Apparatus, system, method, and program

Abstract

To achieve MU-sEUF secure digital signatures from MU-EUF secure digital signatures. [Solution] An apparatus according to one aspect of the present disclosure is an apparatus that signs a first digital signature representing an MU-sEUF secure digital signature, comprising: a key generation unit that generates a verification key pk for a second digital signature representing an MU-EUF secure digital signature and a public key cpk for a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and a private key sk for the second digital signature and a private key csk for the chameleon commitment as the private key sk' of the first digital signature; and a signature generation unit that uses the private key sk and the public key cpk to generate a signature σ' of the first digital signature for a message m to be signed, wherein the signature generation unit generates a signature σ of the second digital signature for a predetermined value commitment c using the public key cpk and a random number r, and a random number r' whose commitment to the hash value of a bit sequence concatenating the verification key pk, the message m to be signed, and the signature σ as the signature σ'.

Description

Technical Field

[0001] The present disclosure relates to an apparatus, a system, a method, and a program.

Background Art

[0002] As the security of an electronic signature, EUF (existential unforgeability) (Non-Patent Document 1) is known, and as stronger security, sEUF (strong existential unforgeability) (Non-Patent Document 2) is known. Further, as variations of EUF, MU-EUF (multi-user existential unforgeability) that captures the case where there are multiple users to be attacked and MU-sEUF (multi-user strong existential unforgeability) with stronger security are known.

[0003] In the field of cryptography, a method of converting a protocol with weak security into a protocol with stronger security has been actively studied. For example, a method of converting an EUF-secure electronic signature into an sEUF-secure electronic signature has been proposed for an electronic signature (Non-Patent Document 3). In the method proposed in Non-Patent Document 3, in constructing an sEUF-secure electronic signature, in addition to an EUF-secure electronic signature, a primitive called a chameleon commitment (Non-Patent Document 4) is used as a component.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

[0005] However, there is no method to convert an MU-EUF secure digital signature to an MU-sEUF secure digital signature.

[0006] This disclosure is made in view of the above points and aims to realize MU-sEUF secure electronic signatures from MU-EUF secure electronic signatures. [Means for solving the problem]

[0007] An apparatus according to one aspect of the present disclosure is an apparatus that signs a first digital signature representing an MU-sEUF secure digital signature, comprising: a key generation unit that generates a verification key pk for a second digital signature representing an MU-EUF secure digital signature and a public key cpk for a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and a private key sk for the second digital signature and a private key csk for the chameleon commitment as the private key sk' of the first digital signature; and a signature generation unit that uses the private key sk and the public key cpk to generate a signature σ' of the first digital signature for a message m to be signed, wherein the signature generation unit generates a signature σ of the second digital signature for a predetermined value commitment c using the public key cpk and a random number r, and a random number r' whose commitment to the hash value of a bit sequence concatenating the verification key pk, the message m to be signed, and the signature σ as the signature σ'. [Effects of the Invention]

[0008] MU-EUF secure digital signatures can be transformed into MU-sEUF secure digital signatures. [Brief explanation of the drawing]

[0009] [Figure 1] This diagram shows the relationships between different levels of security in electronic signatures. [Figure 2] This figure shows an example of the overall configuration of the electronic signature system according to this embodiment. [Figure 3] This figure shows an example of the functional configuration of the signatory device according to this embodiment. [Figure 4] This figure shows an example of the functional configuration of the verifier device according to this embodiment. [Figure 5] This sequence diagram shows an example of the operation of the electronic signature system according to this embodiment. [Figure 6] This is a diagram showing an example of the hardware configuration of a computer.

Embodiment for Carrying Out the Invention

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Security of Electronic Signatures> An electronic signature is a mechanism for guaranteeing the creator of an electronic document (hereinafter simply referred to as a "document" or "message") or for guaranteeing that the document has not been tampered with. Generally, an electronic signature is composed of three algorithms: a key generation algorithm Gen, a signature algorithm Sig, and a verification algorithm Ver. In the key generation algorithm Gen, a verification key pk and a secret key sk are output with a security parameter 1 λ as an input. In the signature algorithm Sig, a signature σ is output with the secret key sk and the document m as inputs. In the verification algorithm Ver, an accept representing acceptance of the signature σ or a reject representing rejection is output with the verification key pk, the document m, and the signature σ as inputs.

[0012] ≪EUF≫ There is EUF as a security that an electronic signature should basically satisfy (Non-Patent Document 1). Briefly stated, EUF means that even when an attacker knows the verification key pk of a certain user U and the signatures σ1,..., σ n by the user U for several documents m1,..., m n , it is a security such that (m * , σ * ) cannot be forged to satisfy the following.

[0013] ∀i ∈ [1, n], m * ≠m i Ver(pk, m * , σ * ) = accept That is, EUF is a signature σ for a new document m * ​* It guarantees that it cannot be counterfeited.

[0014] ≪sEUF≫ sEUF offers stronger security than EUF (Non-Patent Document 2). In sEUF, similar to EUF, a user U's verification key pk and (m1, σ1), ..., (m n ,σ n Assume that the attacker knows m. i is a document, σ i is document m i This is user U's signature for [the item].

[0015] At this time, sEUF is such that (m * ,σ * This level of security means that it cannot be counterfeited.

[0016] ∀i∈[1,n],(m * ,σ * )≠(m i ,σ i ) Ver(pk,m * ,σ * )=accept In other words, sEUF, in addition to EUF, existing documents m * =m i σ i Other signatures σ * It also guarantees that it cannot be counterfeited.

[0017] ≪MU-EUF≫ As a variation of EUF, there is MU-EUF, which captures cases where there are multiple target users. In MU-EUF, the attacker targets each user U1,...,U N Verification key pk1,···,pk N And, document m1,···,m n User U j_1 ,···,U j_n Signature σ1,···,σ n Assume that you know that. However, "j_i" is "j i This means "σ iis document m i User U j_i This is the signature. Also, j1,···,j n The order is ∈[1,N].

[0018] At this time, MU-EUF is determined if the attacker satisfies the following conditions (j * ,m * ,σ * It is secure, meaning it cannot be forged.

[0019] ∀i∈[1,n],(j * ,m * )≠(j i ,m i ) Ver(pk j^* ,m * ,σ * )=accept However, "j^*" is "j * This is intended to mean "[...]. Note that when N=1, the safety level is the same as EUF.

[0020] ≪MU-sEUF≫ Similar to sEUF as a counterpart to EUF, MU-sEUF offers stronger security than MU-EUF. In MU-sEUF, as with MU-EUF, each user U1,...,U N Verification key pk1,···,pk N And, (j1,m1,σ1),···,(j n ,m n ,σ n Assume that the attacker knows m. i is a document, σ i is document m i User U j_i This is a signature.

[0021] At this time, MU-sEUF is such that (j * ,m * ,σ * It is secure, meaning it cannot be forged.

[0022] ∀i∈[1,n],(j * ,m* ,σ * )≠(j i ,m i ,σ i ) Ver(pk j^* ,m * ,σ * )=accept Note that when N=1, the safety level is the same as sEUF.

[0023] <Relationship of different security levels in electronic signatures> As shown in Figure 1, MU-EUF is more secure than EUF, and MU-sEUF is more secure than sEUF. Furthermore, sEUF is more secure than EUF, and MU-sEUF is more secure than MU-EUF. In addition, Non-Patent Document 3 describes a method for converting an EUF-secure digital signature to an sEUF-secure digital signature.

[0024] On the other hand, there is no method to convert an MU-EUF secure digital signature to an MU-sEUF secure digital signature (i.e., a method to construct an MU-sEUF secure digital signature from an MU-EUF secure digital signature).

[0025] Therefore, we propose the following method for constructing an MU-sEUF secure digital signature from an MU-EUF secure digital signature.

[0026] <Proposed method> The following describes a method for constructing an MU-sEUF secure digital signature, using MU-EUF secure digital signatures and key-unilateral attack-secure chameleon commitments (Non-Patent Literature 4) as components. Key-unilateral attack security means that it is secure when the attacker only knows the public key (public key cpk, described later).

[0027] ≪Components of the proposed method≫ MU-EUF Secure Electronic Signature Σ=(Gen,Sig,Ver) The MU-EUF secure digital signature Σ consists of the following three algorithms: the key generation algorithm Gen, the signature algorithm Sig, and the verification algorithm Ver.

[0028] Gen(1 λ )→(pk,sk): The key generation algorithm Gen has security parameter 1 λ It takes the input as input and outputs the verification key pk and the private key sk.

[0029] Sig(sk,m)→σ: The signature algorithm Sig takes a private key sk and a document m as input and outputs a signature σ for that document m.

[0030] Ver(pk,m,σ)→accept / reject: The Verification Algorithm Ver takes the Verification Key pk, Document m, and Signature σ as input and outputs either accept (receiving the signature σ) or reject (rejecting it).

[0031] Key-based one-man attack-safe chameleon commitment Ω=(Cgen,Com,Cham) The key-one-key-attack-safe chameleon commitment Ω consists of three algorithms: the key generation algorithm Cgen, the commitment algorithm Com, and the chameleon algorithm Cham.

[0032] Cgen(1 λ )→(cpk,csk): The key generation algorithm Cgen has security parameter 1 λ It takes the input as input and outputs the public key (cpk) and private key (csk).

[0033] The Com(cpk,m,r)→c commitment algorithm takes the public key cpk, message m, and random number r as input and outputs a commitment c.

[0034] Cham(csk,m,r,m')→r' st Com(cpk,m,r)=Com(cpk,m',r'): The Chameleon algorithm Cham takes a secret key csk, a message m, a random number r, and a message m' as input and outputs a random number r' that satisfies Com(cpk,m,r)=Com(cpk,m',r').

[0035] ≪Configuration of MU-sEUF Secure Electronic Signature Related to the Proposed Method≫ Using MU-EUF-secure digital signature Σ and key-unilateral attack-secure chameleon commitment Ω as components, MU-sEUF-secure digital signature Σ'=(Gen',Sig',Ver') is constructed as follows.

[0036] • Key generation algorithm Gen'(1 λ )→(pk',sk') The key generation algorithm Gen' has security parameter 1 λ Using the input, the verification key pk' and private key sk' are output by following steps 11 to 13.

[0037] Step 11: Gen(1 λ )→(pk,sk) Step 12: Cgen(1 λ )→(cpk,csk) Step 13: Output pk'=(pk,cpk) and sk'=(sk,csk).

[0038] • Signature algorithm Sig'(sk',m)→σ' The signature algorithm Sig' takes the private key sk' and document m as input and outputs a signature σ' for document m according to steps 21 to 25 below. More precisely, the signature algorithm Sig' also takes the public key cpk as input, but in the following, the statement that the public key cpk is input will be omitted. Furthermore, H is the hash function from a bit string of arbitrary length to the message space (document space). In addition, the concatenation of bit strings will be represented by "||".

[0039] Step 21: Randomly select r Step 22: Com(cpk,0,r)→c Step 23: Sig(sk,c)→σ Step 24: Cham(csk,0,r,H(pk||m||σ))→r' Step 25: Output σ'=(σ,r').

[0040] • Verification algorithm Ver'(pk',m,σ') → accept / reject The verification algorithm Ver' takes the verification key pk', document m, and signature σ' as input and outputs either accept or reject according to steps 31-32 below.

[0041] Step 31: Com(cpk,H(pk||m||σ),r')→c Step 32: Output Ver(pk,c,σ).

[0042] The following describes the electronic signature system 1 that implements MU-sEUF-secure electronic signatures related to the proposed method described above. In the following, the user who executes the key generation algorithm Gen' and the signature algorithm Sig' will be referred to as the "signer," and the user who executes the verification algorithm Ver' will be referred to as the "verifier."

[0043] <Example of the overall configuration of Electronic Signature System 1> As shown in Figure 2, the electronic signature system 1 according to this embodiment includes a signer device 10 and a verifier device 20. The signer device 10 and the verifier device 20 are connected to each other via a communication network 30, such as the Internet.

[0044] The signer device 10 is a device that acts as a signer for the MU-sEUF secure electronic signature related to the proposed method. Examples of signer devices 10 include PCs (personal computers), smartphones, tablet devices, wearable devices, general-purpose servers, game consoles, digital home appliances, and in-vehicle devices.

[0045] The verifier device 20 is a device that acts as a verifier for the MU-sEUF secure electronic signature related to the proposed method. Examples of verifier devices 20 include PCs, smartphones, tablet devices, wearable devices, general-purpose servers, game consoles, digital home appliances, in-vehicle devices, etc.

[0046] <Example of functional configuration of signer device 10 and verifier device 20> ≪Signer device 10≫ As shown in Figure 3, the signer device 10 according to this embodiment includes a communication unit 101, a key generation unit 102, a signature generation unit 103, and a storage unit 104. The communication unit 101, the key generation unit 102, and the signature generation unit 103 are realized, for example, by a process in which one or more programs installed in the signer device 10 are executed by a processor (arithmetic unit) such as a CPU (Central Processing Unit). The storage unit 104 is realized, for example, by the storage area of ​​a storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory.

[0047] The communication unit 101 transmits the verification key pk' to the verifier device 20, and also transmits the document m and signature σ' to the verifier device 20.

[0048] The key generation unit 102 generates a verification key pk' and a secret key sk' by executing the key generation algorithm Gen'.

[0049] The signature generation unit 103 generates a signature σ' by executing the signature algorithm Sig'.

[0050] The memory unit 104 stores various information (e.g., security parameter 1). λ It stores the verification key pk', the private key sk', the document m, etc.

[0051] ≪Verifier Device 20≫ As shown in Figure 4, the verifier device 20 according to this embodiment includes a communication unit 201, a signature verification unit 202, and a storage unit 203. The communication unit 201 and the signature verification unit 202 are implemented, for example, by a process in which one or more programs installed on the verifier device 20 are executed by a processor (arithmetic unit) such as a CPU. The storage unit 203 is implemented, for example, by the storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0052] The communication unit 201 receives the verification key pk' from the signer device 10, and also receives the document m and signature σ' from the signer device 10.

[0053] The signature verification unit 202 verifies the signature σ' by executing the verification algorithm Ver'.

[0054] The memory unit 203 stores various types of information (e.g., verification key pk', document m, signature σ', etc.).

[0055] <Example of operation of Electronic Signature System 1> The operation example of the electronic signature system 1 according to this embodiment will be described below with reference to Figure 5.

[0056] The key generation unit 102 of the signer device 10 generates a verification key pk' and a private key sk' by executing the key generation algorithm Gen' (step S101). That is, the key generation unit 102 generates a security parameter 1 λ Using the input, the verification key pk' and private key sk' are output according to steps 11 to 13 above.

[0057] The key generation unit 102 of the signer device 10 stores the verification key pk' and private key sk' generated in step S101 in the storage unit 104 (step S102).

[0058] The communication unit 101 of the signer device 10 transmits the verification key pk' generated in step S101 above to the verifier device 20 (step S103).

[0059] The communication unit 201 of the verifier device 20 receives the verification key pk' transmitted in step S103 (step S104).

[0060] The communication unit 201 of the verifier device 20 stores the verification key pk' received in step S104 in the storage unit 203 (step S105).

[0061] The signature generation unit 103 of the signer device 10 generates a signature σ' by executing the signature algorithm Sig' (step S106). That is, the signature generation unit 103 takes the private key sk' and the document m to be signed as input and outputs a signature σ' for the document m according to the above steps 21 to 25.

[0062] The communication unit 101 of the signer device 10 transmits the pair (m,σ') of document m and σ' generated in step S106 above to the verifier device 20 (step S107).

[0063] The communication unit 201 of the verifier device 20 receives (m,σ') transmitted in step S107 above (step S108).

[0064] The communication unit 201 of the verifier device 20 stores (m,σ') received in step S108 above in the storage unit 203 (step S109). However, (m,σ') may be stored only if step S110, described later, is performed first and the signature σ' is accepted.

[0065] The signature verification unit 202 of the verifier device 20 verifies the signature σ' by executing the verification algorithm Ver' (step S110). That is, the signature verification unit 202 takes the verification key pk', document m, and signature σ' as input and outputs either accept, indicating acceptance of the signature σ', or reject, indicating rejection, according to the above steps 31 to 32.

[0066] <Example Hardware Configuration> The signer device 10 and the verifier device 20 according to this embodiment can be realized, for example, by the hardware configuration of the computer 500 shown in Figure 6.

[0067] The computer 500 shown in Figure 6 includes an input device 501, a display device 502, an external interface 503, a communication interface 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these hardware components is connected to the others via a bus 509 for communication.

[0068] The input device 501 is, for example, a keyboard, mouse, touch panel, physical buttons, etc. The display device 502 is, for example, a display, display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502.

[0069] External I / F 503 is an interface with external devices such as recording media 503a. Examples of recording media 503a include CD (Compact Disc), DVD (Digital Versatile Disk), SD memory card (Secure Digital memory card), and USB (Universal Serial Bus) memory card.

[0070] The communication interface 504 is an interface for connecting to the communication network 30. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is an arithmetic unit such as a CPU.

[0071] Note that the hardware configuration of computer 500 shown in Figure 6 is just one example and is not limited to it. For example, computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, it may not have some of the hardware shown, or it may have various other hardware components besides the hardware shown.

[0072] <Summary> As described above, the electronic signature system 1 according to this embodiment can realize an MU-sEUF secure electronic signature, which consists of an MU-EUF secure electronic signature and a key-unilateral attack-secure chameleon commitment. Therefore, by using the electronic signature system 1 according to this embodiment, when an MU-EUF secure electronic signature is available, it is possible to enhance the security of that electronic signature from MU-EUF to MU-sEUF. This makes it possible to realize an electronic signature with higher security.

[0073] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of Symbols]

[0074] 1. Electronic Signature System 10 Signer device 20 Verifier device 30 Communication Networks 101 Communications Department 102 Key generation section 103 Signature generation section 104 Storage section 201 Communications Department 202 Signature Verification Department 203 Storage section 500 Computers 501 Input device 502 Display device 503 External I / F 503a Recording medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 Processors Bus 509

Claims

1. A device that acts as a signer of a first electronic signature representing a secure electronic signature, A key generation unit generates the verification key pk of a second digital signature representing a MU-EUF secure digital signature and the public key cpk of a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and the private key sk of the second digital signature and the private key csk of the chameleon commitment as the private key sk' of the first digital signature. A signature generation unit that generates the signature σ' of the first digital signature for the message m to be signed using the private key sk and the public key cpk, It has, The signature generation unit, The signature σ of the second digital signature is generated as the public key cpk and random number r, and the signature σ' is generated as the random number r' whose commitment to the hash value of the bit sequence obtained by concatenating the verification key pk, the message m to be signed, and the signature σ is c. Device.

2. A device that acts as a verifier for a first electronic signature representing a secure electronic signature, A signature verification unit that verifies the signature σ' using the verification key pk' of the first digital signature, the message m, and the signature σ' of the first digital signature. It has, The aforementioned signature σ' includes the signature σ of a second digital signature representing a MU-EUF secure digital signature, and a random number r'. The signature verification unit said, Using the public key cpk of a key-one-attack-safe chameleon commitment and the random number r', a commitment c is generated, which is a hash value of a bit sequence obtained by concatenating the verification key pk of the second digital signature, the message m, and the signature σ of the second digital signature contained in the signature σ'. The signature σ is verified using the second digital signature, with the verification key pk, the commitment c, and the signature σ. Device.

3. A system comprising a first device that acts as a signer of a first electronic signature representing a secure electronic signature, and a second device that acts as a verifier of the first electronic signature, The first apparatus is A key generation unit generates the verification key pk of a second digital signature representing a MU-EUF secure digital signature and the public key cpk of a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and the private key sk of the second digital signature and the private key csk of the chameleon commitment as the private key sk' of the first digital signature. The system includes a signature generation unit that generates a signature σ' of the first digital signature for the message m to be signed using the private key sk and the public key cpk, The second apparatus described above is The system includes a signature verification unit that verifies the signature σ' using the verification key pk' of the first digital signature, the message m, and the signature σ' of the first digital signature, The signature generation unit, The signature σ of the second digital signature is generated as the signature σ of the commitment c of a predetermined value using the public key cpk and random number r, and the random number r' is generated as the signature σ', such that the commitment of the hash value of the bit sequence obtained by concatenating the verification key pk, the message m to be signed, and the signature σ is c. The signature verification unit said, Using the public key cpk and the random number r', a commitment c is generated, which is a hash value of a bit sequence concatenated with the verification key pk, the message m, and the signature σ. The signature σ is verified using the second digital signature, with the verification key pk, the commitment c, and the signature σ. system.

4. The system according to claim 3, wherein the hash value of the bit string obtained by concatenating the verification key pk, the message m to be signed, and the signature σ is calculated by a hash function from a bit string of arbitrary length to the message space.

5. The computer that becomes the signer of the first digital signature representing the secure digital signature of MU-sEUF, A key generation procedure that generates the verification key pk of a second digital signature representing a MU-EUF secure digital signature and the public key cpk of a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and the private key sk of the second digital signature and the private key csk of the chameleon commitment as the private key sk' of the first digital signature, A signature generation procedure that generates the signature σ' of the first digital signature for the message m to be signed using the private key sk and the public key cpk, Execute, The signature generation procedure described above is: The signature σ of the second digital signature is generated as the public key cpk and random number r, and the signature σ' is generated as the random number r' whose commitment to the hash value of the bit sequence obtained by concatenating the verification key pk, the message m to be signed, and the signature σ is c. method.

6. The computer that acts as the verifier of the first digital signature representing the secure digital signature of MU-sEUF, A signature verification procedure that verifies the signature σ' using the verification key pk' of the first digital signature, the message m, and the signature σ' of the first digital signature, Execute, The aforementioned signature σ' includes the signature σ of a second digital signature representing a MU-EUF secure digital signature, and a random number r'. The aforementioned signature verification procedure is: Using the public key cpk of a key-one-attack-safe chameleon commitment and the random number r', a commitment c is generated, which is a hash value of a bit sequence obtained by concatenating the verification key pk of the second digital signature, the message m, and the signature σ of the second digital signature contained in the signature σ'. The signature σ is verified using the second digital signature, with the verification key pk, the commitment c, and the signature σ. method.

7. A method used in a system comprising a first device that acts as a signer of a first electronic signature representing a secure electronic signature of MU-sEUF, and a second device that acts as a verifier of the first electronic signature, The first apparatus is, A key generation procedure that generates the verification key pk of a second digital signature representing a MU-EUF secure digital signature and the public key cpk of a key-one-attack secure chameleon commitment as the verification key pk' of the first digital signature, and the private key sk of the second digital signature and the private key csk of the chameleon commitment as the private key sk' of the first digital signature, A signature generation procedure is performed to generate a signature σ' of the first digital signature for the message m to be signed, using the private key sk and the public key cpk. The second device described above, A signature verification procedure is performed to verify the signature σ' using the verification key pk' of the first digital signature, the message m, and the signature σ' of the first digital signature. The signature generation procedure described above is: The signature σ of the second digital signature is generated as the signature σ of the commitment c of a predetermined value using the public key cpk and random number r, and the random number r' is generated as the signature σ', such that the commitment of the hash value of the bit sequence obtained by concatenating the verification key pk, the message m to be signed, and the signature σ is c. The aforementioned signature verification procedure is: Using the public key cpk and the random number r', a commitment c is generated, which is a hash value of a bit sequence concatenated with the verification key pk, the message m, and the signature σ. The signature σ is verified using the second digital signature, with the verification key pk, the commitment c, and the signature σ. method.

8. A program that causes a computer to function as the device described in claim 1 or 2.

Images