Digital signature systems, methods, and recording media

Abstract

This system implements biometric distributed signatures, where signatures are generated using a signing key and other confidential information. [Solution] In the digital signature system 100, the first signature generation device 110 acquires and stores a first auxiliary key c generated using the first secret information s'1 and the first biometric information w, auxiliary data c1 generated using the second secret information s'2 and the first biometric information w, and the third secret information, generates a second distributed key x', and uses the second distributed key and the third secret information to send and receive information with the second signature generation device 120 to generate a second distributed signature for the message to be signed. The third signature generation device 130 acquires the second biometric information w', acquires the auxiliary data, uses the second biometric information and the auxiliary data to restore the second secret information, generates a first distributed key Δ, and uses the first distributed key and the second secret information to send and receive information with the first signature generation device to generate a first distributed signature for the message.

Description

[Technical Field]

[0001] This disclosure relates to a digital signature system, method, and recording medium. [Background technology]

[0002] Digital signatures are a technology that allows verification of the creator of a document and confirms that the document has not been tampered with after its creation.

[0003] Key generation: Generates a pair of signing keys (private keys) sk and verification keys (public keys) vk. (sk, vk)←KeyGen(1 κ ) …(1) κ is a security parameter.

[0004] In some cases, instead of the key generation algorithm directly receiving security parameters, it may receive common (public) parameters generated from the security parameters in the setup algorithm, and then generate a pair of signing keys (private keys) sk and verification keys (public keys) vk.

[0005] Signature: Generate a signature σ for message (document) M using the signature key sk. That is, generate a signature σ using the signature key (private key) sk on the message m to be signed, or the hash value obtained by inputting message m into a hash function. σ←Sign(sk, m) …(2)

[0006] Verification: The validity of the message (document) M and signature σ pair is verified using the verification key vk. 0 / 1←Verify(vk, M, σ) …(3) 1) Is the signature generated using the verification key and the corresponding signing key? 2) Is the signature generated for that document? These two points are examined together. Here, 1 is used for acceptance and 0 for rejection.

[0007] A fuzzy signature, which uses biometric information as the signing key for digital signatures, has been proposed.

[0008] Key generation: Generates a verification key from biometric information.

[0009] Signature: Generates a signature for a document using biometric information.

[0010] Verification: The validity of the message and signature pair is verified using a verification key.

[0011] In fuzzy signatures, a distributed signature scheme is used in which one of the distributed keys is replaced with biometric information (Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0012] [Non-Patent Document 1] Haruna Higo, Toshiyuki Isshiki, Saki Otsuki, Kenji Yasunaga, "Fuzzy Signature with Biometric-Independent Verification", 2023 International Conference of the Biometrics Special Interest Group (BIOSIG), IEEE, 20-22 September 2023 [Overview of the project] [Problems that the invention aims to solve]

[0013] To date, biometric distributed signature schemes have not been implemented for digital signature algorithms such as EdDSA (Edwards-curve Digital Signature Algorithm), which is included in the list of recommended cryptographic algorithms for e-government, where signatures are generated using not only the signing key but also other secret information.

[0014] One of the purposes of this disclosure is to provide a system, method, and program recording medium that solve at least the above-mentioned problems. [Means for solving the problem]

[0015] According to one embodiment of the present disclosure, one embodiment of a digital signature system comprises a first signature generating device and a second signature generating device, each having at least a processor and a communication interface. The first signature generation device acquires and stores a first auxiliary key generated using first secret information and first biometric information corresponding to a verification key, auxiliary data generated using second secret information for distributed signature generation and the first biometric information, and third secret information for distributed signature generation, generates a second distributed key, and uses the second distributed key and the third secret information, and sends and receives information with the second signature generation device to generate a second distributed signature for the message to be signed. The second signature generation device acquires the second biometric information, acquires the auxiliary data, recovers the second secret information using the second biometric information and the auxiliary data, generates a first distributed key, and uses the first distributed key and the second secret information, and sends and receives information with the first signature generation device, to generate a first distributed signature for the message. Either the first signature generation device or the second signature generation device generates a signature for the message using the first distributed signature and the second distributed signature, one of which is generated by the first device and the other is generated by the other device.

[0016] According to one form of the digital signature method disclosed herein, The first device is A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second device, a second distributed signature is generated for the message to be signed. The second device described above, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first device, a first distributed signature for the message is generated. Either the first device or the second device, A signature for the message is generated using the first distributed signature and the second distributed signature, specifically the one generated by one device and the other generated by the other device.

[0017] According to this disclosure, one form of recording medium is: A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second processing device, a second distributed signature is generated for the message to be signed. A program that causes the first processing unit to execute the process, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, A program that causes a second processing unit to execute a process that uses the first distributed key and the second secret information, and sends and receives information with the first device to generate a first distributed signature for the message, The first processing unit and the second processing unit record a program that causes the first or second processing unit to execute a process to generate a signature for the message using one of the first distributed signatures and the other of the second distributed signatures, which is generated by the first and the other of the first and second distributed signatures. [Effects of the Invention]

[0018] According to this disclosure, biometric distributed signatures can be implemented for digital signature schemes in which signatures are generated using confidential information in addition to the signing key. [Brief explanation of the drawing]

[0019] [Figure 1] (A) through (C) are diagrams illustrating EdDSA. [Figure 2] (A) and (B) are hypothetical diagrams of a Two-Party EdDSA. [Figure 3] This figure illustrates an example of a system according to an embodiment of the present disclosure. [Figure 4] This figure illustrates an example of the apparatus configuration of an embodiment of the present disclosure. [Figure 5] This figure illustrates an example of the operation of the system according to the embodiment of this disclosure. [Figure 6] This figure illustrates an example of the operation of the system according to the embodiment of this disclosure. [Figure 7] This figure illustrates an example of the apparatus configuration of an embodiment of the present disclosure. [Figure 8] This figure illustrates an example of the operation of the system according to the embodiment of this disclosure. [Figure 9] This figure illustrates an example of the operation of the system according to the embodiment of this disclosure. [Figure 10] This figure illustrates an example of the operation of the system according to the embodiment of this disclosure. [Figure 11] (A) and (B) are diagrams illustrating an example of a computer. [Modes for carrying out the invention]

[0020] Several embodiments of this disclosure are described below. EdDSA, a signature scheme listed in the e-Government Recommended Cryptography, uses an elliptic curve ((twisted) Edwards curve) on a finite field GF(p) (where p is an odd prime number; p=2^255-19 for Ed25519, and p=2^488-2^244-1 for Ed488). The signature key (signature secret key) sk consists of two pieces of secret information: secret information s (private key) corresponding to the public key verification key vk, and secret information s' for nonce generation during signing. The secret information s' for nonce generation is used to calculate the hash value during signature generation. The hash functions used in EdDSA are SHA-512 for Ed25519 and SHAKE25 for Ed448. Neither of these is homomorphic, and the hash value cannot be calculated separately for each. Therefore, when considering the application of EdDSA to a two-party distributed signature scheme, the signer needs to manage the secret information s' used for generating the nonce, as explained below.

[0021] No method has been proposed that would allow signatures to be generated in a distributed manner using biometric information, without requiring the signer to manage these secrets (secret information s (private key) and secret information s' for nonce generation).

[0022] The above issues are merely examples, but this disclosure proposes a biometric distributed signature scheme that addresses at least the above issues.

[0023] According to some systems (methods) presented in this disclosure, a first auxiliary key (c) generated using a first secret information (private key) (s) corresponding to a verification key and a first biometric information (w) is registered (stored) in a key-based signature generation device (first signature generation device). Furthermore, for the second secret information (s'1) used when generating a distributed signature, auxiliary data (c1) generated using the second secret information (s'1) and the first biometric information (w) is registered (stored) in the key-based signature generation device. In addition, a third secret information (s'2) used when generating a distributed signature is registered (stored) in the key-based signature generation device.

[0024] The biometric signature generator (second signature generator) obtains second biometric information (w') and auxiliary data (c1) from the key-based signature generator (first signature generator) when creating a signature, and uses the second biometric information (w') and auxiliary data (c1) to reconstruct the second secret information (s'1). The biometric signature generator may further generate a first distributed key (either Δ or x'), and use the first distributed key and the second secret information (s'1), and send and receive information with the key-based signature generator, to execute a process to generate a first distributed signature for a message (m: electronic document).

[0025] The key-based signature generation device (first signature generation device) may generate a second distributed key (Δ or the other of x') when creating a signature, and use the second distributed key and the third secret information (s'2) to exchange information with the biometric signature generation device (second signature generation device) to generate a second distributed signature for the message (m).

[0026] Either a key-based signature generator (first signature generator) or a biometric signature generator (second signature generator) may generate a signature for a message (m) using one of the first and second distributed signatures, one of which is generated by the device itself, and the other distributed signature generated by the other device.

[0027] The biometric utilization signature generation device (second signature generation device) generates a second auxiliary key (c') using the first distributed key (Δ) and the second biometric information (w'), transmits the second auxiliary key (c') to the key utilization signature generation device (first signature generation device), and the key utilization signature generation device may receive the second auxiliary key (c') and generate a second distributed key (x') using the first auxiliary key (c) and the second auxiliary key (c'). The key utilization signature generation device (first signature generation device) generates a second auxiliary key (c') using the auxiliary data (c1) and the second distributed key (Δ), transmits the second auxiliary key to the biometric utilization signature generation device (second signature generation device), and the biometric utilization signature generation device may receive the second auxiliary key (c') and generate a first distributed key (x') using the second auxiliary key (c') and the second biometric information (w').

[0028] Here, EdDSA, which is the premise of the method of the embodiments of the present disclosure, will be outlined. EdDSA system common parameter para {b, p, a, d, c, L, n, B, H, E, PH} (for details, see, for example, Reference 1, RFC (Request for Comments) 8032, etc.) (Twisted) Edwards curve E(p, a, d):={(x, y)∈F p ×F p |ax 2 +y 2 =1+dx 2 y 2} …(4) is defined.[[ID=二十九]] H:{0,1} * →{0,1} 2b The output length of is 2b bits. Also,[[]] p<2 b-1 , c<n<b (c = 2 or 3), 2 (b-c-1) <l<2 (b-c) …(5) holds.

[0029] The key generation (KeyGen), signing (Sign), and verification (Verify) processes of EdDSA use algorithms like those shown in Figure 1 (A), (B), and (C) (based on Reference 1).

[0030] The key generation algorithm KeyGen in Figure 1(A) takes the parameter para as input, generates a signing key sk and a verification key vk, and returns them as a return value (return (vk,sk)).

[0031] b-bit length random number s ε This generates a bit sequence of length b bits, generated uniformly randomly from {0,1}. ε Let's assume that. s ε ←{0,1} b …(6)

[0032] The hash function H creates a 2b bit sequence (h0,...,h 2b-1 ) generates (the output length of H is 2b bits). (h0…h 2b-1 ):=H(s ε ) …(7)

[0033] s has the most significant bit ((n+1) bits) as 1, and the i bit (=c,n-1) as h i This is secret information of (n+1) bit length with the lowest c bits being 0. s:=2 n +Σ<i=c,n-1> h i ·2 i …(8)

[0034] s' is H(s ε This is the secret information of the upper b bits length of ). s':=(h b ...h 2b-1 ) …(9)

[0035] The signature verification key vk is vk:=A(=[s]B) …(10) It is b-bit in length. B is a generator of the group (prime order) (starting point of the elliptic curve). That is, [L]B=O …(11) The left side of equation (11) is, TIFF2026050198000002.tif14153 This represents ([L]B is the notation in RFC8032), and O is the zero element of the group operation.

[0036] The signature secret key sk=(s, s') will have a length of (b+n+1) bits.

[0037] The signature generation algorithm Sign in Figure 1(B) takes (sk, vk, m) as input and returns the signature σ as the return value. It is almost equivalent to a Schnorr signature, but unlike a Schnorr signature, instead of randomly generating an internal random number r for the signature, it takes the hash value of the secret information s' and the plaintext (message) to be signed m (by concatenating s' and m and then taking another hash value) and uses this as the nonce r. r:=H(s', m) …(12)

[0038] Add the base point B r times to find R. R := [r]B …(13)

[0039] Next, R and the verification key vk (=A) are concatenated with PH(m) (R||A||PH(m)), and the hash value is obtained. e:=H(R,A,PH(m)) …(14)

[0040] The pre-hash function PH is, in the case of PureEdDSA, the identity function: PH(m) = m In the case of HashEdDSA, PH(m) = H'(m) (hash value of m).

[0041] Similar to a standard Schnorr signature, the value obtained by multiplying E by the secret information s and adding r (modulo operation modulo L) is used. z := r + e*s mod L …(15)

[0042] The signature verification algorithm Verify in Figure 1(C) takes (vk, m, σ) as input and returns the verification result τ as the return value.

[0043] If A and R are not included in E(p,a,d), return τ=0. TIFF2026050198000003.tif6150 TIFF2026050198000004.tif6150

[0044] This is equivalent to Schnorr signature verification, but RFC8032 verifies the signature (R,z) [z]B=R+[e]A …(16) Instead, [2^cz]B=[2^c]R+[2^ce]A …(17) We use (^ is the exponentiation operator). B is a cyclic group of prime order L, and if a valid signatory makes the signature, then A, R ∈ Therefore, [z]B=R+[e]A also holds, but we use the verification formula for [2^cz]B=[2^c]R+[2^ce]A. If [2^cz]B=[2^c]R+[2^ce]A holds, then τ=1; otherwise, τ:=0.

[0045] Next, we will consider two-party distributed signatures with respect to EdDSA. Figure 2 is a diagram illustrating two-party distributed signatures between P1 and P2 (based on the disclosure in Reference 2 and the inventors' own research). Note that in P1 and P2, the numbers in parentheses represent the step numbers in each device (unit), but this order may not be followed.

[0046] In P1, key generation (KeyGen) is performed as shown in Figure 2(A). (1) Take parameter para as input and input a random number s of length b bits. e A 2b bit string generated by hash function H. (h0…h 2b-1 )=:H(s e ) …(18) Of these, (n+1) bits are 1 and i bit is h i (i=c,…,n-1), we obtain a first distributed key s1 of (n+1) bit length with the lowest c bits being 0. s1:=2 n +Σ<i=c,n-1> h i ·2 i …(19) H(s e The first distributed secret information s'1, which is the upper b bits of ), is obtained. The first distributed secret information s'1 is the secret information for generating the first nonce. s'1:=(h b ...h 2b-1 ) …(20)

[0047] (2)Calculate A1=[s1]B (3) Send A1 to P2. (4) Receive A2 (=[s2]B) from P2. (5) Find the rational point A by adding the rational points A1 and A2 on the elliptic curve. A=A1+A2=[s1]B+[s2]B=[s1+s2]B …(21) (6) Let A be the verification key vk. (7) Let the distributed signature private key sk1 be (s1, s'1). Alternatively, step (3) may be omitted, and the value of A obtained in step (5) may be sent to P2.

[0048] Similar to P1, P2 performs key generation (KeyGen) as shown in Figure 2(A). (1) Input parameter para and a random number s of bit length f A 2b bit string generated by hash function H. (h'0…h'_ 2b-1 )=:H(s f ) …(twenty two) Of these, (n+1) bits are 1 and i bit is h' i (i=c,…,n-1), we obtain a second distributed key s2 of (n+1) bit length with the lowest c bits being 0. s2:=2 n +Σ<i=c,n-1> h' i ·2 i …(twenty three)

[0049] The second distributed secret information s'2 is H(s f This is the secret information of the upper b bits length of ). s'2:=(h'…h' 2b-1 ) …(twenty four)

[0050] (2) Calculate A2 = [s2] B (3) Receive A1 (=[s1]B) from P2. (4) Send A2 to P2. (5) Add the rational points A1 and A2 on the elliptic curve to find A. A=A1+A2=[s1]B+[s2]B=[s1+s2]B …(25) (6) Let A be the verification key vk. (7) Let the distributed signature private key sk2 be (s2, s'2). Alternatively, step (3) may be deleted, and instead of step (5), the system may receive A transmitted from P1.

[0051] During signature generation, P1 performs distributed signature generation (Sign) as shown in Figure 2(B). Distributed signature generation (Sign) takes the verification key vk (=A), the distributed signature secret key sk1 (=(s1,s'1)), and the message m as input.

[0052] (1) Calculate the first nonce r1 (integer), which is the hash value of the first distributed secret information s'1 and message m (the hash value obtained by concatenating s'1 and m and then inputting it into the hash function H is defined as the first nonce r1). r1:=H(s'1, m) …(26)

[0053] (2) Use the first nonce r1 to find the first rational point R1 on the elliptic curve. R1 := [r1] B …(27)

[0054] (3) Send R1 to P2.

[0055] (4) Receive R2 from P2. Note that step (4) may be performed before step (3) as long as it is before step (5).

[0056] (5) Add the first rational point R1 and the second rational point R2 on the elliptic curve to find the third rational point R. R:=R1+R2=[r1+r2]B …(28)

[0057] (6) The third rational point R and the verification key vk (=A) are concatenated with PH(m) and then included in the hash function H. e:=H(R,A,PH(m)) …(29) Calculate.

[0058] (7) Receive z2 from P2.

[0059] (8) Using z2, e and s1 z := z² + r¹ + e*s¹ mod L …(30) Calculate.

[0060] (9) Find the signature σ := (R, z) and return the signature σ (= (R, z)). Alternatively, step (3) may be omitted and the R obtained in step (5) may be sent to P2.

[0061] In P2, distributed signature generation (Sign) is performed as shown in Figure 2(B). Distributed signature generation (Sign) takes the verification key vk (=A), the distributed signature secret key sk2 (=(s2,s'2)), and the message m as input.

[0062] (1) Calculate a second nonce r2 (integer), which is the hash value of the second distributed secret information s'2 and message m (the hash value obtained by concatenating s'2 and m and then inputting it into the hash function H is taken as the second nonce r2). r² := H(s'², m) …(31)

[0063] (2) Find the second rational point R2 on the elliptic curve. R2 :=[r2]B …(32)

[0064] (3) We receive the first rational point R1 on the elliptic curve from P1. (4) Transmit the second rational point R2 on the elliptic curve to P1.

[0065] The order of (3) and (4) does not have to be this order.

[0066] (5) Add the first rational point R1 and the second rational point R2 on the elliptic curve to find the third rational point R on the elliptic curve. R:=R1+R2=[r1+r2]B …(33)

[0067] (6) The third rational point R on the elliptic curve and the signature verification key vk (=A) are concatenated into PH(m) and then included in the hash function H. e:=H(R, A, PH(m)) …(34) Calculate.

[0068] (7) z² := r² + e*s² mod L …(35) Calculate.

[0069] (8) Send z2 to P1. Alternatively, step (3) may be omitted, and instead of step (5), receive R sent from P1.

[0070] Here, for the signature σ=(R,z), equation (30) is: z := z² + r¹ + e*s¹ = r² + e*s² + r¹ + e*s¹ =r1+r2+e*(s1+s2) =r1+r2+e*s mod L …(36) Thus, z is the z in the signature σ=(R,z) for message m, which is based on the secret key (s=s1+s2) and the secret information s'1 and s'2.

[0071] Although not shown in Figure 2, the verification device that receives the signature σ from P1 executes the verification algorithm Verify. In Verify, the verification key vk, message m, and signature σ are taken as input, and for the signature σ=(R,z), [2^cz]B=[2^c]R+[2^ce]A …(37) Check if it is true. For example, if c=3, [8z]B=[8]R+[8e]A …(38) In Figure 2, P1 and P2 each perform key generation (KeyGen), but the configuration is not limited to this. For example, a separate entity (such as a first or second key generation device) could be used to generate keys for P1 and P2 (generating vk, sk1, and sk2).

[0072] In the example in Figure 2, P1 needs to manage the distributed signature secret key sk1=(s1, s'1). Although Reference 2 does not disclose biometric distributed signatures, which generate signatures in a distributed manner between two parties using a distributed key based on biometric information, in biometric distributed signatures, as in Figure 2, P1 needs to manage at least the secret information s'1. If P1 is the client, the management of the secret information s'1 becomes the responsibility of the client.

[0073] The above issues are just examples, but this disclosure proposes a new digital signature system (biometric distributed signature system) that can at least address the above issues.

[0074] Figure 3 illustrates several embodiments of the digital signature system proposed in this disclosure. Referring to Figure 3, the digital signature system 100 includes a biometric key generation device 110, a key signature generation device 120, a biometric signature generation device 130, a verification device 140, and a secret information generation device 150. In Figure 3, the numbers in parentheses within each device represent the processing step numbers, but the order of processing is not necessarily limited to this order. In Figure 3, the transmission and reception of signals are indicated by arrows, but this does not mean one-way transmission. It may, of course, include a series of handshakes such as the transmission of an information acquisition request from the receiving device to the transmitting device, the transmission of information from the transmitting device to the receiving device, and the transmission of an acknowledgment from the receiving device to the transmitting device, or a series of handshakes such as the transmission request from the transmitting device to the receiving device, the transmission of an acknowledgment from the receiving device to the transmitting device, the transmission of information from the transmitting device to the receiving device, and the transmission of an acknowledgment from the receiving device to the transmitting device. The same applies to the following drawings.

[0075] The biometric key generation device 110 performs the following processing as part of its key generation algorithm.

[0076] (1) Obtain the user's first biometric information w.

[0077] (2) Generate a private key (secret information) s and a public key, which is a verification key vk (=A=[s]B) corresponding to the private key s. The private key (secret information) s may also be generated using equation (8) above. The verification key vk may also be generated using equation (10) above.

[0078] (3) A first auxiliary key c is generated using the secret key (secret information) s corresponding to the verification key vk and the first biometric information w. The first auxiliary key c may also be a sketch (secure switch) formed by combining the value ENC(s) obtained by encoding the secret key (secret information) s and the first biometric information w. ENC(s) represents the encoded value obtained by inputting s into the encoding function ENC. c := ENC(s) + w …(39) Furthermore, composition is not limited to addition; it may also involve subtraction or bitwise exclusive OR operations. For example, if w is binary data, c may be obtained by bitwise exclusive OR with ENC(s).

[0079] (4) Generate first secret information s'1 for generating the first nonce. The first secret information s'1 may be, for example, given by equation (9). Generate auxiliary data c1 using the first biometric information w. The auxiliary data c1 may be a value obtained by combining the encoded value ENC(s'1) of the first secret information s'1 and the first biometric information w. c1 := ENC(s'1) + w …(40) Furthermore, in the right-hand side of equation (40), as in equation (39), composition is not limited to addition, but may also involve subtraction or bit-wise exclusive OR, etc.

[0080] (5) The first auxiliary key c and auxiliary data c1 are transmitted to the key-using signature generation device 120. Although c may also be called auxiliary data, it is referred to as the auxiliary key here to distinguish it from the auxiliary data c1. It is also referred to as the first auxiliary key to distinguish it from the following c'.

[0081] (6) The verification key vk(=A) is sent to the verification device 140. The verification key vk is also sent to the key-based signature generation device 120. This is because the verification key vk(=A) is used when generating the signature. The verification key vk(=A) may be a common parameter that can be commonly referenced by the key-based signature generation device 120 and the biometric signature generation device 130.

[0082] The secret information generation device 150 performs the following processing as part of the key generation algorithm, for example:

[0083] (1) Generate a second secret information s'2 for generating a second nonce. The second secret information s'2 may be generated by, for example, equation (24).

[0084] (2) The second secret information s'2 is transmitted to the key-based signature generation device 120. The secret key s may also be referred to as the first secret information. In this case, the first secret information s'1 and the second secret information s'2 will be treated (represented) as the second secret information and the third secret information.

[0085] The biometric signature generation device 130 performs the following processing, for example, when creating a signature.

[0086] (1) Obtain the user's (signer's) second biometric information w'.

[0087] (2) Obtain the message m to be signed.

[0088] (3) The device receives auxiliary data c1 from the key signature generation device 120.

[0089] (4) The first secret information s'1 is restored using the auxiliary data c1 and the second biometric information w'. For example, the first secret information s'1 is restored by inputting the difference between c1 and w' into the decryption function DEC. s'1:=DEC(c1-w') …(41)

[0090] The right-hand side of equation (41) is, DEC(c1-w')=DEC(ENC(s'1)+(w-w')) …(42)

[0091] The modalities of the first biometric data w and the second biometric data w' are the same (for example, the sensors that acquire the first biometric data w and the second biometric data w' are the same model). If the first biometric data w and the second biometric data w' are from the same person, the difference between w and w' will be less than or equal to the correction range of the decoding function DEC. DEC(c1-w')=DEC(ENC(s'1))=s'1...(43) This is the result.

[0092] In the biometric signature generation device 130, when creating a signature, it receives auxiliary data c1 from the key signature generation device 120 each time, and obtains the first secret information s'1 by decrypting the difference between the auxiliary data c1 and the second biometric information w'. Therefore, it is unnecessary for the biometric signature generation device 130 to manage the first secret information s'1.

[0093] (5) Select (generate) a first distributed key Δ (integer) uniformly randomly from the information source.

[0094] A second auxiliary key c' is generated using the first distributed key Δ and the second biometric information w'. c':=ENC(Δ)+w' …(44)

[0095] The second auxiliary key c' and message m are sent to the key signature generation device 120. Note that message m may be sent to the key signature generation device 120 after message m is obtained in step (2).

[0096] (6) Using the first secret information s'1 and the first distributed key Δ, information is sent and received between the key-utilizing signature generation device 120 and the distributed signature generation process, and the distributed signature generation process is executed.

[0097] For example, a first nonce r1=H(s'1,m) is generated using the first secret information s'1 and message m, the first rational point (R1=[r1]B) on the elliptic curve corresponding to the first nonce r1 is calculated, and a third rational point R(R=R1+R2) is obtained, which is the result of adding R1 and the second rational point (R2=[r2]B) on the elliptic curve corresponding to the second nonce r2 from the key-utilizing signature generation device 120 on the elliptic curve. Then, a first partial signature (first distributed signature) z1(=r1+e*Δ, where e:=H(R,A, PH(m))) is generated using R, the first nonce r1, the verification key vk(=A=[s]B), the message (m), and the first distributed key Δ. Next, the signature (σ=(R,z)) may be generated by combining the first partial signature z1 and the second partial signature (second distributed signature) z2 (=r2+e*x', z2 is generated in the key-using signature generator 120 using R, the second nonce r2, the verification key vk (=A=[s]B), the message (m), and the second distributed key x') with the third rational point R, resulting in a value z (=r1+r2+e*(Δ+x')) and a third rational point R.

[0098] (7) The signature σ=(R, z) and message m are sent to the verification device 140.

[0099] The key-based signature generation device 120 performs, for example, the following processes:

[0100] (1) The first auxiliary key c and auxiliary data c1 are received from the biometric key generation device 110 and registered in the storage unit. The first auxiliary key c registered in the key signature generation device 120 is a value in which the secret key s corresponding to the verification key vk is encoded and embedded in the first biometric information w, and security is ensured against the extraction of the secret key s and the first biometric information w from the first auxiliary key c, and against the leakage of the secret key s and the first biometric information w. In addition, the auxiliary data c1 registered in the key signature generation device 120 is a value in which the secret information s'1 for generating the first nonce is encoded and embedded in the first biometric information w, and security is ensured against the extraction and leakage of the secret information s'1.

[0101] (2) The second piece of secret information s'2 is received from the secret information generation device 150 and registered in the memory unit.

[0102] (3) The auxiliary data c1 is transmitted to the biometric signature generation device 130.

[0103] (4) Generate a second distributed key x'.

[0104] For example, a second auxiliary key c' (=ENC(Δ)+w') may be received from the biometric signature generation device 130, and a second distributed key x' may be generated using the first auxiliary key c and the second auxiliary key c'.

[0105] (5) Using the second secret information s'2 and the second distributed key x', information is sent and received between the biometric signature generation device 130 and the distributed signature generation process, and the distributed signature generation process is executed.

[0106] For example, a second nonce r2=H(s'2,m) may be generated using the second secret information s'2, a second rational point R2=[r2]B on the elliptic curve corresponding to the second nonce r2 is calculated and sent to the biometric signature generation device 130, a third rational point R(=R1+R2) which is the sum of the first rational point R1 and the second rational point R2 on the elliptic curve from the biometric signature generation device 130, a verification key vk(=A=[s]B), a message m, and a second distributed key x' may be used to generate a second partial signature z2(=r2+e*x', where e:=H(R,A, PH(m))), and the second partial signature z2 may be sent to the biometric signature generation device 130.

[0107] In the verification device 140, which verifies the signature of a message using a verification key, (1) The biometric signature generation device 130 receives a signature σ=(R, z) and a message m, (2) The verification key vk is used to verify whether the pair of σ=(R, z) and the message is correct. The signature σ=(R, z) and the message m may be received from the key-based signature generator 120.

[0108] Depending on the implementation, the biometric signature generator 130, the biometric key generator 110, and the secret information generator 150 may each be configured as client-side devices connected via a network (e.g., wired / wireless LAN (Local Area Network), mobile communication network, etc.), while the key signature generator 120 may be configured as a server device (e.g., a cloud server, etc.) connected to the client-side devices via a wired / wireless LAN, mobile communication network, The Internet, or other WAN (Wide Area Network) (however, it is not limited to the above). Depending on the implementation, the secret information generator 150 may be configured as a server-side device, independent of the key signature generator 120. For example, the server-side secret information generator 150 may generate secret information s'2 upon receiving a request from the client-side biometric key generator 110 and transmit it to the key signature generator 120.

[0109] Figure 4 shows an example of the functional configuration of each device in the system 100 of Figure 3. The biometric key generation device 110 includes a first biometric information acquisition unit 111, a secret information generation unit 112, a verification key generation unit 113, a verification key transmission unit 114, a first auxiliary key generation unit 115, a first auxiliary key transmission unit 116, an auxiliary data generation unit 117, and an auxiliary data transmission unit 118.

[0110] The confidential information generation device 150 comprises a confidential information generation unit 151 and a confidential information transmission unit 152.

[0111] The biometric signature generation device 130 includes a second biometric information acquisition unit 131, an auxiliary data acquisition unit 132, a secret information restoration unit 133, a message acquisition unit 134, a first distributed key generation unit 135, a second auxiliary key generation unit 136, a second auxiliary key / message transmission unit 137, a distributed signature generation unit 138, and a signature / message transmission unit 139. The distributed signature generation unit 138 uses a verification key vk (=A) to generate a distributed signature, but a verification key acquisition unit (not shown) that acquires the key from, for example, the key-based signature generation device 120 may be provided within the distributed signature generation unit 138, or it may be provided separately from the distributed signature generation unit 138. It is not necessary for the biometric signature generation device 130 to receive the verification key vk generated by the biometric key generation device 110 and store and manage the verification key vk on the biometric signature generation device 130 side.

[0112] The key-based signature generation device 120 includes a first auxiliary key acquisition unit 121A, a first auxiliary key storage unit 121B, a secret information acquisition unit 122A, a secret information storage unit 122B, an auxiliary data acquisition unit 123A, an auxiliary data storage unit 123B, an auxiliary data transmission unit 123C, a second auxiliary key / message acquisition unit 124, a second distributed key generation unit 125, a distributed signature generation unit 126, a verification key acquisition unit 120A, and a verification key storage unit 120B. Although not shown for the sake of drawing, the key-based signature generation device 120 may also include a signature message transmission unit (127 in Figure 8) that transmits the signature and message to the verification device 140, instead of the signature / message transmission unit 139 of the biometric signature generation device 130.

[0113] The verification device 140 includes a verification key acquisition unit 141, a verification key storage unit 142, a signature / message acquisition unit 143, and a signature verification unit 144.

[0114] Figure 5 illustrates the key (secret information) generation process in the system shown in Figure 4. The numbers in parentheses for each device in Figure 5 represent the processing step numbers for each device.

[0115] The biometric key generation device 110 performs the following processing.

[0116] (1) The first biometric information acquisition unit 111 acquires the user's first biometric information w. The first biometric information may be any of the following: facial information, fingerprint information, vein information (finger or palm), iris information, etc.

[0117] (2) The secret information generation unit 112 generates a bit sequence (random number) of length b bits uniformly randomly from {0,1} and s ε Let's assume that. s ε ←{0,1} b …(45)

[0118] The hash function H creates a 2b bit sequence (h0,...,h 2b-1 ) generates. (h0,…,h 2b-1 ):=H(s ε ) …(46)

[0119] s is a secret information of (n+1) bit length where the most significant bit ((n+1) bits) is 1, bit i (=c,n-1) is hi, and the least significant bit c is 0. s:=2 n +Σ<i=c,n-1> h i ·2 i …(47)

[0120] s'1 is H(s ε This is the secret information of the upper b bits length of ). s'1:=(h b ...h 2b-1 ) …(48)

[0121] (3) The verification key generation unit 113 generates a verification key vk using the secret information s (secret key) and base point B. vk:=A=[s]B …(49)

[0122] (4) The first auxiliary key generation unit 115 generates a first auxiliary key c using the value ENC(s) obtained by encoding the secret information s (secret key) and the first biometric information w. c := ENC(s) + w …(50) The operation + can also be -, or, depending on the encoding, a bitwise exclusive OR operation, etc.

[0123] The encoding function ENC converts plaintext mA in the source space into the code cA. The decoding function DEC converts the code cA back into plaintext mA. cA ← ENC (mA) …(51) mA ← DEC(cA) …(52)

[0124] Here, for a code cA' whose difference from any plaintext mA in the source space is within the correction range (capability), mA = DEC(cA') …(53) The following must hold true. Linear codes will be used below.

[0125] Linearity: ENC(mA) + ENC(mB) …(54) is a codeword for mA+mB, mA + mB = DEC(ENC(mA) + ENC(mB)) …(55) The following holds true. In equation (55), the "+" on the left and right sides does not have to be the same operation.

[0126] Regarding coding, error correction codes (such as Hamming codes, BCH (Bose-Chaudhuri-Hocquenghem code), RS (Reed-Solomon) codes, and LDPC (low-density parity-check code) codes) may be used. Alternatively, lattice coding may be used. More specifically, methods using integer grids, triangular grids, and more complex grids are known.

[0127] If the biometric information w is n-bit binary data, then the encoded value ENC(s) may also be n-bit binary data.

[0128] If the biological information w is an n-dimensional vector, then the encoded value ENC(s) may also be an n-dimensional vector.

[0129] (5) The first auxiliary key transmission unit 116 transmits the first auxiliary key c to the key-using signature generation device 120.

[0130] (6) The auxiliary data generation unit 117 generates auxiliary data c1 using the value ENC(s'1) obtained by encoding the secret information s'1 and the first biometric information w. c1 := ENC(s'1) + w …(56)

[0131] (7) The auxiliary data transmission unit 118 transmits the auxiliary data c1 to the key-based signature generation device 120.

[0132] (8) The verification key transmission unit 114 transmits the verification key vk(=A=[s]B) to the verification device 140. The verification key transmission unit 114 may also transmit the verification key vk(=A=[s]B) to the key-using signature generation device 120.

[0133] The first auxiliary key c and auxiliary data c1 may be sent together or separately. The order in which the verification key vk, the first auxiliary key c, and the auxiliary data c1 are sent is arbitrary.

[0134] The confidential information generation device 150 performs the following processing.

[0135] (1) The secret information generation unit 151 generates a bit sequence (random number) of length b bits uniformly randomly from {0,1} and s f Let's assume that. s f ←{0,1} b …(57)

[0136] The hash function H creates a 2b bit sequence (h0,...,h 2b-1 ) generates. (h'0…h' 2b-1 ):=H(s f ) …(58) s'2:=(h' b …h' 2b-1 ) …(59)

[0137] (2) The secret information generation unit 151 transmits the secret information s'2 for generating the second nonce to the key signature generation device 120.

[0138] The verification device 140 performs the following processing.

[0139] (1) The verification key acquisition unit 141 receives the verification key transmitted from the biometric key generation device 110.

[0140] (2) The verification key acquisition unit 141 stores the verification key in the verification key storage unit 142.

[0141] The key-based signature generation device 120 performs the following processing.

[0142] (1) The first auxiliary key acquisition unit 121A, the auxiliary data acquisition unit 123A, and the verification key acquisition unit 120A each receive the first auxiliary key c, auxiliary data c1, and verification key vk transmitted from the biometric key generation device 110. Of course, the first auxiliary key acquisition unit 121A, the auxiliary data acquisition unit 123A, and the verification key acquisition unit 120A may each receive the first auxiliary key c, auxiliary data c1, and verification key vk at different times.

[0143] (2) The secret information acquisition unit 122A receives the second secret information s'2 for generating a nonce transmitted from the secret information generation device 150.

[0144] (3) The first auxiliary key acquisition unit 121A stores the first auxiliary key c in the first auxiliary key storage unit 121B, the auxiliary data acquisition unit 123A stores the auxiliary data c1 in the auxiliary data storage unit 123B, and the verification key acquisition unit 120A stores the verification key vk in the verification key storage unit 120B. The secret information acquisition unit 122A stores the secret information s'2 in the secret information storage unit 122B.

[0145] In the key-based signature generation device 120 shown in Figure 4, the first auxiliary key storage unit 121B, auxiliary data storage unit 123B, secret information storage unit 122B, and verification key storage unit 120B may be separate storage devices or they may be a single storage device.

[0146] Figure 6 illustrates the process of generating and verifying signatures in the system shown in Figure 4.

[0147] The biometric signature generation device 130 performs the following processing, for example, when generating a signature.

[0148] (1) The second biometric information acquisition unit 131 acquires the user's second biometric information w'. The second biometric information w' and the first biometric information w are of the same modality.

[0149] (2) The message acquisition unit 134A acquires the message m (electronic document) to be signed.

[0150] (3) The auxiliary data acquisition unit 132 acquires auxiliary data c1 from the key signature generation device 120. The auxiliary data acquisition unit 132 may also send a request to the key signature generation device 120 to acquire auxiliary data c1 and receive the auxiliary data c1 from the key signature generation device 120.

[0151] (4) The secret information recovery unit 133 recovers the secret information s'1 for generating the first nonce using the auxiliary data c1 and the second biometric information w'. s'1:=DEC(c1-w') …(60)

[0152] As mentioned above, if the second biological information w' and the first biological information w belong to the same person, then DEC(c1-w') …(61) The result of the operation is s'1.

[0153] (5) The first distributed key generation unit 135 selects (generates) a first distributed key Δ from the information source in a uniformly random manner.

[0154] (6) The distributed signature generation unit 138 generates a second auxiliary key c' using the value ENC(Δ) obtained by encoding the first distributed key Δ and the second biometric information w'. c':=ENC(Δ)+w' …(62)

[0155] (7) The second auxiliary key / message transmission unit 137 transmits the second auxiliary key c' and message m to the key-using signature generation device 120. Although the second auxiliary key / message transmission unit 137 is shown as a single unit, it is of course possible to configure the second auxiliary key transmission unit and the message transmission unit as separate units.

[0156] (8) The distributed signature generation unit 138 exchanges information with the distributed signature generation unit 126 of the key-based signature generation device 120 to generate a signature.

[0157] (8A) The distributed signature generation unit 138 inputs the value obtained by concatenating the secret information s'1 for generating the first nonce and the message m into the hash function H and calculates the first nonce (integer). r1:=H(s'1, m) …(63)

[0158] (8B) The distributed signature generation unit 138 uses r1 to find the first rational point R1 on the elliptic curve (by adding the base point B to the first nonce r1 times). R1 := [r1] B …(64)

[0159] (8C) The distributed signature generation unit 138 receives the second rational point R2 on the elliptic curve transmitted from the distributed signature generation unit 126 of the key-using signature generation device 120. The distributed signature generation unit 138 obtains the verification key vk transmitted from the distributed signature generation unit 126 of the key-using signature generation device 120. It should be noted that the acquisition of the verification key vk stored in the key-using signature generation device 120 by the distributed signature generation unit 138 may be performed before the execution of step (8E), and may be performed separately from the acquisition of the second rational point R2.

[0160] (8D) The distributed signature generation unit 138 finds a third rational point R on the elliptic curve by adding the first rational point R1 and the second rational point R2 on the elliptic curve. R:=R1+R2=[r1+r2]B …(65)

[0161] (8E) The distributed signature generation unit 138 concatenates the third rational point R, the verification key vk (= A), and PH(m), and includes them in the hash function H. e := H(R, A, PH(m)) …(66) Calculate.

[0162] (8F) The distributed signature generation unit 138 transmits the first rational point R1 on the elliptic curve to the distributed signature generation unit 126 of the key-usage signature generation device 120. The transmission of R1 by the distributed signature generation unit 138 may be performed at an arbitrary timing in response to a request for obtaining R1 from the distributed signature generation unit 126 of the key-usage signature generation device 120.

[0163] (8G) The distributed signature generation unit 138 calculates the first partial signature z1. z1 := r1 + e * Δ mod L …(67) Since z1 becomes the element z (= z1 + z2) of the signature σ = (R, z) when combined (added) with the following z2, it is called the first partial signature (the first distributed signature).

[0164] (8H) The distributed signature generation unit 138 receives z2 (= r2 + e * x') from the distributed signature generation unit 126 of the key-usage signature generation device 120. The distributed signature generation unit 138 may obtain z2 by making a request for obtaining z2 to the distributed signature generation unit 126 of the key-usage signature generation device 120. Since z2 becomes the element z (= z1 + z2) of the signature σ = (R, z) when combined (added) with the first partial signature (the first distributed signature) z1, it is called the second partial signature (the second distributed signature).

[0165] (8I) The distributed signature generation unit 138 adds the second partial signature (the second distributed signature) z2 to the first partial signature (the first distributed signature) z1 to obtain z of the signature σ = (R, z). z := r1 + e * Δ + r2 + e * x' = r1 + r2 + e * (Δ + x') = r1 + r2 + e * (Δ + (s - Δ)) = r1 + r2 + e * s mod L …(68)

[0166] (9) The distributed signature generation unit 138 sends the signature σ=(R,z) and message m to the verification device 140.

[0167] Furthermore, the biometric signature generation device 130 may delete the auxiliary data c1, the first secret information s'1, the first distributed key Δ, and the second auxiliary key c' (or reset or zero-clear the corresponding variable area, etc.) after completing the distributed signature generation process (8). In addition, the information r1, R1, R2, e, z1, z2, and z generated or acquired in the distributed signature creation process (8) may also be deleted (or the corresponding variable area, storage area, etc.) after sending the signature σ=(R,z) to the verification device 140.

[0168] The key-based signature generation device 120 performs the following processing when generating a signature, for example. This follows from step (3) onwards in the processing numbers (steps) of the key-based signature generation device 120 in Figure 5.

[0169] (4) The auxiliary data transmission unit 123C transmits the auxiliary data c1 to the biometric signature generation device 130.

[0170] (5) The second auxiliary key / message acquisition unit 124 acquires the second auxiliary key c' and message m from the biometric signature generation device 130.

[0171] (6) The second distributed key generation unit 125 generates a second distributed key x' using the first auxiliary key c and the second auxiliary key c'. x':=DEC(c-c') …(69)

[0172] The right-hand side of equation (69) is, DEC(c-c')=DEC(ENC(s)+w-(ENC(Δ)+w')) =DEC(ENC(s-Δ))+(w-w')) …(70)

[0173] If the first biometric information w and the second biometric information w' belong to the same person, the difference between w and w' will be within the correction range, and equation (70) above will be: DEC(ENC(s-Δ))=s-Δ …(71) This is the result.

[0174] In other words, x' = s - Δ …(72)

[0175] (7) The distributed signature generation unit 126 exchanges information with the distributed signature generation unit 138 of the biometric signature generation device 130 to generate a partial signature and transmits it to the distributed signature generation unit 138.

[0176] (7A) The distributed signature generation unit 126 calculates a second nonce r2 (integer), which is a hash value obtained by concatenating the secret information s'2 and m for generating the second nonce. r² := H(s'², m) …(73)

[0177] (7B) The distributed signature generation unit 126 finds a second rational point R2 on the elliptic curve (by adding the base point B r2 times). R2 :=[r2]B …(74)

[0178] (7C) The distributed signature generation unit 126 transmits R2 to the distributed signature generation unit 138 of the biometric signature generation device 130. The distributed signature generation unit 126 transmits the verification key vk to the distributed signature generation unit 138 of the biometric signature generation device 130. In Figure 6, the second rational point R2 and the verification key vk are transmitted together, but of course the distributed signature generation unit 126 may transmit the second rational point R2 and the verification key vk separately.

[0179] (7D) The distributed signature generation unit 126 obtains R1 from the distributed signature generation unit 138 of the biometric signature generation device 130.

[0180] (7E) The distributed signature generation unit 126 finds a third rational point R on the elliptic curve by adding the first rational point R1 and the second rational point R2 on the elliptic curve. R:=R1+R2=[r1+r2]B …(75)

[0181] (7F) The distributed signature generation unit 126 concatenates the third rational point R and the signature verification key vk (=A) with PH (m) and then inputs them into the hash function H. e := H(R, A, PH(m)) …(76) Calculate it.

[0182] (7G) The distributed signature generation unit 126 z2 := r2 + e * s2 mod L …(77) Calculate it.

[0183] (7H) The distributed signature generation unit 126 transmits z2 to the distributed signature generation unit 138 of the biometric signature generation device 130.

[0184] Note that in the key - using signature generation device 120, after the completion of the distributed signature generation process (7), the second auxiliary key c' and the second distributed key x' may be deleted (or the corresponding variable areas, storage areas, etc. may be reset or zero - cleared). Also, the information of r2, R1, R2, e, z2 generated or acquired in the distributed signature creation process (7) may be deleted (or the corresponding variable areas, storage areas, etc. may be reset or zero - cleared).

[0185] The verification device 140 performs the following process.

[0186] (3) Receive the signature σ and the message m.

[0187] [[ID=3,0]] (4) Verify whether the pair of the signature σ and the message m is correct using the verification key vk. [2 c z]B = [2 c R + [2 c e]A …(78) If it holds, accept (Verify(vk, σ, m) returns, for example, 1), and if it does not hold, reject (Verify(vk, σ, m) returns, for example, 0).

[0188] In Figure 6, steps (8G) to (8I) of the distributed signature generation process of the biometric signature generation device 130 and step (7H) of the distributed signature generation process of the key-based signature generation device 120 may be modified as shown in Figure 7. For example, step (8H) of the distributed signature generation process of the biometric signature generation device 130 transmits z1 to the distributed signature generation process of the key-based signature generation device 120, step (7H) of the distributed signature generation process of the key-based signature generation device 120 receives z1, calculates z=z1+z2 in step (7I), and sends the signature σ=(R, z) and message m from the key-based signature generation device 120 to the verification device 140 in step (8). In this case, instead of the signature / message transmission unit 139 of the biometric signature generation device 130 in Figure 4, the key-based signature generation device 120 is equipped with a signature / message transmission unit.

[0189] Here, as a non-restrictive example of the coding function ENC, we will describe an example where coding using a square grid, as disclosed in, for example, Reference 3, is applied, for the case where the first biological information w and the second biological information w' are n-dimensional vectors.

[0190] Let the first biological information w and the second biological information w' be n-dimensional real vectors. w= (w1, …, w n ), w'= (w'1,…, w' n ) …(79)

[0191] The distance between the first biological information w and the second biological information w' is, for example, the Chebyshev distance (L ∞ distance, L ∞ The norm is expressed as follows: d (n) ∞ (w, w') = max {|w i - w' i |, i=1,…,n} …(80) distance d (n) ∞ (w, w') is a predetermined threshold t h Below(d (n) ∞ (w, w')≦t h If they match, they are considered to be the same organism.

[0192] Define the lattice point set L as follows. L = {Y = (y1, …, y n ) | y i is a non - negative integer, 0 ≤ y i ≤ K} …(81) Here, K is a predetermined positive integer that is sufficiently larger than t h or |w i .

[0193] Define a function int() that corresponds an integer u to an n - dimensional integer vector Y ∈ L by the following equation. u ← int(Y) = Σ<i = 1,n>y i (2K) i-1 …(82)

[0194] The inverse function int -1 () is a function that corresponds an integer u to an n - dimensional integer vector Y. Y ← int -1 (u) …(83)

[0195] When the first secret information s'1 (a positive integer) is input into the inverse function int -1 (), an n - dimensional integer vector A is obtained. A = (a1, …, a n ) ← int -1 (s'1) …(84)

[0196] Here, let the encoding function ENC be ENC() = 2t h * int -1 () …(85) That is, this encoding function ENC satisfies ENC(m1)+ENC(m2)=ENC(m + 1+m2).

[0197] The encoded value obtained by encoding s'1 in step (6) of the biocompatible key generation device 110 is an n - dimensional vector and is given as follows. ENC(s'1)=2t h * int -1 (s'1)=2t h *(a1, …, a n ) …(86)

[0198] Therefore, the auxiliary data c1 generated by the biometric key generation device 110 in Figure 5 is represented as follows. c1:= ENC(s'1) + w = ​​2t h *(a1,…, a n )+(w1,…, w n ) =(2t h *a1+w1,…,2t h *a n + w n ) …(87)

[0199] Here, as a non-restrictive example, we use a square grid for encoding, and the encoding function ENC is 2t. h *int -1 When using (), the decoding function DEC is, DEC(x) = int(x / 2t) h ) …(88) That is also acceptable.

[0200] Step (4) of the biometric signature generation device 130 in Figure 6 s'1:=DEC(c1- w') …(89) In this case, the arguments of the decoding function DEC are, c1-w'=(2t h *a1+w1,…,2t h *a n + w n )-(w'1,…, w' n ) (2t h *a1+w1-w'1,…,2t h *a n + w n -w' n ) …(90)

[0201] therefore, DEC(c1-w')=int{(1 / 2t h )(2t h *a1+w1-w'1,…,2t h *a n + w n -w' n )} =int{(1 / 2t h )(2t h *a1,…,2t h *a n )} + (1 / 2t h )(w1-w'1,…,w n -w' n )} =int{(a1,…,a n ) + (1 / 2t h )(w1-w'1,…,w n -w' n )} …(91)

[0202] Regarding the first biological information w and the second biological information w', d (n) ∞ (w, w') = max { |w i - w' i |, i=1,…,n} ≤ t h …(92) In this case, the n-dimensional vector (1 / 2t) of equation (91) h )(w1-w'1,…,w n -w' n Since each component is less than or equal to ±1 / 2, the integer value of each component is 0. DEC(c1-w')=int{(a1,…,a n )}=s'1…(93) This is the result.

[0203] Furthermore, in step (6) of the biometric key generation device 110 in Figure 5, the encoded value obtained by encoding the secret information s becomes an n-dimensional integer vector, which is given below. ENC(s) = 2t h *int -1 (s) = 2t h *(e1,…, e n ) …(94)

[0204] Therefore, in the bio-based key generation device 110 shown in Figure 5, the first auxiliary key c generated in step (4) is represented as follows. c := ENC(s) + w = ​​2t h *(e1,…, e n )+(w1,…, w n ) =(2t h *e1+w1,…,2t h *e n + w n ) …(95)

[0205] In the biometric signature generation device 130, the value encoded by the first distributed key Δ in step (6) of Figure 6 is expressed as follows. ENC(Δ)=2t h *int -1 (Δ) = 2t h *(f1,…, f n ) …(96)

[0206] Therefore, in the biometric signature generation device 130 shown in Figure 6, the second auxiliary key c' in step (6) is represented as follows. c':= ENC(Δ) + w' = 2t h *(f1,…, f n )+(w'1,…, w' n ) =(2t h *f1+w'1,…,2t h *f n +w' n ) …(97)

[0207] In the key-based signature generation device 120 shown in Figure 6, DEC(c-c') in step (6) is c-c'=(2t h *e1+w1,…,2t h *e n + w n )-(2t h *f1+w'1,…,2t h *f n +w' n ) =(2t h )(e1-f1, …,e n -f n )+(w1-w'1,…,w n -w' n ), …(98) twist, DEC(c-c')=int{(1 / 2t h )(2t h )(e1-f1, …,e n -f n )+(1 / 2t h )(w1-w'1,…,w n -w' n )} =int{(e1-f1, …,e n -f n )+(1 / 2t h )(w1-w'1,…,w n -w' n )} =int{(e1, …,e n )-(f1, …,f n )+(1 / 2t h )(w1-w'1,…,w n -w' n )} …(99)

[0208] so d (n) ∞ (w, w') = max { |w i - w' i |, i=1,…,n} ≤ t h …(100) In this case, the n-dimensional vector (1 / 2t) of equation (98) h )(w1-w'1,…,w n -w' n Since all components are less than or equal to ±1 / 2, the integer values ​​of each component are 0. DEC(c-c')=int{(e1, …,e n )-(f1, …,f n ))=s-Δ …(101) This is the result.

[0209] The message m may also be provided externally to the key-based signature generation device 120 and the biometric signature generation device 130, respectively.

[0210] For the purpose of enhancing security, a zero-knowledge proof (Non-Interactive zero-knowledge: NIZK) of knowing the first nonce r1 may be performed from the biometric signature generator 130 to the key signature generator 120. In this case, the biometric signature generator 130 and the key signature generator 120 share a proof generation key and a proof verification key. For example, in Figure 6, the distributed signature generation unit 138 of the biometric signature generator 130, which is the prover, may, for example, calculate the first rational point R1 of the elliptic curve using the first nonce r1 (step (8B) of the biometric signature generator 130 in Figure 6), and then generate a proof (NIZK proof) π1 from a specific example of the proposition to be proven (instance: knowing the first nonce r1) and evidence (witness) that this proposition is true, and send the instance (R1) and proof π1 to the key signature generator 120, which is the verifier. The key-based signature generator 120, which is the verifier, may, after receiving the instance (R1) and the certificate π1, perform verification of the certificate π1 using the certificate verification key.

[0211] The key signature generator 120 may perform a non-interactive zero-knowledge proof of knowing the second nonce r2 to the biometric signature generator 130. For example, in Figure 6, the distributed signature generation unit 126 of the key signature generator 120, which is the prover, may, for example, use the second nonce r2 to calculate the second rational point R2 of the elliptic curve (step (7C) of the key signature generator 120 in Figure 6), and then generate proof π2 from a concrete example of the proposition to be proven (instance: knowing the second nonce r2) and evidence that this proposition is true, and then transmit the instance (R2) and proof π2 to the biometric signature generator 130, which is the verifier. The biometric signature generator 130, which is the verifier, receives the instance (R2) and proof π2 and then verifies proof π2 using the proof verification key. The biometric signature generator 130 may decommit to the instance (R2) and the proof π2, and the key signature generator 120 may verify the proof π2 after the commitment has been released (decommitted) (Reference 4).

[0212] Figure 8 shows another example of the system of this disclosure. The biometric key generation device 110, the secret information generation device 150, and the verification device 140 are the same as those in Figure 4.

[0213] The biometric signature generation device 130 comprises a second biometric information acquisition unit 131, an auxiliary data acquisition unit 132, a secret information recovery unit 133, a message acquisition unit 134A, a message transmission unit 134B, a second auxiliary key acquisition unit 137A, a first distributed key generation unit 135, and a distributed signature generation unit 138.

[0214] The key-based signature generation device 120 comprises a first auxiliary key acquisition unit 121A, a first auxiliary key storage unit 121B, a secret information acquisition unit 122A, a secret information storage unit 122B, an auxiliary data acquisition unit 123A, an auxiliary data storage unit 123B, an auxiliary data transmission unit 123C, a message acquisition unit 128A, a second distributed key generation unit 125, a second auxiliary key generation unit 129A, a second auxiliary key transmission unit 129B, a distributed signature generation unit 126, a signature / message transmission unit 127, a verification key acquisition unit 120A, and a verification key storage unit 120B.

[0215] Figure 9 is a diagram illustrating the processing in the system shown in Figure 8. Note that the biometric key generation device 110 and the secret information generation device 150 are the same as those in Figure 5, so their explanation is omitted. The verification key acquisition unit 120A of the key signature generation device 120 acquires the verification key vk generated by the biometric key generation device 110 and stores it in the verification key storage unit 120B (processing steps 1 and 2 in Figure 5).

[0216] The biometric signature generation device 130 performs the following processing, for example, when creating a signature.

[0217] (1) The second biometric information acquisition unit 131 acquires the user's second biometric information w'. The second biometric information w' and the first biometric information w are of the same modality.

[0218] (2) The message acquisition unit 134A acquires the message m (electronic document) to be signed.

[0219] (3) The message transmission unit 134B transmits message m to the key signature generation device 120.

[0220] (4) The auxiliary data acquisition unit 132 acquires the auxiliary data c1 transmitted from the key-using signature generation device 120. The second auxiliary key acquisition unit 137A acquires the second auxiliary key c' transmitted from the key-using signature generation device 120.

[0221] (5) The secret information recovery unit 133 recovers the secret information s'1 for generating the first nonce using the auxiliary data c1 and the second biometric information w'. s'1:=DEC(c1-w') …(102)

[0222] As mentioned above, if the second biological information w' and the first biological information w belong to the same person, then DEC(c1-w') …(103) The result of the operation is s'1.

[0223] (6) The first distributed key generation unit 135 is x':=DEC(c'-w') …(104) This generates the first distributed key x'.

[0224] The right-hand side of equation (102), DEC(c'-w'), DEC(c'-w')=DEC(c-ENC(Δ)-w') =DEC(ENC(s)+w - ENC(Δ)-w') =DEC(ENC(s-Δ)+(w-w')) …(105) If the first biometric information w and the second biometric information w' belong to the same person, DEC(c'-w')=s-Δ …(106) ∴ x'=s-Δ …(107)

[0225] (7) The distributed signature generation unit 138 exchanges information with the distributed signature generation unit 126 of the key-based signature generation device 120 to generate a signature.

[0226] (7A) The distributed signature generation unit 138 concatenates the secret information s'1 for generating the first nonce and the message m (plaintext to be signed) and inputs them into the hash function H to calculate the first nonce (integer), which is the hash value of s'1 and m. r1:=H(s'1, m) …(108)

[0227] (7B) The distributed signature generation unit 138 uses r1 to find the first rational point R1 on the elliptic curve. R1 := [r1] B …(109)

[0228] (7C) The distributed signature generation unit 138 transmits R1 to the distributed signature generation unit 126 of the key-based signature generation device 120. The transmission of R1 by the distributed signature generation unit 138 may be performed at any time in response to a request for R1 acquisition from the distributed signature generation unit 126 of the key-based signature generation device 120.

[0229] (7D) The distributed signature generation unit 138 receives a second rational point R2 on the elliptic curve transmitted from the key-utilizing signature generation device 120. The distributed signature generation unit 138 obtains a verification key vk from the key-utilizing signature generation device 120. The acquisition of the verification key vk may be done before step (7F) is executed and may be separate from the second rational point R2.

[0230] (7E) The distributed signature generation unit 138 finds a rational point R by adding rational points R1 and R2 on the elliptic curve. R:=R1+R2=[r1+r2]B …(110)

[0231] (7F) The distributed signature generation unit 138 concatenates the rational point R and the verification key vk (=A) with PH (m) and then inputs them into the hash function H. e:=H(R,A,PH(m)) …(111) Calculate.

[0232] (7G) The distributed signature generation unit 138 calculates the first distributed signature (first partial signature) z1. z1 := r1 + e*x' mod L …(112)

[0233] (7H) The distributed signature generation unit 138 transmits z1 to the distributed signature generation unit 126 of the key-based signature generation device 120.

[0234] Furthermore, in the biometric signature generation device 130, after the distributed signature generation process (7) is completed, the auxiliary data c1, the second auxiliary key c', the first secret information s'1, and the first distributed key x' may be deleted (or the corresponding variable area, storage area, etc. may be reset or zeroed out). In addition, the information r1, R1, R2, e, and z1 generated or acquired in the distributed signature creation process (7) may be deleted (or the corresponding variable area, storage area, etc. may be reset or zeroed out) after the distributed signature generation process (7) is completed.

[0235] When generating a signature, the key-based signature generation device 120 performs the following processing steps following step 3 in Figure 5.

[0236] (4) Obtain message m from the biometric signature generation device 130.

[0237] (5) Generate (select) a second distributed key Δ from the information source in a uniformly random manner.

[0238] (6) The second auxiliary key c' is obtained by combining the first auxiliary key c and the second distributed key Δ to obtain the value ENC(Δ). c':=c- ENC(Δ) …(113)

[0239] (7) The second auxiliary key c' and auxiliary data c1 are transmitted to the distributed signature generation unit 138 of the biometric signature generation device 130.

[0240] (8) The distributed signature generation unit 126 exchanges information with the distributed signature generation unit 138 of the biometric signature generation device 130 to generate a distributed signature.

[0241] (8A) The distributed signature generation unit 126 concatenates the secret information s'2 for generating the second nonce with the message m and inputs it into the hash function H to calculate the second nonce r2 (integer), which is the hash value of s'2 and m. r² := H(s'², m) …(114)

[0242] (8B) The distributed signature generation unit 126 finds a second rational point R2 on the elliptic curve (by adding the base point B to the second nonce r twice). R2 :=[r2]B …(115)

[0243] (8C) The distributed signature generation unit 126 obtains a first rational point R1 on the elliptic curve from the distributed signature generation unit 138 of the biometric signature generation device 130.

[0244] (8D) The distributed signature generation unit 126 transmits the second rational point R2 to the distributed signature generation unit 138 of the biometric signature generation device 130. The distributed signature generation unit 126 transmits the verification key vk (=A) to the distributed signature generation unit 138 of the biometric signature generation device 130. In Figure 9, the second rational point R2 and the verification key vk are transmitted together, but the distributed signature generation unit 126 may transmit the second rational point R2 and the verification key vk separately.

[0245] (8E) The distributed signature generation unit 126 finds a third rational point R on the elliptic curve by adding the first rational point R1 and the second rational point R2 on the elliptic curve. R:=R1+R2=[r1+r2]B …(116)

[0246] (8F) The distributed signature generation unit 126 concatenates the third rational point R with the verification key vk (=A) and PH (m) and then inputs them into the hash function H. e:=H(R,A,PH(m)) …(117) Calculate.

[0247] (8G) The distributed signature generation unit 126 calculates the second distributed signature (second partial signature) z2. z2:=r2+e*Δ mod L …(118) Calculate.

[0248] (8H) The distributed signature generation unit 126 receives z1 from the distributed signature generation unit 138 of the biometric signature generation device 130.

[0249] (8I) The distributed signature generation unit 126 adds z1 to z2 to obtain z (z in signature σ=(R,z)). z:=r2+e*Δ+r1+e*x' =r1+r2+e*(Δ+x') =r1+r2+e*(Δ+(s-Δ)) =r1+r2+e*s mod L …(119)

[0250] The distributed signature generation unit 126 outputs the signature σ=(R,z) to the signature / message transmission unit 127.

[0251] (9) The signature / message transmission unit 127 transmits the signature σ=(R,z) and message m to the verification device 140.

[0252] Furthermore, the key-based signature generation device 120 may delete the second distributed key Δ and the second auxiliary key c' after the completion of the distributed signature generation process (8) (or reset or zero-clear the corresponding variable area, storage area, etc.). In addition, the information r2, R1, R2, e, z1, z2, and z generated or acquired in the distributed signature creation process (8) may be deleted (or the corresponding variable area, storage area, etc., may be reset or zero-cleared) after sending the signature σ=(R,z) and message m to the verification device 140.

[0253] Figure 10 is a modified example of Figure 9, in which the signature σ (=(R, z)) is generated on the biometric signature generation device 130 side, and the signature σ and message m are transmitted from the biometric signature generation device 130 to the verification device 140. In the example of Figure 10, the signature / message transmission unit 127 of the key-based signature generation device 120 in Figure 8 is unnecessary, and instead, the biometric signature generation device 130 is provided with a signature / message transmission unit 139 (Figure 4). In Figure 10, steps (7A) to (7G) of the distributed signature generation process of the biometric signature generation device 130 are the same as steps (7A) to (7G) of the distributed signature generation process of the biometric signature generation device 130 in Figure 9. In step (7H) of the distributed signature generation process, z2 is received from the key-based signature generation device 120, and in step (7I), the distributed signature generation unit 138 of the biometric signature generation device 130 adds z2 to z1 to obtain z.

[0254] z:=r1+e*x'+r2+e*Δ =r1+r2+e*(Δ+x') =r1+r2+e*(Δ+(s-Δ)) =r1+r2+e*s mod L …(120)

[0255] (10) The signature and message transmission unit (139 in Figure 4) of the biometric signature generation device 130 transmits the signature σ=(R,z) and message m to the verification device 140.

[0256] The biometric signature generation device 130 and the key signature generation device 120 may each acquire the message m individually.

[0257] The biometric signature generator 130 transmits the hash value PH(m)=H'(m) of message m (used in the calculation of e=H(R,A,PH(m)) in step (7F)) to the key signature generator 120, which may use it in the calculation of the hash value in step (8F) (e=H(R,A,PH(m)).

[0258] The biometric key generation device 110 may temporarily send the first auxiliary key c and auxiliary data c1 to a device other than the key signature generation device 120, hold them in that device, and retrieve them each time a signature is generated by the key signature generation device 120 requesting retrieval from the other device.

[0259] The confidential information generation device 150 may send the confidential information to a device other than the key-based signature generation device 120, which will hold the information, and the key-based signature generation device 120 may retrieve the information by requesting it from the other device each time a signature is generated.

[0260] The verification device 140 may transmit the verification result to the biometric signature generation device 130, which is the source of the signature.

[0261] Figure 11 is a schematic diagram illustrating an example in which each device (110, 120, 130, 140, 150) of the digital signature system 100 described above is implemented using computers equipped with communication capabilities and capable of communicating with each other via a network. In Figure 11(A), each device (110, 120, 130, 140, 150) is equipped with a processor 201 (multiple processors are possible), a storage device 202, an input / output device 203, and a communication interface 204. The storage device 202 may be configured to include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), or an HDD (Hard Disk Drive), CD (Compact Disc), DVD (Digital Versatile Disc), etc. The processor 201 realizes the processing and functions of each device by executing a program (not shown) stored in the storage device 202. The input / output device 203 may be configured to include a keyboard and a display. For example, the key-based signature generation device 120 may be configured to display the verification result (accepted / rejected) from the verification device 140 on an output device such as a display. In addition, in the biometric key generation device 110 and biometric signature generation device 130 that acquire biometric information, the input device / output device 203 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) if the biometric information is a face, iris, etc., a fingerprint sensor if it is a fingerprint, or, for example, an LED (Light Emitting Diode) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger if it is a finger / palm vein. The sensor may be a removable sensor, such as a USB (Universal Serial Bus) device. The communication interface 204 may be configured to include a network interface card or transceiver, and communicate with each other via a LAN (Local Area Network), WAN (Wide Area Network) such as the Internet, wireless LAN, mobile communication network, etc.Furthermore, the communication interface 204 may be configured to have an interface in the biometric key generation device 110 and the biometric signature generation device 130 that communicates with an external sensor (for example, a Bluetooth® connected sensor) and receives biometric information acquired by the external sensor. Devices 110, 130, and 150 may be client devices (terminals), and device 120 may be a server device, such as a cloud server.

[0262] Figure 11(B) schematically illustrates an example in which one or more of the devices (110, 120, 130, 140, 150) of the digital signature system 100 described above are implemented as virtual machines of the virtualization system 300 using server virtualization technology. Multiple virtual machines (VMs) 303 operate on a virtualization infrastructure 302 such as a hypervisor implemented on a physical machine 301 such as a server device. One or more of the devices (110, 120, 130, 140, 150) of the digital signature system 100 may be implemented as virtual machines (VMs) 303. Although physically it is a single server, a virtual server environment in which multiple servers are running is provided. Each virtual machine (VM) 303 is preferably configured to operate in an isolated environment in memory space. In this case, a program that implements one of the processes of the devices (110, 120, 130, 140, 150) runs on the virtual operating system (OS) of the virtual machine VM. The virtual machine VM that virtually implements one of the devices (110, 120, 130, 140, 150) may be configured to communicate with other virtual machines via a virtual network, or it may be configured to communicate with other devices (110, 120, 130, 140, 150) via a physical interface (communication interface) of the physical machine 301, via a LAN, the Internet, or other WAN.

[0263] The first biological information w and the second biological information w' may be binary vectors, real vectors, or integer vectors.

[0264] [Reference 1] CRYPTREC EX-3002-2020, Eiichiro Fujisaki, "Investigation and Evaluation of the Security of the Structure of Digital Signature EdDSA", December 2020, [Retrieved June 10, 2024] Internet<URL:https: / / www.cryptrec.go.jp / exreport / cryptrec-ex-3002-2020.pdf> [Reference 2] Q. Feng, D. He, M. Luo, Z. Li and K. -KR Choo, "Practical Secure Two-Party EdDSA Signature Generation with Key Protection and Applications in Cryptocurrency," 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2020, pp. 137-147, 2020 [Reference document 3] Patent No. 5707311 [Reference 4] Lindell, Yehuda. "Fast secure two-party ECDSA signing." Advances in Cryptology-CRYPTO 2017: 37th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 20-24, 2017, Proceedings, Part II 37. Springer International Publishing, 2017

[0265] The embodiments described above may be further described as follows (but are not limited to the following):

[0266] (Note 1) The digital signature system comprises a first signature generating device and a second signature generating device, each equipped with at least a processor and a communication interface. The first signature generation device includes a first auxiliary key generated using first secret information and first biometric information corresponding to a verification key, auxiliary data generated using second secret information for distributed signature generation and the first biometric information, and third secret information for distributed signature generation. The process involves obtaining and storing the information, generating a second distributed key, and using the second distributed key and the third secret information, and sending and receiving information with the second signature generation device, to generate a second distributed signature for the message to be signed. The second signature generation device acquires the second biometric information, acquires the auxiliary data, recovers the second secret information using the second biometric information and the auxiliary data, generates a first distributed key, and uses the first distributed key and the second secret information, and sends and receives information with the first signature generation device, to generate a first distributed signature for the message. Either the first signature generation device or the second signature generation device, A signature for the message is generated using the first distributed signature and the second distributed signature, specifically the one generated by one device and the other generated by the other device.

[0267] (Note 2) In the digital signature system of Note 1, The aforementioned second signature generator, A second auxiliary key is generated using the first distributed key and the second biometric information. The second auxiliary key is transmitted to the first signature generation device. The first signature generation device, The second auxiliary key is received, and the second distributed key is generated using the first auxiliary key and the second auxiliary key.

[0268] (Note 3) In the digital signature system of Note 1, The first signature generation device, A second auxiliary key is generated using the aforementioned auxiliary data and the second distributed key. The second auxiliary key is transmitted to the second signature generation device. The aforementioned second signature generator, Having received the second auxiliary key, The first distributed key is generated using the second auxiliary key and the second biometric information.

[0269] (Note 4) In any of the digital signature systems described in Notes 1 to 3, Each comprises a key generation device and a secret information generation device, each equipped with at least a processor and a communication interface. The aforementioned key generation device is The first biological information described above is acquired, Generate the first secret information corresponding to the secret key, The verification key is generated from the first secret information and the base point of the elliptic curve. Using the first secret information and the first biometric information, the first auxiliary key is generated. The second confidential information is generated, and the auxiliary data is generated using the second confidential information and the first biometric information. The first auxiliary key and the auxiliary data are transmitted to the first signature generation device. The aforementioned confidential information generating device is Generate the third confidential information, and transmit the third confidential information to the first signature generation device. The first signature generation device, The first auxiliary key and the auxiliary data transmitted from the key generation device are received and stored in the first storage unit and the second storage unit, respectively. The third secret information transmitted from the secret information generation device is received and stored in the third storage unit.

[0270] (Note 5) In any of the digital signature systems described in Notes 1 to 3, The aforementioned second signature generator, The second confidential information and the first hash value relating to the message are obtained, The first hash value and the base point of the elliptic curve are used to calculate the first point of the elliptic curve. The first point of the elliptic curve is transmitted to the first signature generation device. A second hash value is obtained relating to the first point on the elliptic curve and the second point on the elliptic curve received from the first signature generator, the third point obtained by adding them together on the elliptic curve, the verification key, and the message. The first distributed signature is calculated as the sum of the first hash value and the value obtained by multiplying the second hash value by the first distributed key. The first signature generation device, A third hash value is obtained relating to the third secret information and the message. The second point of the elliptic curve is calculated from the third hash value and the base point of the elliptic curve. The second point of the elliptic curve is transmitted to the second signature generation device. A fourth hash value is obtained relating to the third point obtained by adding the first point and the second point on the elliptic curve received from the second signature generation device, the verification key, and the message. The second distributed signature is calculated as the sum of the third hash value and the value obtained by multiplying the fourth hash value by the second distributed key. The first signature generating device or the second signature generating device, A third value is obtained by adding the second value to the first value. The set of the third point and the third value of the elliptic curve is used as the signature for the message.

[0271] (Note 6) In the digital signature system of Note 5, the calculations for the first value, the second value, and the third value are performed using a modulo operation modulo the order of the base point of the elliptic curve.

[0272] (Note 7) In any of the digital signature systems described in Notes 1 to 6, a verification device is provided that verifies the signature on the message using the verification key, and the first signature generation device or the second signature generation device transmits the signature and the message to the verification device.

[0273] (Note 8) The digital signature method is: The first device is A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second device, a second distributed signature is generated for the message to be signed. The second device described above, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first device, a first distributed signature for the message is generated. Either the first device or the second device, A signature for the message is generated using the first distributed signature and the second distributed signature, specifically the one generated by one device and the other generated by the other device.

[0274] (Note 9) In the digital signature method of Note 8, The second apparatus described above is A second auxiliary key is generated using the first distributed key and the second biometric information. The second auxiliary key is transmitted to the first device. The first apparatus described above, The second auxiliary key is received, and the second distributed key is generated using the first auxiliary key and the second auxiliary key.

[0275] (Note 10) In the digital signature method of Note 8, The first apparatus described above, A second auxiliary key is generated using the aforementioned auxiliary data and the second distributed key. The second auxiliary key is transmitted to the second device. The second apparatus described above is Having received the second auxiliary key, The first distributed key is generated using the second auxiliary key and the second biometric information.

[0276] (Note 11) In any of the digital signature methods described in Notes 8 to 10, The third device is The first biological information described above is acquired, Generate the first secret information corresponding to the secret key, The verification key is generated from the first secret information and the base point of the elliptic curve. Using the first secret information and the first biometric information, the first auxiliary key is generated. The second confidential information is generated, and the auxiliary data is generated using the second confidential information and the first biometric information. The first auxiliary key and the auxiliary data are transmitted to the first device. The fourth device is, Generate the third confidential information, and transmit the third confidential information to the first device. The first apparatus described above, The first auxiliary key and the auxiliary data transmitted from the third device are received and stored in the first and second storage units, respectively. The third confidential information transmitted from the fourth device is received and stored in the third memory unit.

[0277] (Note 12) In any of the digital signature methods described in Notes 8 through 11, The second apparatus described above is The second confidential information and the first hash value relating to the message are obtained, The first hash value and the base point of the elliptic curve are used to calculate the first point of the elliptic curve. The first point of the elliptic curve is transmitted to the first device. A second hash value is obtained relating to the third point obtained by adding the first point on the elliptic curve and the second point on the elliptic curve received from the first device, the verification key, and the message. The first distributed signature is calculated as the sum of the first hash value and the value obtained by multiplying the second hash value by the first distributed key. The first apparatus described above, A third hash value is obtained relating to the third secret information and the message. The second point of the elliptic curve is calculated from the third hash value and the base point of the elliptic curve. The second point of the elliptic curve is transmitted to the second device. A fourth hash value is obtained relating to the third point obtained by adding the first point and the second point on the elliptic curve received from the second device, the verification key, and the message. The second distributed signature is calculated as the sum of the third hash value and the value obtained by multiplying the fourth hash value by the second distributed key. The first apparatus or the second apparatus, A third value is obtained by adding the second value to the first value. The set of the third point and the third value of the elliptic curve is used as the signature for the message.

[0278] (Note 13) In the digital signature method of Note 12, the calculations for the first value, the second value, and the third value are performed using a modulo operation modulo the order of the base point of the elliptic curve.

[0279] (Note 14) In any of the digital signature methods described in Notes 8 through 13, The first or second device transmits the signature and the message to a verification device that verifies the signature using the verification key.

[0280] (Note 15) Recording media are, A first auxiliary key generated using the first secret information and the first biometric information, Auxiliary data generated using the second confidential information and the first biometric information, The third secret piece of information, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second processing unit, a second distributed signature is generated for the message to be signed. A program that causes the first processing unit to execute the process, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first processing unit, a first distributed signature for the message is generated. A program that causes the second processing unit to execute the process, The first and second processing units record a program that causes the first or second processing unit to execute a process to generate a signature for the message using one of the first and second distributed signatures generated by its own unit, and the other of the first and second distributed signatures generated by the other of the first and second processing units.

[0281] (Note 16) The recording medium in Note 15 is A program that causes the second processing unit to perform the process of generating a second auxiliary key using the first distributed key and the second biometric information, and transmitting the second auxiliary key to the first processing unit, The system stores a program that causes the first processing unit to receive the second auxiliary key and generate the second distributed key using the first and second auxiliary keys.

[0282] (Note 17) The recording medium in Note 15 is A program that causes the first processing unit to execute a process of generating a second auxiliary key using the auxiliary data and the second distributed key, and transmitting the second auxiliary key to the second processing unit, The system records a program that causes the second processing unit to receive the second auxiliary key and generate the first distributed key using the second auxiliary key and the second biometric information.

[0283] Furthermore, the disclosures of the above-mentioned non-patent literature and references are incorporated herein by reference. Within the framework of the disclosure of this application (including the claims), further modifications, adjustments, and combinations of embodiments or examples are possible based on the fundamental technical concept. Also, within the framework of the claims of the present invention, various combinations or selections of various disclosed elements (including each element in each appendix, each element in each embodiment, each element in each drawing, etc.) are possible. In other words, this disclosure naturally includes the entire disclosure, including the claims, and various modifications and alterations that a person skilled in the art could make in accordance with the technical concept. [Explanation of Symbols]

[0284] 100 Digital Signature Systems 110. Bio-based key generation device 111 First biological information acquisition unit 112 Secret information generation section 113 Verification Key Generation Unit 114 Verification Key Transmission Unit 115 First auxiliary key generation unit 116 First auxiliary key transmission unit 117 Auxiliary Data Generation Unit 118 Auxiliary data transmission unit 120 Key-based signature generation device 120A Verification Key Acquisition Unit 120B Verification Key Storage Unit 121A First auxiliary key acquisition unit 121B First auxiliary key storage unit 122A Confidential Information Acquisition Department 122B Secret information storage section 123A Auxiliary data acquisition unit 123B Auxiliary data storage unit 123C Auxiliary Data Transmission Unit 124 Second auxiliary key / message acquisition unit 125 Second Distributed Key Generation Unit 126 Distributed signature generation unit 127 Signature / Message Sending Section 128A Message Acquisition Unit 129A Second auxiliary key generation unit 129B Second auxiliary key transmission unit 130 Biometric Signature Generation Device 131 Second biological information acquisition unit 132 Auxiliary data acquisition unit 133 Secret Information Restoration Unit 134, 134A Message acquisition unit 134B Message transmission unit 135 First Distributed Key Generation Unit 136 Second auxiliary key generation unit 137 Second auxiliary key / message transmission unit 137A Second auxiliary key acquisition unit 138 Distributed signature generation unit 139 Signature / Message Sending Section 140 Verification device 141 Verification Key Acquisition Unit 142 Verification Key Storage Unit 143 Signature and Message Acquisition Department 144 Signature Verification Department 150 Secret information generation device 151 Secret information generation section 152 Confidential Information Transmission Unit 200 Computer devices 201 Processor 202 Memory 203 Input / Output Devices 204 Communication Interface 300 virtualization systems 301 Physical Machines 302 Virtualization Infrastructure 303 Virtual Machines (VMs)

Claims

1. The system comprises a first signature generation device and a second signature generation device, each having at least a processor and a communication interface, The first signature generation device is A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second signature generation device, a second distributed signature is generated for the message to be signed. Execute the process, The second signature generation device described above is By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first signature generation device, a first distributed signature is generated for the message. Execute the process, Either the first signature generation device or the second signature generation device, A digital signature system that generates a signature for the message using one of the first distributed signatures and the second distributed signature, one generated by one of the devices and the other generated by the other device.

2. The second signature generation device described above is A second auxiliary key is generated using the first distributed key and the second biometric information. The second auxiliary key is transmitted to the first signature generation device. The first signature generation device is Having received the second auxiliary key, The digital signature system according to claim 1, wherein the second distributed key is generated using the first auxiliary key and the second auxiliary key.

3. The first signature generation device is A second auxiliary key is generated using the aforementioned auxiliary data and the second distributed key. The second auxiliary key is transmitted to the second signature generation device. The second signature generation device described above is Having received the second auxiliary key, The digital signature system according to claim 1, wherein the first distributed key is generated using the second auxiliary key and the second biometric information.

4. Each comprises a key generation device and a secret information generation device, each equipped with at least a processor and a communication interface. The aforementioned key generation device is The first biological information is acquired, Generate the first secret information corresponding to the secret key, The verification key is generated from the first secret information and the base point of the elliptic curve. Using the first secret information and the first biometric information, the first auxiliary key is generated. The second confidential information is generated, and the auxiliary data is generated using the second confidential information and the first biometric information. The first auxiliary key and the auxiliary data are transmitted to the first signature generation device. The aforementioned confidential information generating device is The third confidential information is generated, and the third confidential information is transmitted to the first signature generation device. The first signature generation device is The first auxiliary key and the auxiliary data transmitted from the key generation device are received and stored in the first storage unit and the second storage unit, respectively. The digital signature system according to claim 1, which receives the third confidential information transmitted from the confidential information generating device and stores it in the third storage unit.

5. The second signature generation device described above is The second secret information and the first hash value relating to the message are obtained, The first hash value and the base point of the elliptic curve are used to calculate the first point of the elliptic curve. The first point of the elliptic curve is transmitted to the first signature generation device. A second hash value is obtained relating to the first point on the elliptic curve and the second point on the elliptic curve received from the first signature generator, the third point obtained by adding the first point on the elliptic curve and the second point on the elliptic curve received from the first signature generator, the verification key, and the message. The first distributed signature is calculated as the sum of the first hash value and the value obtained by multiplying the second hash value by the first distributed key. The first signature generation device is A third hash value relating to the third secret information and the message is obtained, The second point of the elliptic curve is calculated from the third hash value and the base point of the elliptic curve. The second point of the elliptic curve is transmitted to the second signature generation device. A fourth hash value is obtained relating to the third point obtained by adding the first point and the second point on the elliptic curve received from the second signature generation device, the verification key, and the message. The second distributed signature is calculated as the sum of the third hash value and the value obtained by multiplying the fourth hash value by the second distributed key. The first signature generating device or the second signature generating device, A third value is obtained by adding the second value to the first value. The digital signature system according to claim 1, wherein the set of the third point and the third value of the elliptic curve is the signature for the message.

6. The digital signature system according to claim 5, wherein each of the operations for determining the first value, the second value, and the third value is performed using a modulo operation modulo the order of the base point of the elliptic curve.

7. The device includes a verification device that uses the verification key to verify the signature on the message, The digital signature system according to claim 1, wherein the first signature generating device or the second signature generating device transmits the signature and the message to the verification device.

8. The first device is A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second device, a second distributed signature is generated for the message to be signed. The second device described above, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first device, a first distributed signature for the message is generated. Either the first device or the second device, A digital signature method for generating a signature for a message using one of the first distributed signatures and the second distributed signature, one generated by one of the devices and the other generated by the other device.

9. The second apparatus described above is A second auxiliary key is generated using the first distributed key and the second biometric information. The second auxiliary key is transmitted to the first device. The first apparatus is The digital signature method according to claim 8, comprising receiving the second auxiliary key and generating the second distributed key using the first auxiliary key and the second auxiliary key.

10. The first apparatus is A second auxiliary key is generated using the aforementioned auxiliary data and the second distributed key. The second auxiliary key is transmitted to the second device. The second apparatus described above is Having received the second auxiliary key, The digital signature method according to claim 8, wherein the first distributed key is generated using the second auxiliary key and the second biometric information.

11. The third device is The first biological information is acquired, Generate the first secret information corresponding to the secret key, The verification key is generated from the first secret information and the base point of the elliptic curve. Using the first secret information and the first biometric information, the first auxiliary key is generated. The second confidential information is generated, and the auxiliary data is generated using the second confidential information and the first biometric information. The first auxiliary key and the auxiliary data are transmitted to the first device. The fourth device is, Generate the third confidential information, and transmit the third confidential information to the first device. The first apparatus is The first auxiliary key and the auxiliary data transmitted from the third device are received and stored in the first storage unit and the second storage unit, respectively. The digital signature method according to claim 8, comprising receiving the third confidential information transmitted from the fourth device and storing it in the third storage unit.

12. The second apparatus described above is The second secret information and the first hash value relating to the message are obtained, The first hash value and the base point of the elliptic curve are used to calculate the first point of the elliptic curve. The first point of the elliptic curve is transmitted to the first device. A second hash value is obtained relating to the third point obtained by adding the first point on the elliptic curve and the second point on the elliptic curve received from the first device, the verification key, and the message. The first distributed signature is calculated as the sum of the first hash value and the value obtained by multiplying the second hash value by the first distributed key. The first apparatus is A third hash value relating to the third secret information and the message is obtained, The second point of the elliptic curve is calculated from the third hash value and the base point of the elliptic curve. The second point of the elliptic curve is transmitted to the second device. A fourth hash value is obtained relating to the third point obtained by adding the first point and the second point on the elliptic curve received from the second device, the verification key, and the message. The second distributed signature is calculated as the sum of the third hash value and the value obtained by multiplying the fourth hash value by the second distributed key. The first apparatus or the second apparatus is A third value is obtained by adding the second value to the first value. The digital signature method according to claim 11, wherein the set of the third point and the third value of the elliptic curve is used as the signature for the message.

13. The digital signature method according to claim 12, wherein each of the operations for determining the first value, the second value, and the third value is performed using a modulo operation modulo the order of the base point of the elliptic curve.

14. The digital signature method according to claim 8, wherein the first or second device transmits the signature and the message to a verification device that verifies the signature using the verification key.

15. A first auxiliary key generated using the first secret information and the first biometric information corresponding to the verification key, Auxiliary data generated using the second secret information for distributed signature generation and the first biometric information, A third secret for distributed signature generation, Retrieve and store in memory, Generate a second distributed key, Using the second distributed key and the third secret information, and by sending and receiving information with the second processing device, a second distributed signature is generated for the message to be signed. A program that causes the first processing unit to execute the process, By acquiring a second set of biometric information, The aforementioned auxiliary data is obtained, The second confidential information is restored using the second biometric information and the auxiliary data. Generate the first distributed key, Using the first distributed key and the second secret information, and by sending and receiving information with the first processing unit, a first distributed signature for the message is generated. A program that causes a second processing unit to execute the processing, Either the first processing apparatus or the second processing apparatus, A recording medium that records a program that causes the first or second processing unit to execute a process of generating a signature for the message using one of the first and second distributed signatures, which is generated by one of the devices and which is generated by the other device.

16. A program that causes the second processing unit to execute a process of generating a second auxiliary key using the first distributed key and the second biometric information, and transmitting the second auxiliary key to the first processing unit, A recording medium according to claim 15, which records a program that causes the first processing unit to receive the second auxiliary key and generate the second distributed key using the first auxiliary key and the second auxiliary key.

17. A program that causes the first processing unit to execute a process of generating a second auxiliary key using the auxiliary data and the second distributed key, and transmitting the second auxiliary key to the second processing unit, A recording medium according to claim 15, which records a program that causes the second processing unit to receive the second auxiliary key and generate the first distributed key using the second auxiliary key and the second biometric information.

Images