algorithm (step S38). The equation generation unit 40 inputs the simultaneous equations F to the signature verification unit 37.

[0303] The signature verification unit 37 stores the simultaneous equations F in a memory, and also verifies the signature points of the following equation (87) included in the signature and the indeterminate equation A H (x1,...,x vx ) is input to the equation generating unit 40, and an instruction is given to generate simultaneous linear equations G for determining the signature curve, assuming that this signature point exists on the signature curve which is the private key.

[0304]

number

[0305] The equation generation unit 40 generates simultaneous equations G for finding the signature curve from the signature points based on the method shown in signature verification step 5 of the above-mentioned signature verification algorithm (step S39). The equation generation unit 40 inputs the simultaneous equations G to the signature verification unit 37.

[0306] Signature verification unit 37 inputs a polynomial set obtained by merging the set of polynomials that make up simultaneous equations F and the set of polynomials that make up simultaneous equations G to an S polynomial calculation unit, and instructs the unit to calculate S polynomials up to degree 1. Details of the method for calculating S polynomials are well known, so a detailed explanation will be omitted.

[0307] The S polynomial calculation unit 41 calculates an S polynomial set up to degree 1 from the input polynomial set (step S40). The S polynomial calculation unit 41 inputs the S polynomial set to the signature verification unit 37.

[0308] The signature verification unit 37 accepts the signature σ if the S polynomial set is not an empty set (step S42), and rejects the signature σ if the S polynomial set is an empty set (step S43). The signature verification unit 37 inputs the verification result (acceptance or rejection) to the verification result output unit 42. When the verification result output unit 42 outputs the verification result, the signature verification process ends.

[0309] As described above, in the signature generation device 20 of the first embodiment, the private key input unit 25 inputs a finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. p The one-variable polynomial ring F defined above p The input of the private key is an m-variable polynomial over [t], where the variables of the private key are the m independent variables, and the private key is a 1-variable polynomial ring F p The plaintext input unit 21 receives input of plaintext M to be signed. The hash value calculation unit 22 calculates a hash value h(M) of plaintext M. The hash value polynomial generation unit 23 generates m hash value polynomials h(M) from the hash value h(M). i (t) (i=1, , m). p The signature generation unit 26 generates random values ​​without overlapping. ... i (t) (i = 1, , m) to generate a signature curve σ(t), and generate m hash value polynomials h i A set of signature points on the signature curve σ(t) obtained by substituting a random value for the variable t in (t) (i=1, , m) is generated as a signature. Then, the signature output unit 29 outputs the signature.

[0310] In the signature verification device 30 of the first embodiment, the public key input unit 31 receives a finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. p The one-variable polynomial ring F defined above p The input of a public key, which is an n+m variable polynomial on [t], is accepted. The signature input unit 32 accepts the input of a signature. The plaintext input unit 33 accepts the input of a signed plaintext M. The hash value calculation unit 34 calculates a hash value h(M) of the plaintext M. The hash value polynomial generation unit 35 generates m hash value polynomials h(M) from the hash value h(M). i (t) (i=1, , m). The polynomial substitution unit 38 substitutes m hash value polynomials h i (t)(i=1, ,m) to obtain the indeterminate equation A H The equation generator 40 generates the indeterminate equation A H From the equation A, H Then, a simultaneous equation F is generated to derive a signature curve σ(t) that is a zero point of the above equation, and a simultaneous equation G is generated that is established by assuming that the signature points that make up the signature exist on the signature curve σ(t). An S polynomial calculation unit 41 finds a set of first-order S polynomials that make up the simultaneous equations F and G. Then, a signature verification unit 37 rejects the signature if the set of S polynomials is an empty set, and accepts the signature if the set of S polynomials is not an empty set.

[0311] According to the first embodiment, it is possible to configure a digital signature scheme that can ensure security even when quantum computers appear and that can shorten the key length.

[0312] In the following, examples of specific functional configurations of variations of this embodiment will be described. First, in the signature verification of the above-mentioned Modification 1, in the variation of checking the overlap of signature points, immediately after the signature σ is input to the signature verification unit 37 in the signature verification device 30, the signature verification unit 37 checks the vth signature point among the NSP signature points. xA step is added in which +1 components are extracted and overlaps are detected by a method such as sorting. At this time, if the signature verification unit 37 detects overlaps, it outputs a denial via the verification result output unit 42, and if no overlaps are detected, it executes the remaining signature verification steps of the first embodiment.

[0313] Next, in the signature verification of the above-mentioned Modification 2, in a variation for confirming the validity of the signature point, in the signature verification device 30, the signature σ is input to the signature verification unit 37, and the indeterminate equation A H (x1,...,x vx Immediately after deriving )=0, we define the NSP signature points as indeterminate equations A H (x1,...,x vx ) and add a step to confirm that it is 0.

[0314] At this time, the signature verification unit 37 calculates the indeterminate equation A H (x1,...,x vx If there is a signature point that does not become 0 when the signature point is substituted into the indeterminate equation A, the denial is output via the verification result output unit 42. The signature verification unit 37 calculates all the signature points by substituting the indeterminate equation A. H (x1,...,x vx ) and there is no point that does not become 0, the remaining signature verification steps of the first embodiment are performed.

[0315] Next, in the signature verification of the above-described variant example 3, in a variation of the Groebner basis calculation performed in the signature verification, a polynomial set is input to the S polynomial calculation unit 41 in the signature verification device 30, and the Groebner basis calculation is performed. However, this can be realized by stopping at a predetermined step, such as limiting the degree of the S polynomial to be calculated to a predetermined degree rather than limiting it to 1, or limiting it to only the reduction process for the S polynomial calculation.

[0316] Next, in the signature verification of the above-mentioned variant 4, in a variation of the decision to accept or reject a signature performed in signature verification, in the signature verification device 30, after the signature verification unit 37 stores the simultaneous equations F in memory (step 38), a process is added in which NSP signature points are extracted from the signature point set obtained as the signature in accordance with a predetermined rule (step 38-1), and for the extracted signature point set, the signature point of the above-mentioned equation (87) included in the signature point set and the indeterminate equation AH(x1, . . . , xvx) are input to the equation generation unit 40, and assuming that this signature point exists on the signature curve which is the private key, an instruction is given to generate a simultaneous linear equation G to find the signature curve.

[0317] Furthermore, the S polynomial set is input from the S polynomial operation unit 41 to the signature verification unit 37, and if the S polynomial set is not an empty set, the signature verification unit 37 changes the step of accepting the signature σ (step S42) so that it will only be accepted when a predetermined number of acceptances has been reached. Here, if the actual number of acceptances has not reached the predetermined number, the process is realized by returning to the process of extracting a signature point set from the signature (step 38-1) and continuing the process.

[0318] If the S polynomial set is an empty set, the signature σ is rejected regardless of the number of verifications (step S43). In the fourth modification, the number of signature points included in the signature must be larger than usual, which requires corresponding changes to the signature generation device and signature generation algorithm. However, this can be handled by changing parameters, so we will not go into detail here.

[0319] This concludes the description of the key generation device 10, the signature generation device 20, and the signature verification device 30 in the first embodiment and the first to fourth modifications.

[0320] (Second embodiment) Next, a second embodiment will be described. In the description of the second embodiment, the same description as in the first embodiment will be omitted, and only differences from the first embodiment will be described. Specific algorithms of the second embodiment will be described in the order of a key generation algorithm, a signature generation algorithm, and a signature verification algorithm.

[0321] The second embodiment eliminates the constraints on the number of signatures that were imposed by coefficient comparison attacks in the first embodiment by increasing the number of private keys from one to two and randomly selecting one of them when generating a signature.

[0322] On the other hand, in the second embodiment, the number of dependent variables v x is limited to 2, and there are some changes to the key generation algorithm.

[0323] The second embodiment will be described below, focusing on the differences from the first embodiment. First, the system parameters are v x There are no other changes other than being fixed at 2.

[0324] [Key generation algorithm] In the key generation algorithm, two sets of private keys (following formula (88)) shown in the above formula (27) are prepared.

[0325]

number

[0326] Let us consider the indeterminate equation A(x1, x2, y1, , y vx ), where v x Note that =2. Let us consider these two sets of private keys as (u (0) 1,u (0) 2),(u (1) 1,u (1) 2), both are solutions to indeterminate equations, so the following equation (89) holds.

[0327]

number

[0328] where u (0) 1,u (0) 2,u (1) 1,u (1) 2 is F p [t][y1, ,y vy ], the following equation (90) holds.

[0329]

number

[0330] In this case, the constant term on the left side of the above equation (90) is cancelled, and the following equation (91) holds (note that the range of the sum is 1≦i1+i2≦PDX).

[0331]

number

[0332] Here, if we use the following equation (92), then from the following equation (93), the coefficient A of the first-order term x1 1,0 (y1,...,y vy ) can be calculated as a polynomial by using the following equation (94).

[0333]

number

[0334]

number

[0335]

number

[0336] This A 1,0 (y1,...,y vy ) to obtain the constant term A0,0 (y1,...,y vy ) according to the above equation (31), an indeterminate equation with two solutions is completed.

[0337] [Signature generation algorithm] The signature generation algorithm of the second embodiment differs from the first embodiment in that, since there are two private keys, one of them is randomly selected before generating a signature, and the signature is created with the selected private key. That is, the signature generation algorithm consists of the following signature generation steps 1 to 5.

[0338] 1. A hash value H(M) of the plaintext M is calculated. 2. The hash value H(M) is v y hash value polynomial h i (t)(i=1, ,v y ) coefficients. 3. b is chosen uniformly at random from {0,1}. 4. Hash value polynomial (h1(t), ,h vy (t)) is the private key (u (b) 1(y1, ,y vy ),u (b) 2(y1, ,y vy )) independent variables y1, ,y vy and the signature curve σ(t) is calculated by the following equation (95).

[0339]

number

[0340] 5.F p Former k (k=1,...,NSP) are randomly extracted so that they do not overlap, and the following set of points generated from these is used as the signature: σ={(σ1(t i ),σ2(t i ),t i ):i=1,···,NSP}

[0341] The signature verification algorithm of the second embodiment is v x = 2.

[0342] Furthermore, the variations of the first embodiment (the above-described variations 1 and 2) are also valid in the second embodiment, and the same effects are achieved. Since these variations are all independent, both can be used together.

[0343] [Safety Considerations] The security of the second embodiment will be examined. Three attacks (coefficient comparison attack, key recovery attack, and signature curve derivation attack) can also be applied to the second embodiment.

[0344] Of these, with regard to coefficient comparison attacks, as in the first embodiment, if there are L signatures, L·NSP equations can be obtained. Since a linear simultaneous equation can be uniquely solved in polynomial time if the rank of the matrix derived from the linear simultaneous equation matches the number of variables, if the number of equations exceeds the number of variables, there is a possibility that a unique solution can be found in polynomial time. In other words, if it is possible to obtain signatures of the following equations (96) or more generated from the same private key, there is a possibility that the private key can be restored.

[0345]

number

[0346] On the other hand, in the second embodiment, there are two private keys, so if it is not possible to identify which of these keys generated the obtained signature, the probability of collecting L signatures generated from the same private key is 2. -L That is, the following formula (97) ensures resistance to coefficient comparison attacks regardless of the number of signatures.

[0347]

number

[0348] Here, λ is a security parameter and is usually set to λ = 128, 192, or 256. This is the effect of the second embodiment.

[0349] The key recovery attack in the second embodiment is similar to that in the first embodiment, but x is fixed to 2. As a result, the number of equations in the simultaneous equations for deriving the private key remains the same, but the number of variables becomes equation (98) below, so the difference between the number of equations and the number of variables becomes larger compared to the first embodiment.

[0350]

number

[0351] For this reason, the second embodiment is inferior to the first embodiment in that simultaneous equations tend to be easier to solve.

[0352] The signature curve derivation attack in the second embodiment is the same as that in the first embodiment. Therefore, it is clear that the amount of calculation increases exponentially in any of the existing attacks, and the digital signature in the second embodiment has sufficient security.

[0353] [Specific configuration] Next, specific configurations and algorithms of the key generation device 10, signature generation device 20, and signature verification device 30 in the digital signature of the second embodiment will be described. The following will mainly explain the differences between the second embodiment and the first embodiment.

[0354] 9A and 9B are flowcharts showing an example of processing by the key generation device 10 of the second embodiment. The flow of processing by the key generation device 10 of the second embodiment will be described with reference to the flowcharts shown in FIGS. 9A and 9B.

[0355] The process of the key generating device 10 of the second embodiment is as follows: Parameters p and v y, PDX, PDY, Pdt, SDY, and Sdt are input (step S51).

[0356] The system parameter input unit 1 sends the system parameters input in step S51 to the control unit 2. The control unit 2 performs the following processes in cooperation with other processing units based on the input system parameters.

[0357] First, the control unit 2 instructs the random value generation unit 3 to output a random integer value in the range from 0 to SDY for SDY, one of the input parameters. The random value generation unit 3 inputs an integer value SDY1 in that range to the control unit 2.

[0358] The control unit 2 calculates SDY2=SDY-SDY1. If SDY1>SDY2, the control unit 2 exchanges these values ​​and sets them so that SDY1≦SDY2. Next, the control unit 2 performs the same process as SDY on the input parameter Sdt, and generates integers Sdt1 and Sdt2 such that 0≦Sdt1≦Sdt2≦Sdt (step S52).

[0359] The control unit 2 calculates the parameters p and v y , SDY1 and Sdt1 are input to the polynomial generator 4, and F p [t][y1, ,y vy ], the polynomials in which the variable y i (i=1,...,v y ) with a total degree of SDY1 and coefficient degree of Sdt1. vy ) to the polynomial generator 4.

[0360] The polynomial generator 4 outputs to the random value generator 3 (Sdt1+1){((v y +SDY1)!) / (v y !SDY1!)} integers between 0 and p-1 are generated.

[0361] The random value generator 3 uses a pseudo-random number generator or the like to generate (Sdt1+1){((v y+SDY1)!) / (v y !SDY1!)} random numbers between 0 and p-1. The random value generator 3 generates (Sdt1+1){((v y +SDY1)!) / (v y !SDY1!)} random numbers from 0 to p-1 are input to the polynomial generator 4.

[0362] The polynomial generator 4 generates (Sdt1+1){((v y +SDY1)!) / (v y !SDY1!)} random numbers are calculated using the polynomial δ1(y1, ,y vy ) the coefficients of the univariate polynomial ring F p By embedding it as an element coefficient of [t], the polynomial δ1(y1, ,y vy ) is randomly generated (step S53). vy ) is input to the control unit 2. The control unit 2 calculates the polynomial δ1(y1, ,y vy ) in memory.

[0363] Similarly, the control unit 2 determines the parameters p and v y , SDY2-SDY1 and Sdt2-Sdt1 are also input to the polynomial generator 4, and F p [t][y1, ,y vy ], the polynomials in which the variable y i (i=1,...,v y ) is a polynomial δ(y1, ,y vy ) to the polynomial generator 4.

[0364] The polynomial generator 4 generates a polynomial δ(y1,...,y vy ) and generate δ(y1, ,y vy ) is input to the control unit 2. The control unit 2 calculates the polynomial δ(y1, ,y vy ) in memory.

[0365] Next, the control unit 2 inputs the polynomial calculation unit 5 to the polynomial δ(y1, ,y vy) and the polynomial δ1(y1, ,y vy ) to give the polynomial calculation unit 5 a multiplication instruction.

[0366] The polynomial calculation unit 5 performs multiplication according to the following equation (99) in accordance with an instruction from the control unit 2 (step S55).

[0367]

number

[0368] The control unit 2 calculates δ2(y1, . . . , y vy ) stored in memory.

[0369] Next, the control unit 2 calculates p, v from the parameters input in step S51. y , SDY and Sdt are input to the polynomial generator 4, and F p [t][y1, ,y vy ], the polynomials in which the variable y i (i=1,...,v y The polynomial generator 4 is instructed to generate the following two polynomials, each of which has a total degree of SDY and a coefficient degree of Sdt.

[0370]

number

[0371] The polynomial generator 4 outputs 2·(Sdt+1){((v y +SDY)!) / (v y !SDY!)} integers between 0 and p-1 are generated.

[0372] The random value generator 4 generates 2·(Sdt+1){((v y +SDY)!) / (v y !SDY!)} random numbers from 0 to p-1 are generated, and the generated random numbers are input to the polynomial generator 4.

[0373] The polynomial generator 4 generates the input 2·(Sdt+1){((v y +SDY)!) / (v y !SDY!)} random numbers are calculated using polynomial u i Coefficient β included in (i=1,2) i,j1,···,jvy (t) as the coefficients of the polynomial u (0) i (i=1, 2). The polynomial generator 4 generates the polynomial u (0) i (i=1,2) is input to the control unit 2.

[0374] The control unit 2 calculates the polynomial u (0) i (i=1, 2) is stored in the memory as the first private key (step S56).

[0375] Next, the control unit 2 reads the first private key from the memory and the polynomial δ to generate the second private key of the following formula (101). i (y1,...,y vy ) (i=1,2) is read out.

[0376]

number

[0377] The control unit 2 calculates the first secret key and the polynomial δ i (y1,...,y vy ) (i=1, 2) into the polynomial calculation unit 5, and instructs the addition according to the above formula (101). The polynomial calculation unit 5 calculates the polynomial u obtained by calculating the above formula (101). (1) i (i=1,2) is input to the control unit 2.

[0378] The control unit 2 calculates the polynomial u (1) i (i=1, 2) is stored in the memory as the second private key (step S57).

[0379] Next, the control unit 2 generates the indeterminate equation A of the following (102), which is the public key, by 0,0 (y1,...,y vy ) and the first-order term A 1,0 (y1,...,y vy )x1 to generate coefficients other than

[0380]

number

[0381] Here, the total number of terms to be generated is {(v x +PDX)! / (v x !PDX!)}-There are two, and each coefficient A i1,i2 (y1,...,y vy ) is expressed by the following formula (103).

[0382]

number

[0383] The control unit 2 determines the system parameters p and v y , PDX, PDY, and Pdt are input to the polynomial generation unit 4, and the polynomial generation unit 4 is instructed to generate these polynomials. The polynomial generation unit 4 calculates the coefficients α j1,···,jvy Since the degree of (t) is Pdt, the random value generation unit 3 is instructed to generate random values ​​from 0 to p-1, the number of which is shown in the following equation (104).

[0384]

number

[0385] The random value generation unit 3 generates random values ​​from 0 to p−1 in the number indicated by the above equation (104), and inputs the random values ​​to the polynomial generation unit 4.

[0386] The polynomial generator 4 uses this random value as the constant term of the indeterminate equation A and the linear term A 1,0(y1,...,y vy )x1 other coefficient A i1,i2 (y1,...,y vy ) coefficient α j1,···,jvy By embedding it in the coefficient of (t), the constant term of the indeterminate equation A and the linear term A 1,0 (y1,...,y vy The polynomial generator 4 generates coefficients other than the constant term and the linear term A of the indeterminate equation A (step S58). 1,0 (y1,...,y vy ) and coefficients other than x1 are input to the control unit 2.

[0387] The control unit 2 calculates the constant term of the indeterminate equation A and the linear term A according to the following equation (105): 1,0 (y1,...,y vy )x1 and other terms.

[0388]

number

[0389] Note that the sum on the right side of equation 105 above starts from 1.

[0390] Next, the control unit 2 calculates the indeterminate equation A by using the constant term and the linear term A 1,0 (y1,...,y vy ) x1 other than term A ~ and the private key u i (y1,...,y vy ) (i=1, 2) is input to the indeterminate equation generating unit 6, and an instruction to generate the indeterminate equation A, which is the public key, is issued to the indeterminate equation generating unit 6.

[0391] The indeterminate equation generating unit 6 first calculates the coefficient of the first-order term according to the above-mentioned equation (94) (step S59). The polynomial calculation required at this time is executed each time an instruction is issued from the indeterminate equation generating unit 6 to the polynomial calculation unit 5. Here, from the above-mentioned method of creating a private key, the following holds. (u (0) 1-u (1) 1)|(u (0) 2-u(1) 2)

[0392] As a result, the condition of the above equation (92) is satisfied, and the result of the above equation (94) becomes a polynomial.

[0393] The indeterminate equation generator 6 generates a constant term A 0,0 is calculated using the following equation (106) (step S60).

[0394]

number

[0395] The polynomial calculation required for calculating the above equation (106) is executed by issuing an instruction from the indeterminate equation generating unit 6 to the polynomial calculation unit 5 each time.

[0396] Next, the indeterminate equation generating unit 6 generates the indeterminate equation A according to the following equation (107) (step S61), and inputs the indeterminate equation A to the control unit 2 as a public key.

[0397]

number

[0398] When the control unit 2 outputs the public key together with the private key held in the memory via the key output unit 7 (step S62), the key generation process ends.

[0399] Next, the processing flow of the signature generating device 20 that executes the signature generating process of the second embodiment will be described with reference to the flowchart shown in FIG. 10, focusing on the differences from the first embodiment.

[0400] 10 is a flowchart showing an example of processing by the signature generating device 20 of the second embodiment. In the signature generating device 20 of the second embodiment, as in the first embodiment, a plaintext M is input from the plaintext input unit 21, and a private key u is input from the private key input unit 25. i (y1,...,y vy) (i=1, 2) is input (steps S71 and S75).

[0401] The differences from the first embodiment are the following (1) to (3). (1) Among the system parameters stored in the system parameter storage unit 24, v x is fixed at 2. (2) Two sets of private keys are input from the private key input unit 25. (3) When the signature generation unit 26 generates a signature, the input private key u (b) i (y1,...,y vy ) (i=1,2,b=0,1), b is randomly selected, and the selected private key variables y1, ,y vy hash value polynomial h i (t)(i=1, ,v y ) is substituted, and the following signature curve (108) is generated.

[0402]

number

[0403] The differences from the first embodiment are as described above in (1) to (3), and other matters are the same as those in the first embodiment, so detailed explanation of steps S71 to S80 in FIG. 10 will be omitted.

[0404] 11 is a flowchart showing an example of processing performed by the signature verification device 30 of the second embodiment. The processing performed by the signature verification device 30 of the second embodiment is performed by using v x is fixed to 2, but other matters are the same as in the first embodiment, so detailed description of steps S91 to S103 in FIG. 11 will be omitted.

[0405] As described above, in the signature generation device 20 of the second embodiment, the number of dependent variables n is 2. The public key is a one-variable polynomial ring F pThere are two sets of private keys, each set including two m-variable polynomials on one-variable polynomial rings Fp[t] that are zeros of the public key. The private key input unit 25 accepts input of two sets of private keys. The signature generation unit 26 randomly selects one of the two sets of private keys, and generates m hash value polynomials h for the independent variables of the two m-variable polynomials included in the selected private key. i (t) (i=1, ,m) and create m hash value polynomials h i (t) A set of signature points obtained by substituting a random value for the variable t (i = 1, , m) is generated as a signature.

[0406] In the signature verification device 30 of the second embodiment, the number of dependent variables n is 2, as in the signature generation device 20. The public key is a one-variable polynomial ring F p There are two sets of private keys, each set including an m-variable polynomial on two 1-variable polynomial rings Fp[t] that are zeros of the public key. The polynomial substitution unit 38 substitutes m hash value polynomials h i (t)(i=1, ,m) to obtain the indeterminate equation A H Generate.

[0407] Moreover, the variations of the second embodiment are similar to the variations of the first embodiment (Modifications 1 to 4).

[0408] Finally, examples of the hardware configurations of the key generation device 10, the signature generation device 20, and the signature verification device 30 according to the first and second embodiments will be described.

[0409] [Example of hardware configuration] FIG. 12 is a diagram showing an example of the hardware configuration of the key generation device 10, the signature generation device 20, and the signature verification device 30 according to the first and second embodiments.

[0410] The key generation device 10, the signature generation device 20, and the signature verification device 30 of the first and second embodiments each include a control device 301, a main memory device 302, an auxiliary memory device 303, a display device 304, an input device 305, and a communication device 306. The control device 301, the main memory device 302, the auxiliary memory device 303, the display device 304, the input device 305, and the communication device 306 are connected via a bus 310.

[0411] The control device 301 executes a program read from the auxiliary storage device 303 to the main storage device 302. The main storage device 302 is memory such as a read-only memory (ROM) and a random access memory (RAM). The auxiliary storage device 303 is a hard disk drive (HDD), a solid state drive (SSD), a memory card, or the like.

[0412] The display device 304 displays display information. The display device 304 is, for example, a liquid crystal display. The input device 305 is an interface for operating the computer. The input device 305 is, for example, a keyboard or a mouse. If the computer is a smart device such as a smartphone or tablet terminal, the display device 304 and the input device 305 are, for example, a touch panel. The communication device 306 is an interface for communicating with other devices.

[0413] Programs that are executed by a computer are provided as computer program products, recorded in the form of installable or executable files on computer-readable storage media such as CD-ROMs, memory cards, CD-Rs, and DVDs (Digital Versatile Discs).

[0414] The program to be executed by the computer may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network, or the program to be executed by the computer may be provided via a network such as the Internet without being downloaded.

[0415] The program executed by the computer may be provided in advance in a ROM or the like.

[0416] The program executed by the computer has a modular configuration including functional blocks that can also be realized by the program, among the functional configurations (functional blocks) of the key generation device 10, the signature generation device 20, and the signature verification device 30. As for each functional block, as actual hardware, the control device 301 reads out the program from a storage medium and executes it, and the above-mentioned functional block is loaded onto the main memory device 302. In other words, the above-mentioned functional block is generated on the main memory device 302.

[0417] Note that some or all of the above-described functional blocks may be realized by hardware such as an integrated circuit (IC) instead of by software.

[0418] Furthermore, when each function is realized using a plurality of processors, each processor may realize one of the functions, or may realize two or more of the functions.

[0419] Furthermore, the computer that realizes the key generation device 10, the signature generation device 20, and the signature verification device 30 may operate in any manner. For example, the key generation device 10 (signature generation device 20 and signature verification device 30) of the first and second embodiments may be realized by a single computer. Furthermore, for example, the key generation device 10, the signature generation device 20, and the signature verification device 30 of the first and second embodiments may be operated as a cloud system on a network.

[0420] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0421] 1 System parameter input section 2. Control section 3 Random value generator 4 Polynomial generator 5 Polynomial operation section 6 Indeterminate equation generator 7 Key output unit 10 Key generator 20 Signature generator 21 Plaintext input section 22 Hash value calculation unit 23 Hash value polynomial generator 24 System parameter storage section 25 Private key input section 26 Signature generation section 27 Random value generator 28 Polynomial operation section 29 Signature output unit 30 Signature Verification Device 31 Public key input section 32 Signature input section 33 Plaintext input section 34 Hash value calculation unit 35 Hash value polynomial generator 36 System parameter storage section 37 Signature Verification Unit 38 Polynomial assignment part 39 Polynomial operation section 40 Equation generator 41 S polynomial operation section 42 Verification result output section 301 Control device 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input Device 306 Communication Equipment 310 Bus

Claims

1. A finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ a private key input unit that accepts input of a private key that is an n-variable polynomial on [t], where the variables of the private key are the m independent variables, and the private key is a one-variable polynomial ring F ｐ is a zero point of the public key, which is an n+m variable polynomial on [t], a plaintext input unit that accepts input of plaintext M to be signed; a hash value calculation unit that calculates a hash value h(M) of the plaintext M; From the hash value h(M), m hash value polynomials h ｉ (t) A hash value polynomial generator that generates a hash value polynomial (i=1, . . . , m); The finite field F ｐ a random value generator that generates random values ​​without overlapping; The m hash value polynomials h are used as independent variables of the n m-variable polynomials that constitute the private key. ｉ (t) (i=1, . . . , m) to generate a signature curve σ(t), and ｉ a signature generation unit that generates a set of signature points on the signature curve σ(t) obtained by substituting the random value for a variable t in (t) (i=1, . . . , m), as a signature; a signature output unit that outputs the signature; A signature generation device comprising:

2. the number of dependent variables, n, is 2; The public key is a one-variable polynomial ring F ｐ is a polynomial of m+2 variables over [t], There are two sets of private keys, each set including two m-variable polynomials in the 1-variable polynomial ring Fp[t] that are zeros of the public key; the private key input unit accepts input of the two pairs of private keys; The signature generation unit randomly selects one of the two sets of private keys, and applies the m hash value polynomials h to the independent variables of two m-variable polynomials included in the selected private key. ｉ (t) (i=1, . . . , m) and ｉ (t) A set of signature points obtained by substituting the random value into a variable t (i=1, ..., m) is generated as the signature. The signature generating device according to claim 1 .

3. A finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ a public key input unit that accepts input of a public key that is an n+m variable polynomial on [t]; a signature input unit that accepts input of a signature; a plaintext input unit that accepts input of a signed plaintext M; a hash value calculation unit that calculates a hash value h(M) of the plaintext M; From the hash value h(M), m hash value polynomials h ｉ (t) A hash value polynomial generator that generates a hash value polynomial (i=1, . . . , m); The m hash value polynomials h are used as the independent variables of the n+m variable polynomial that constitutes the public key. ｉ (t) (i = 1, ..., m) to obtain the indeterminate equation A Ｈ a polynomial substitution unit that generates The indeterminate equation A Ｈ From the above, the indeterminate equation A Ｈ an equation generating unit that generates a simultaneous equation F that derives a signature curve σ(t) that is a zero point of the above equation, and generates a simultaneous equation G that is established by assuming that the signature points that constitute the signature exist on the signature curve σ(t); an S polynomial calculation unit that performs Groebner basis calculations of the polynomials that make up the simultaneous equations F and G up to a predetermined step to obtain a reduced polynomial set; a signature verification unit that rejects the signature if the polynomial set is an empty set and accepts the signature if the polynomial set is not an empty set; A signature verification device comprising:

4. The private key corresponding to the public key is a zero point of the public key, and the private key is a zero point of the one-variable polynomial ring F ｐ [t] is an m-variable polynomial with n elements over [t], and the variables of the private key are the m independent variables; The signature is a set of signature points on the signature curve σ(t). The signature verification device according to claim 3.

5. the number of dependent variables, n, is 2; The public key is a one-variable polynomial ring F ｐ is a polynomial of m+2 variables over [t], There are two sets of private keys, each set including two m-variable polynomials in the 1-variable polynomial ring Fp[t] that are zeros of the public key; The polynomial substitution unit substitutes the m hash value polynomials h into the independent variables of the m+2 variable polynomial that constitutes the public key. ｉ (t) (i=1,...,m) to obtain the indeterminate equation A Ｈ Generate 5. The signature verification device according to claim 4.

6. A signature generating device generates a finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ receiving an input of a private key that is an n-variable polynomial over [t], where the variables of the private key are the m independent variables, and the private key is a polynomial ring F ｐ is a zero point of the public key, which is an n+m variable polynomial on [t], a step of said signature generating device accepting input of plaintext M to be signed; the signature generation device calculating a hash value h(M) of the plaintext M; The signature generating device generates m hash value polynomials h(M) from the hash value h(M). ｉ (t) (i=1,...,m); The signature generation device generates the signature using the finite field F ｐ randomly generating random values ​​of The signature generation device generates the m hash value polynomials h for the independent variables of the n m-variable polynomials that constitute the private key. ｉ (t) (i=1, . . . , m) to generate a signature curve σ(t), and ｉ generating a set of signature points on the signature curve σ(t) obtained by substituting the random value for a variable t in (t) (i=1, ..., m) as a signature; the signature generating device outputting the signature; A signature generation method comprising:

7. A signature verification device is configured to verify a finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ A step of accepting an input of a public key that is an n+m variable polynomial on [t]; a step of the signature verification device accepting an input of a signature; a step of the signature verification device accepting input of a signed plaintext M; a step of the signature verification device calculating a hash value h(M) of the plaintext M; The signature verification device generates m hash value polynomials h(M) from the hash value h(M). ｉ (t) (i=1,...,m); The signature verification device generates the m hash value polynomials h for the independent variables of the n+m variable polynomial that constitutes the public key. ｉ (t) (i = 1, ..., m) to obtain the indeterminate equation A Ｈ generating a The signature verification device Ｈ From the above, the indeterminate equation A Ｈ and generating a simultaneous equation G that is established by assuming that the signature points constituting the signature exist on the signature curve σ(t); a step in which the signature verification device performs Groebner basis calculation of polynomials constituting the simultaneous equations F and G up to a predetermined step to obtain a reduced polynomial set; the signature verification device rejecting the signature if the polynomial set is an empty set, and accepting the signature if the polynomial set is not an empty set; A signature verification method including:

8. Computer, A finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ a private key input unit that accepts input of a private key that is an n-variable polynomial on [t], where the variables of the private key are the m independent variables, and the private key is a one-variable polynomial ring F ｐ is a zero point of the public key, which is an n+m variable polynomial on [t], a plaintext input unit that accepts input of plaintext M to be signed; a hash value calculation unit that calculates a hash value h(M) of the plaintext M; From the hash value h(M), m hash value polynomials h ｉ (t) A hash value polynomial generator that generates a hash value polynomial (i=1, . . . , m); The finite field F ｐ a random value generator that generates random values ​​without overlapping; The m hash value polynomials h are used as independent variables of the n m-variable polynomials that constitute the private key. ｉ (t) (i=1, . . . , m) to generate a signature curve σ(t), and ｉ a signature generation unit that generates a set of signature points on the signature curve σ(t) obtained by substituting the random value for a variable t in (t) (i=1, . . . , m), as a signature; a signature output unit that outputs the signature; A signature generation program to act as a

9. Computer, A finite field F having m (m≧1) independent variables and n (n≧2) dependent variables. ｐ The one-variable polynomial ring F defined above ｐ a public key input unit that accepts input of a public key that is an n+m variable polynomial on [t]; a signature input unit that accepts input of a signature; a plaintext input unit that accepts input of a signed plaintext M; a hash value calculation unit that calculates a hash value h(M) of the plaintext M; From the hash value h(M), m hash value polynomials h ｉ (t) A hash value polynomial generator that generates a hash value polynomial (i=1, . . . , m); The m hash value polynomials h are used as the independent variables of the n+m variable polynomial that constitutes the public key. ｉ (t) (i = 1, ..., m) to obtain the indeterminate equation A Ｈ a polynomial substitution unit that generates The indeterminate equation A Ｈ From the above, the indeterminate equation A Ｈ an equation generating unit that generates a simultaneous equation F that derives a signature curve σ(t) that is a zero point of the above equation, and generates a simultaneous equation G that is established by assuming that the signature points that constitute the signature exist on the signature curve σ(t); an S polynomial calculation unit that performs Groebner basis calculations of the polynomials that make up the simultaneous equations F and G up to a predetermined step to obtain a reduced polynomial set; a signature verification unit that rejects the signature if the polynomial set is an empty set and accepts the signature if the polynomial set is not an empty set; A signature verification program to function as a

Images