Aggregate signature certification system, aggregate signature certification method, program

Abstract

This system provides aggregated signature certification to prevent third parties from impersonating the legitimate issuer of signatures before aggregation. [Solution] An aggregated signature certification system including a signature issuing device, an aggregation device, and a verification device, wherein the aggregation device includes a signature aggregation unit that receives signature groups from a plurality of signature issuing devices, issues an aggregated signature based on the received signature groups, and transmits it to a verification device, and a commitment generation unit that generates a commitment based on the received signature groups and the public keys corresponding to the received signature groups, transmits it to a verification device as a first commitment, and transmits the generated commitment to the verification device as a second commitment when a challenge request is received from the verification device, and the verification device includes an aggregated signature verification unit that verifies the received aggregated signature, and a commitment verification unit that transmits a challenge request and verifies whether the second commitment matches the first commitment.

Description

[Technical Field]

[0001] This disclosure relates to an aggregate signature certification system, an aggregate signature certification method, and a program. [Background technology]

[0002] To reduce signature size and improve verification efficiency, multiple signatures (σ1, σ2, σ3, ...) are combined into a single signature (σ) as shown in Figure 1. agg A technology called aggregated signatures, which consolidates signatures into a single signature, is attracting attention.

[0003] Several conventional aggregate signature methods have been identified as susceptible to key substitution attacks, where a key can be created that allows signature verification to pass even with a key other than the true key and plaintext for the pre-aggregation signatures σ1, σ2, σ3, ... (Non-Patent Literature 1). A key substitution attack can then cause the aggregated signatures σ agg A third party could impersonate the legitimate issuer of the pre-aggregation signatures σ1, σ2, σ3, ... [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yuuki Fujita et al. “On Key Substitution Attacks against Aggregate Signatures and Multi-Signatures”, [online], 2024, Cryptology ePrint Archive, [Retrieved December 9, 2024], Internet <URL:https: / / eprint.iacr.org / 2024 / 1728> [Overview of the project] [Problems that the invention aims to solve]

[0005] Conventional aggregate signatures have suffered from the lack of a mechanism to prevent key substitution attacks. Therefore, this disclosure aims to provide an aggregate signature certification system that prevents third parties from impersonating the legitimate issuer of the signatures before aggregation. [Means for solving the problem]

[0006] The aggregated signature certification system described herein includes a signature issuing device, an aggregation device, and a verification device.

[0007] The aggregation device includes a signature aggregation unit and a commitment generation unit. The verification device includes an aggregated signature verification unit and a commitment verification unit.

[0008] The signature aggregation unit receives signature groups from multiple signature issuing devices, issues an aggregated signature based on the received signature group, and transmits it to the verification device.

[0009] The commitment generation unit generates a commitment based on the received signature group and the public key corresponding to the received signature group, and sends it to the verification device as a first commitment. If a challenge request is received from the verification device, the generated commitment is sent to the verification device as a second commitment.

[0010] The aggregate signature verification unit verifies the received aggregate signature.

[0011] The commitment verification unit sends a challenge request and verifies whether the second commitment matches the first commitment. [Effects of the Invention]

[0012] The aggregated signature certification system described in this disclosure can prevent third parties from impersonating the legitimate issuer of signatures prior to aggregation. [Brief explanation of the drawing]

[0013] [Figure 1] A diagram illustrating the processing overview of a conventional aggregate signature system. [Figure 2]A diagram showing an overview of the processing of the aggregated signature certification system of Example 1. [Figure 3] A diagram showing the device configuration of the aggregated signature certification system of Example 1. [Figure 4] A sequence diagram showing the operation of the aggregated signature certification system of Example 1. [Figure 5] A diagram showing an example of the functional configuration of a computer.

Modes for Carrying Out the Invention

[0014] Hereinafter, embodiments of the present disclosure will be described in detail. Components having the same function are denoted by the same reference numerals, and redundant descriptions are omitted.

Examples

[0015] Hereinafter, an overview of the processing of the aggregated signature certification system of Example 1 will be described with reference to FIG. 2. As illustrated in the figure, an aggregator (Holder) receives messages m1, m2, m3,... and signature groups σ1, σ2, σ3,... generated by a plurality of signature issuing devices, and aggregates the signature groups σ1, σ2, σ3,... to issue an aggregated signature σ agg for issuance.

[0016] When aggregating the signature groups σ1, σ2, σ3,..., the aggregator (Holder) also generates a commitment C, transmits it together with the aggregated signature σ agg to a verification device (Verifier), and holds the commitment C.

[0017] When the aggregator (Holder) receives a challenge request from the verification device (Verifier), it transmits the held commitment C to the verification device (Verifier). The challenge request is generated when a person who claims to be a legitimate signature issuer for the pre-aggregation signature appears.

[0018] The verification device (Verifier) can detect an illegal process of forging a legitimate signature issuer for the pre-aggregation signature by verifying the consistency of the two transmitted commitments C.

[0019] As described above, by configuring the aggregated signature certification system, it becomes possible to correctly assert the issuer of the signatures before aggregation, and it is possible to prevent third parties from impersonating the legitimate issuer of the signatures before aggregation.

[0020] This prevents attacks that impersonate signature issuers, such as key substitution attacks. The aggregate signature certification system of this embodiment can create assertable aggregate signatures for any aggregate signature scheme.

[0021] Furthermore, the aggregate signature certification system of this embodiment is highly efficient because it can create a valid aggregate signature by holding only one value (commitment) on a finite field.

[0022] Furthermore, in technological fields requiring proof for arbitrary data, such as Verifiable Credentials, this system can be used with vast amounts of data, such as SNS "like" history, to create VCs that can assert their reliability more effectively than conventional technologies.

[0023] The device configuration of the aggregate signature certification system 1 of this embodiment will now be described with reference to Figure 3. As shown in the figure, the aggregate signature certification system 1 includes a key issuing device 11, a signature issuing device 12, an aggregation device 17, and a verification device 18. The aggregation device 17 includes a signature aggregation unit 13 and a commitment generation unit 14, and the verification device 18 includes an aggregate signature verification unit 15 and a commitment verification unit 16.

[0024] In this embodiment, there are T signature issuing devices 12 (where T is an integer greater than or equal to 2), and these are also referred to as signature issuing devices 12-1, ..., 12-T. However, when describing processes and operations common to all signature issuing devices 12-1, ..., 12-T, the descriptions will refer to the processes and operations of signature issuing device 12-t (where t=1, ..., T).

[0025] Note that the functions of the signature aggregation unit 13 and the commitment generation unit 14 may be realized as devices different from the aggregation device 17. For example, the function of the signature aggregation unit 13 may be realized as a signature aggregation device 13, and the function of the commitment generation unit 14 may be realized as a commitment generation device 14.

[0026] Also, the functions of the aggregated signature verification unit 15 and the commitment verification unit 16 may be realized as devices different from the verification device 18. For example, the function of the aggregated signature verification unit 15 may be realized as an aggregated signature verification device 15, and the function of the commitment verification unit 16 may be realized as a commitment verification device 16.

[0027] Hereinafter, an example in which the aggregated signature proof system 1 includes the key issuance device 11, the signature issuance device 12, the aggregation device 17, and the verification device 18 will be described. Note that by reading the "… unit" of 13 - 16 as "… device", it becomes equivalent to a configuration including six devices of 11 - 16.

[0028] First, the key issuance device 11 issues secret keys sk1,..., sk t ,..., sk T to each of the signature issuance devices 12-1,…,12-t,…,1 2-T, and transmits the secret keys sk 1,..,.sk t ,..., sk T and messages m1,..., m t ,..., m T to the corresponding signature issuance devices 12-1,…,12-t,…,12-T (S11).

[0029] The signature issuance device 12-t receives the secret key sk t and the message m t , and issues a signature σ t from the secret key sk t and the message m t and transmits it to the aggregation device 17 (S12).

[0030] The signature aggregation unit 13 of the aggregation device 17 receives a signature group σ1,..., σ t,...,σ T Received, received signature group σ1,...,σ t ,...,σ T Aggregate and create an aggregated signature σ agg The system issues a signal and sends it to the verification device 18 (S13).

[0031] The commitment generation unit 14 of the aggregation device 17 processes the received signature group σ1,...,σ t ,...,σ T The received signature group σ1,...,σ t ,...,σ T Corresponding public keys pk1,...,pk t ,...,pk T Based on this, a commitment C is generated and sent to the verification device 18 as the first commitment (S14-1). If a challenge request (required when someone claims to be the legitimate signatory for the signatures before aggregation) is received from the verification device 18, the generated commitment C is sent to the verification device 18 as the second commitment (S14-2).

[0032] A commitment may be generated by hashing each signature and each public key, for example, as shown in the following formula.

number

[0033] The aggregate signature verification unit 15 of the verification device 18 performs aggregate signature σ agg Received the aggregated signature σ agg Verify this (S15).

[0034] The commitment verification unit 16 of the verification device 18 receives the first commitment and sends a challenge request to the aggregation device 17 when a person claims to be the legitimate signatory to the signatures before aggregation (S16-1), receives the second commitment, and verifies whether the second commitment matches the first commitment (S16-2).

[0035] Specifically, for example, the commitment verification unit 16 executes an algorithm that outputs True if C1 = C2, assuming the first commitment is C1 and the second commitment is C2, and False otherwise. If True is output, it indicates that the claimant is true, and if False is output, it indicates that the claimant is false.

[0036] According to the aggregated signature certification system 1 of this embodiment, the aggregation device 17 issues an aggregated signature and generates a commitment, which it transmits to the verification device 18. This commitment is then transmitted again in response to a challenge request from the verification device 18 (required when a claimant appears). The verification device 18 is configured to verify whether the two commitments match. As a result, the issuer of the signatures before aggregation can be correctly asserted, and it is possible to prevent a third party from impersonating the legitimate issuer of the signatures before aggregation.

[0037] [Devices (terminals) for use via a network (telecommunication lines)] The device, system, or method of disclosure may also have a device (terminal) for using it via a network (telecommunication line). The "device (terminal) for use via a network (telecommunication line)" may be equipped with functions necessary to obtain the effects of implementing the device, system, or method of disclosure (for example, control functions, decoding functions, restoration functions, input / output functions, etc.).

[0038] [Processor, program, recording medium] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0039] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0040] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0041] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 5, and then causing the control unit 10010, input unit 10030, output unit 10040, display unit 10050, etc. to operate.

[0042] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0043] A program describing this process may be included in a computer program product.

[0044] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0045] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed by a so-called ASP (Application Service Provider) type service, where the processing function is realized only by execution instructions and result acquisition, without transferring the program from the server computer to this computer. Furthermore, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. In this form, the program includes information used for processing by an electronic computer that is equivalent to a program (data that is not a direct instruction to the computer but has the property of defining the computer's processing).

[0046] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.

Claims

1. A collective signature certification system including a signature issuing device, a collection device, and a verification device, The aggregation device is A signature aggregation unit that receives signature groups from multiple signature issuing devices, issues aggregated signatures based on the received signature groups, and transmits them to the verification device, The system includes a commitment generation unit that generates a commitment based on the received signature group and the public key corresponding to the received signature group and transmits it to the verification device as a first commitment, and transmits the generated commitment to the verification device as a second commitment when a challenge request is received from the verification device. The verification device is A collective signature verification unit that verifies the received collective signature, Includes a commitment verification unit that transmits the challenge request and verifies whether the second commitment matches the first commitment. Aggregated signature certification system.

2. A signature certification system including a signature issuing device, a signature aggregation device, a commitment generation device, an aggregate signature verification device, and a commitment verification device, The signature aggregation device is The system receives signature groups from multiple signature issuing devices, issues aggregated signatures based on the received signature groups, and transmits them to the aggregated signature verification device. The commitment generation device is The system receives signature groups from multiple signature issuing devices, generates a commitment based on the received signature groups and the public keys corresponding to the received signature groups, and transmits it to the commitment verification device as a first commitment. When a challenge request is received from the commitment verification device, the system transmits the generated commitment to the commitment verification device as a second commitment. The aggregated signature verification device is The received aggregated signature is verified, The commitment verification device is The challenge request is sent, and the second commitment is verified to determine whether it matches the first commitment. Aggregated signature certification system.

3. A method for certifying a signature, performed by a signature issuing device, an aggregation device, and a verification device, The aggregation device is The steps include receiving a group of signatures from multiple signature issuing devices, issuing an aggregated signature based on the received group of signatures, and transmitting it to the verification device, The following steps are performed: generate a commitment based on the received signature group and the public key corresponding to the received signature group and send it to the verification device as a first commitment; and if a challenge request is received from the verification device, send the generated commitment to the verification device as a second commitment. The verification device is The steps include verifying the received aggregate signature, The steps include sending the challenge request and verifying whether the second commitment matches the first commitment. Aggregated signature certification method.

4. A signature issuing device, a signature aggregation device, a commitment generation device, an aggregate signature verification device, and an aggregate signature verification method performed by the commitment verification device, The signature aggregation device is The system receives signature groups from multiple signature issuing devices, issues aggregated signatures based on the received signature groups, and transmits them to the aggregated signature verification device. The commitment generation device is The system receives signature groups from multiple signature issuing devices, generates a commitment based on the received signature groups and the public keys corresponding to the received signature groups, and transmits it to the commitment verification device as a first commitment. When a challenge request is received from the commitment verification device, the system transmits the generated commitment to the commitment verification device as a second commitment. The aggregated signature verification device is The received aggregated signature is verified, The commitment verification device is The challenge request is sent, and the second commitment is verified to determine whether it matches the first commitment. Aggregated signature certification method.

5. A program that causes a computer to function as the aggregation device described in claim 1.

6. A program that causes a computer to function as the verification device described in claim 1.

Images