Pre-signature generation system

Abstract

This system provides a pre-signature generation system that enables simple two-party adapter signing. [Solution] The pre-signature generation system includes a first device and a second device and is a system that generates pre-signatures in adapter signatures. The second device includes a homomorphic Paillier cipher group generation unit that generates a homomorphic Paillier cipher group by encrypting a portion of the values ​​necessary for generating the pre-signature using a homomorphic Paillier cipher or a verifiable homomorphic Paillier cipher, and a homomorphic Paillier cipher group transmission unit that transmits the homomorphic Paillier cipher group to the first device. The first device includes a secure calculation unit that performs secure calculations on the homomorphic Paillier cipher group based on a portion of the values ​​necessary for generating the pre-signature, and a secure calculation result transmission unit that transmits the secure calculation results to the second device. The second device includes a secure calculation result receiving and decrypting unit that receives and decrypts the secure calculation results, and a pre-signature generation unit that generates a pre-signature based on the decrypted secure calculation results.

Description

[Technical Field]

[0001] This disclosure relates to a pre-signature generation system for generating pre-signatures in adapter signatures. [Background technology]

[0002] Non-patent document 1 discloses a system that utilizes adapter signatures in a system structure compatible with blockchain.

[0003] Adapter signing has the following four functions:

[0004] pSign: A function that generates pre-signed signatures containing confidential information. pVrfy: A feature that verifies pre-signed documents. Adapt: ​​A feature that allows you to input secret information for pre-signing and generate a valid signature. Ext: Functionality to obtain confidential information from pre-signed and legitimate signatures. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Aumayr, L., Ersoy, O., Erwig, A., Faust, S., Hostakova, K., Maffei, M., Moreno-Sanchez, P., and Riahi, S., "Generalized Channels from Limited Blockchain Scripts and Adaptor Signatures", Advances in Cryptology - ASIACRYPT 2021(Tibouchi, M. and Wang, H., eds.), Cham, Springer International Publishing, pp. 635-664 (2021). [Overview of the Initiative] [Problems that the invention aims to solve]

[0006] The technology of Non-Patent Document 1 is a system premised on adapter signatures by multiple persons and cannot be applied to the case between two parties. Therefore, an object of the present disclosure is to provide a pre-signature generation system that realizes a simple adapter signature between two parties.

Means for Solving the Problem

[0007] The pre-signature generation system of the present disclosure includes a first device and a second device, and is a system that generates a pre-signature in an adapter signature. The first device includes a secret operation unit and a secret operation result transmission unit, and the second device includes a homomorphic Paillier cipher group generation unit, a homomorphic Paillier cipher group transmission unit, a secret operation result reception and decryption unit, and a pre-signature generation unit.

[0008] The homomorphic Paillier cipher group generation unit encrypts a part of the values necessary for generating a pre-signature by a homomorphic Paillier cipher or a verifiable homomorphic Paillier cipher to generate a homomorphic Paillier cipher group.

[0009] The homomorphic Paillier cipher group transmission unit transmits the homomorphic Paillier cipher group to the first device.

[0010] The secret operation unit executes a secret operation on the homomorphic Paillier cipher group based on a part of the values necessary for generating a pre-signature.

[0011] The secret operation result transmission unit transmits the secret operation result to the second device.

[0012] The secret operation result reception and decryption unit receives and decrypts the secret operation result.

[0013] The pre-signature generation unit generates a pre-signature based on the decrypted secret operation result.

Effect of the Invention

[0014] The pre-signature generation system described in this disclosure enables simple two-party adapter signing. [Brief explanation of the drawing]

[0015] [Figure 1] A block diagram showing the functional configuration of the pre-signature generation system in Example 1. [Figure 2] A sequence diagram showing the operation of the pre-signature generation system in Example 1. [Figure 3] A block diagram showing the functional configuration of the pre-signature generation system in Example 2. [Figure 4] A sequence diagram showing the operation of the pre-signature generation system in Example 2. [Figure 5] A block diagram showing the functional configuration of the pre-signature generation system in Example 3. [Figure 6] A sequence diagram showing the operation of the pre-signature generation system in Example 3. [Figure 7] A diagram illustrating an example of a computer's functional configuration. [Modes for carrying out the invention]

[0016] The embodiments of this disclosure will be described in detail below. Components having the same function will be numbered the same, and redundant explanations will be omitted. [Examples]

[0017] The device configuration and the functional configuration of each device of the pre-signature generation system in Example 1 will be described below with reference to Figure 1. It should be noted that all pre-signature generation systems in the following examples are systems for implementing adapter signing pSign (a function that generates a pre-signature with confidential information).

[0018] As shown in the figure, the pre-signature generation system 1000 of this embodiment is realized by two-party communication between the first device 1 and the second device 2.

[0019] The first device 1 includes a first value group generation unit 11, a first value group transmission unit 12, a homomorphic pairier cipher group receiving unit 13, a secure calculation unit 14, and a secure calculation result transmission unit 15. The second device 2 includes a random number generation unit 20, a first value group receiving unit 21, a second value group generation unit 22, a third value group generation unit 23, a homomorphic pairier cipher group generation unit 24, a homomorphic pairier cipher group transmission unit 25, a secure calculation result receiving and decryption unit 26, and a pre-signature generation unit 27.

[0020] The operation of each component will be explained below with reference to Figure 2.

[0021] <<First value group generation unit 11>> First, the first value group generator 11 of the first device 1 generates a random number k1 from the finite field Zq. This can be expressed in terms of the algorithm as follows.

number

number

number

[0022] <<First Value Group Transmitter 12>> Next, the first value group transmission unit 12 transmits the first value group K~1, K1, PY1 to the second device 2 (S12). Step S12 is expressed in the algorithm as follows.

number

[0023] <<Random number generation unit 20>> The random number generator 20 of the second device 2 generates a random number k0 from the finite field Zq (S20). Step S20 is expressed in the algorithm as follows.

number

number

[0024] <<Second value group generation unit 22>> Next, the second value group generation unit 22 generates the second value group K~, K, r based on the received first value group K~1, K1, PY1 and the random number k0 generated in step S20, as shown in the following equation in the algorithm (S22).

number

[0025] <<Third value group generation unit 23>> Next, the third-value group generator 23 generates the third-value groups U and c as shown in the following equation in the algorithm (S23).

number

[0026] ≪Homomorphic paillier cipher group generation unit 24≫ The homomorphic Paillier cipher group generator 24 encrypts the hashed message h(m), random number k0, r included in the second value group, the secret key sk0 of the second device 2, and c included in the third value group, which are some of the values ​​necessary for generating the pre-signature, using a homomorphic Paillier cipher (or a verifiable homomorphic Paillier cipher; see step S13 for details), as shown in the following equation in the algorithm, to form a homomorphic Paillier cipher group E h , E r , E sk , E c Generate (S24).

number

[0027] ≪Quasi-homomorphic Paillier cipher group transmitter 25≫ The quasi-homomorphic Paillier cipher group transmitter 25 transmits the quasi-homomorphic Paillier cipher groups E h , E r , E sk , E c to the first device 1 (S25). Step S25 is expressed as follows in terms of the algorithm.

Number

Number

number

number

[0028] In homomorphic Paillier encryption, raising a ciphertext to a power results in a product after decryption, and the product of two ciphertexts results in a sum after decryption. The combination of power and product as described above to generate the confidential calculation results encs~ and encz is a technique to perform calculations while keeping the format of the data required for adapter signing and NIZK using the Schnorr protocol confidential to the first device 1 (details will be described later).

[0029] ≪Confidential Calculation Result Transmission Unit 15≫ The confidential calculation result transmission unit 15 transmits the confidential calculation results encs~ and encz to the second device 2 (S15). Step S15 is expressed in the algorithm as follows.

number

number

number

number

[0030] Furthermore, the following formula for z is given in the reference non-patent document 2-2, Schnorr's Protocol: Proof of Knowledge of Discrete Log, which is a paper on NIZK in the Schnorr Protocol.

number

number

[0031] In Example 1, the pre-signature generation system 1000 preferably uses a proofable homomorphic pileir cipher from a security standpoint. In Example 2, a pre-signature generation system 2000 is disclosed that can securely generate pre-signatures even when a proofable homomorphic pileir cipher cannot be used.

[0032] As shown in Figure 3, the pre-signature generation system 2000 of this embodiment is realized through two-party communication between the first device 3 and the second device 4.

[0033] As shown in the figure, the first device 3 includes a first value group generation unit 31, a first NIZK unit 31A, a first value group transmission unit 32, a homomorphic pairier cipher group receiving unit 33, a secure calculation unit 34, and a secure calculation result transmission unit 35. The second device 4 includes a random number generation unit 20, a first value group receiving unit 41, a second NIZK unit 41A, a second value group generation unit 22, a third NIZK unit 43, a homomorphic pairier cipher group generation unit 44, a homomorphic pairier cipher group transmission unit 45, a secure calculation result receiving and decryption unit 46, and a pre-signature generation unit 47.

[0034] The operation of each component will be explained below, mainly with reference to Figure 4, for processes that differ from those in Example 1.

[0035] <<First value group generation unit 31>> The first value group generation unit 31 generates a random number k1 and first value groups K~1 and K1, which are part of the values ​​necessary for generating the pre-signature (S31). The generation of k1, K~1, and K1 is the same as in Example 1. However, PY1, which was generated in Example 1, is not used in this example and therefore does not need to be generated.

[0036] ≪1st NIZK Section 31A≫ The first NIZK section 31A performs the following equation shown in the algorithm to obtain the calculation results U1 and z1 (S31A) in order to generate values ​​necessary for verifying random numbers by NIZK using the Schnorr protocol, which are some of the values ​​necessary for generating a pre-signature, namely sk1, P, Y, k1, K~1, K1.

number

number

[0037] <<First Value Group Receiving Unit 41>> The first value group receiving unit 41 receives the first value group K~1, K1 and the calculation results U1, z1 (S41). Step S41 is expressed in the algorithm as follows.

number

number

[0038] ≪3rd NIZK Department 43≫ The third NIZK section 43 performs the following equation shown in the algorithm to obtain the calculation results U0 and z0 (S43) on sk0, K~1, K1, K~, K, k0, which are some of the values ​​necessary for generating the pre-signature, as an operation to have them verified by NIZK using the Schnorr protocol during the pre-verification stage in adapter signing (S43).

number

number

number

number

number

[0039] ≪Confidential Calculation Result Transmission Unit 35≫ The confidential calculation result transmission unit 35 transmits the confidential calculation result encs~ to the second device 4 (S35). Step S35 is expressed in the algorithm as follows.

number

number

number

[0040] Referring to Figure 5 below, the device configuration and the functional configuration of each device of the pre-signature generation system 3000 of Example 3, which adds a signature verification function to the pre-signature generation system 2000 of Example 2, will be described.

[0041] As shown in the figure, the pre-signature generation system 3000 of this embodiment is realized by two-party communication between the first device 5 and the second device 6.

[0042] The first device 5 includes a first value group generation unit 31, a first NIZK unit 31A, a first value group transmission unit 32, a homomorphic pairier cipher group receiving unit 33, a secure calculation unit 54, and a secure calculation result transmission unit 35. The second device 6 includes a random number generation unit 20, a first value group receiving unit 41, a second NIZK unit 41A, a second value group generation unit 22, a third NIZK unit 43, a homomorphic pairier cipher group generation unit 64, a homomorphic pairier cipher group transmission unit 45, a secure calculation result receiving and decryption unit 46, a signature verification unit 66, and a pre-signature generation unit 47.

[0043] The differences from Example 2 are the confidentiality calculation unit 54, the homomorphic pairier cryptographic group generation unit 64, and the signature verification unit 66. The processing that differs from Example 2 will be explained below with reference to Figure 6.

[0044] ≪Homomorphic paillier cipher group generation unit 64≫ The homomorphic Paillier cipher group generator 64 generates the homomorphic Paillier cipher group E in the same way as in step S44 of Example 2. k , E r This generates (S64). However, E in Example 2 h is E k This has been changed, and as shown in the equation below, the target to be encrypted is 1 / k0 instead of h(m) / k0. Also, in this embodiment, the method of combining NIZK by the Schnorr protocol with the homomorphic Paillier cipher set is not adopted, so the homomorphic Paillier cipher set E sk , E c The generation of is omitted. Step S64 is expressed in the algorithm as follows:

number

number

number

[0045] [Device for use via a network (telecommunication line)] The apparatus, system, or method of this disclosure may also have an apparatus (terminal) for using it via a network (telecommunication line). The apparatus (terminal) for use via a network (telecommunication line) may be equipped with functions necessary to obtain the effects of implementing the apparatus, system, or method of this disclosure (e.g., control functions, decoding functions, restoration functions, input / output functions, etc.).

[0046] [Processor, program, recording medium] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0047] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0048] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0049] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 7, and then causing the control unit 10010, input unit 10030, output unit 10040, display unit 10050, etc. to operate.

[0050] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0051] A program describing this process may be included in a computer program product.

[0052] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0053] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed by a so-called ASP (Application Service Provider) type service, where the processing function is realized only by execution instructions and result acquisition, without transferring the program from the server computer to this computer. Furthermore, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. In this form, the program includes information used for processing by an electronic computer that is equivalent to a program (data that is not a direct instruction to the computer but has the property of defining the computer's processing).

[0054] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware. [Industrial applicability]

[0055] The pre-signature generation system described in this disclosure can be used for commercial transactions using cryptocurrency, etc.

Claims

1. A pre-signature generation system comprising a first device and a second device, which generates a pre-signature in adapter signing, The second device is A homomorphic Paillier cipher set generator generates a homomorphic Paillier cipher set by encrypting a portion of the values ​​necessary for generating the aforementioned pre-signature using a homomorphic Paillier cipher or a verifiable homomorphic Paillier cipher, It includes a homomorphic Paillier cipher group transmission unit that transmits the homomorphic Paillier cipher group to the first device, The first apparatus is A secure operation unit that performs secure operations on the homomorphic Paillier cipher set based on a portion of the values ​​necessary for generating the aforementioned pre-signature, It includes a confidential calculation result transmission unit that transmits the confidential calculation result to the second device, The second device is A secure calculation result receiving and decoding unit receives and decodes the secure calculation result, Includes a pre-signature generation unit that generates the pre-signature based on the decrypted confidential calculation result. A pre-signed signature generation system.

2. A pre-signature generation system comprising a first device and a second device, which generates a pre-signature in adapter signing, The first apparatus is A first value group generation unit generates a first value group which is a part of the values ​​necessary for generating the aforementioned pre-signature, A first NIZK unit performs calculations for verification using non-interactive zero-knowledge proofs (NIZK) according to the Schnorr protocol on a portion of the values ​​necessary for generating the aforementioned pre-signature, It includes a first value group transmission unit that transmits the first value group and the calculation result to the second device, The second device is The first value group receiving unit receives the first value group and the calculation result, A second NIZK unit performs calculations for verification using NIZK according to the Schnorr protocol on the first value group and the calculation results, A third NIZK unit performs calculations to be verified by NIZK using the Schnorr protocol during the pre-verification stage in adapter signing, as part of the values ​​necessary for generating the aforementioned pre-signature, Includes a pre-signature generation unit that generates the pre-signature based on the values ​​required to generate the pre-signature. A pre-signed signature generation system.

3. A pre-signature generation system according to claim 2, The second device is A homomorphic Paillier cipher set generator generates a homomorphic Paillier cipher set by encrypting a portion of the values ​​necessary for generating the aforementioned pre-signature using homomorphic Paillier encryption, It includes a homomorphic Paillier cipher group transmission unit that transmits the homomorphic Paillier cipher group to the first device, The first apparatus is A secure operation unit that performs secure operations on the homomorphic Paillier cipher set based on a portion of the values ​​necessary for generating the aforementioned pre-signature, It includes a confidential calculation result transmission unit that transmits the confidential calculation result to the second device, The second device is It includes a secure calculation result receiving and decoding unit that receives and decodes the secure calculation result, The aforementioned pre-signature generation unit, Based on the decrypted confidential calculation result, the pre-signature is generated. A pre-signed signature generation system.

4. A pre-signature generation system according to claim 3, The second device is Includes a signature verification unit that performs a verifiability check based on the decrypted confidential calculation result. A pre-signed signature generation system.

Images