Ring signature system, terminal, method, and program

Abstract

A ring signature system according to one aspect of the present disclosure comprises: a plurality of member terminals belonging to a ring signature group; and a verifier terminal for verifying a ring signature. The member terminal includes a key generation unit configured to generate a public key and a private key of lattice encryption as a verification key and a signature key, respectively, and a signature generation unit configured to generate a signature for a message via a combinable ring signature to which a Schnorr signature is applied, by using its own signature key and a verification key of another member terminal. The verifier terminal includes a verification unit configured to verify the signature by using the verification key of the member terminal and the message.

Description

[Technical Field]

[0001] The present disclosure relates to a ring signature system, a terminal, a method, and a program. [Background technology]

[0002] The number of transactions with electronic signatures is increasing, especially in the blockchain industry. A typical electronic signature (hereinafter referred to simply as a "signature") has a one-to-one correspondence with a public key (verification key) used to verify the signature. Therefore, the signer's public key can be traced from the signature attached to each transaction, thereby identifying the signer. In other words, a typical electronic signature is traceable.

[0003] On the other hand, there are an increasing number of use cases where the privacy of signers needs to be protected, and in blockchain, AOS ring signatures, which make it impossible to identify the actual signer from the number of ring members N, and traceable ring signatures, which allow public members to identify the signer only in the case of double signatures, have been put into practical use.

[0004] Furthermore, group signatures known as EPID (Enhanced Privacy ID) and DAA (Direct Anonymous Attestation) have been put to practical use in device attestation (Remote Attestation) for devices such as Intel (registered trademark) SGX and TPM (Trusted Platform Module). These group signatures not only prevent public members from identifying the actual signer from the number N of group members, but also prevent the signer from being identified by the group administrator, thereby strengthening privacy protection / anonymity of signers while maintaining operational management by the group administrator.

[0005] Existing ring signatures do not have a group administrator like group signatures, and are signatures that satisfy the privacy requirements of anonymity, unlinkability, and untraceability. Meanwhile, with the recent strengthening of AML / CFT (Anti-Money Laundering / Countering the Financing of Terrorism) regulations, primarily in Europe, there is a growing need to identify and track fraudulent signers or to enable signature linking. Furthermore, in recent years, quantum-resistant cryptography has increasingly been adopted in the field of electronic signature technology to protect against the threat of quantum computers. Linkable ring signatures (LRS), which are based on quantum-resistant cryptography, are known as an electronic signature technology that takes these factors into consideration (Non-Patent Documents 1 and 2). [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Lu, X., Au, MH, Zhang, Z. (2019). Raptor: A Practical Lattice-Based (Linkable) Ring Signature. In: Deng, R., Gauthier-Umana, V., Ochoa, M., Yung, M. Applied Cryptography and Network Security. ACNS 2019. Lecture Notes in Computer Science, vol 11464. Springer, Cham. [Non-patent document 2] Alberto Torres, WA et al. (2018). Post-Quantum One-Time Linkable Ring Signature and Application to Ring Confidential Transactions in Blockchain (Lattice RingCT v1.0). In: Susilo, W., Yang, G. Information Security and Privacy. ACISP 2018. Lecture Notes in Computer Science, vol 10946. Springer, Cham. Summary of the Invention [Problem to be solved by the invention]

[0007] However, conventional combinable ring signatures based on quantum-resistant cryptography have the problem of being complicated to implement.

[0008] The present disclosure has been made in view of the above points, and aims to easily realize a combinable ring signature based on quantum-resistant cryptography. [Means for solving the problem]

[0009] A ring signature system according to one aspect of the present disclosure is a ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal that verifies ring signatures, wherein the member terminals have a key generation unit configured to generate a public key and a private key of a lattice cryptosystem as a verification key and a signing key, respectively, and a signature generation unit configured to generate a signature for a message using its own signing key and the verification keys of other member terminals using a combinable ring signature to which a Schnorr signature is applied, and the verifier terminal has a verification unit configured to verify the signature using the verification keys of the member terminals and the message. [Effects of the Invention]

[0010] Combinable ring signatures based on quantum-resistant cryptography can be easily realized. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a ring signature system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of the functional configuration of a ring member terminal according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a verifier terminal according to the present embodiment. [Figure 4] 10 is a flowchart illustrating an example of a key generation process according to the present embodiment. [Figure 5] FIG. 10 is a sequence diagram showing an example of a group signature creation and verification process according to the embodiment. [Figure 6] 10 is a flowchart illustrating an example of a double signature detection process according to the present embodiment. [Figure 7] FIG. 2 illustrates an example of the hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0012] An embodiment of the present invention will be described below. In the following embodiment, a ring signature system 1 will be described that performs signing and verification using a combinable ring signature in which the Fiat-Shamir transform (Schnorr signature) is applied to a lattice-based combinable ring signature (LRS). This ring signature system 1 makes it possible to realize a combinable ring signature based on quantum-resistant cryptography with a simpler implementation than conventional methods.

[0013] <Preparation> Below, we will prepare some symbols and terms.

[0014] Anonymity means that the signer cannot be identified from the signature. This can also be said to mean that there is randomness in the number of ring members when identifying the verification key used to verify the signature.

[0015] Linkability means that when there are duplicate signatures, the signatures can be linked (or matched).

[0016] Traceability means that the signer can be identified (or traced) when there is a double signature. On the other hand, untraceability means that the signer cannot be identified (or traced). When there is untraceability, there is also anonymity.

[0017] The number of members in a group that performs ring signatures (hereinafter also referred to as a ring signature group) is set to N. Also, members that belong to a ring signature group are also referred to as ring members.

[0018] The ring member (signer) who signs is represented by π. That is, π∈[N]={1, ,N}. In addition, in the index representing the ring member, N+1=1 and 0=N (that is, the next number after N is 1, and the number immediately before 1 is N).

[0019] Let q be a prime number. m, n, and k are pre-set parameters, each of which takes an integer value of 1 or greater.

[0020] Also, let H1 and H2 be hash functions defined below.

[0021] H1:{0,1} * →{-d, ,0, ,d} m×k H2:{0,1} * →Z q k where Z q is the set of integers from 0 to q, {0,1} * represents a bit string of any length. Also, d is a preset parameter that takes an integer value of 1 or greater.

[0022] A discrete normal distribution with standard deviation σ and mean 0 is called D.σ m Also, Z q n×m Let A be the information generated uniformly and randomly from the above. This A is public information that is common to the entire system. σ is a preset parameter.

[0023] <Overall configuration example of Ring Signature System 1> An example of the overall configuration of a ring signature system 1 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the ring signature system 1 according to this embodiment includes a plurality of ring member terminals 10 and one or more verifier terminals 20. These are communicably connected via a communication network 30 including, for example, the Internet. Hereinafter, when distinguishing between the individual ring member terminals 10, they will be referred to as ring member terminals 10. i (i∈[N]). π is the signer's ring member terminal 10, and the signer terminal 10 π It is also called.

[0024] The ring member terminals 10 are various terminals that become ring members belonging to a ring signature group. Examples of the ring member terminals 10 include PCs (personal computers), smartphones, tablet terminals, general-purpose servers, and various IoT (Internet of Things) devices.

[0025] The verifier terminal 20 is a terminal that verifies a ring signature. Examples of the verifier terminal 20 include a PC, a smartphone, a tablet terminal, and various IoT devices.

[0026] The overall configuration example of the ring signature system 1 shown in FIG. 1 is just an example, and the present invention is not limited to this.

[0027] <Example of functional configuration of ring member terminal 10 and verifier terminal 20> An example of the functional configuration of the ring member terminal 10 and the verifier terminal 20 will be described below.

[0028] <Ring member terminal 10> An example of the functional configuration of the ring member terminal 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the ring member terminal 10 according to this embodiment has a group signature processing unit 101 and a storage unit 102. The group signature processing unit 101 is realized, for example, by processing that one or more programs installed in the ring member terminal 10 execute on a calculation device such as a CPU (Central Processing Unit). Furthermore, the storage unit 102 is realized, for example, by a storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory.

[0029] The group signature processing unit 101 executes processing to generate a group signature for a given message. The storage unit 102 stores various information (e.g., a private key (signature key), a public key (verification key), public information A, hash functions H1 and H2, a message to be signed, etc.).

[0030] <Verifier terminal 20> An example of the functional configuration of the verifier terminal 20 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the verifier terminal 20 according to this embodiment includes a signature verification processing unit 201 and a storage unit 202. The signature verification processing unit 201 is realized, for example, by a processing unit such as a CPU that executes one or more programs installed in the verifier terminal 20. The storage unit 202 is realized, for example, by a storage device such as an HDD, SSD, or flash memory.

[0031] The signature verification processing unit 201 executes processing to verify a signature attached to a message. The signature verification processing unit 201 also executes processing to detect duplicate signatures attached to the message. The storage unit 202 stores various information (e.g., a private key (signature key), a public key (verification key), public information A, a hash function H1, etc.).

[0032] <Key generation process> The key generation process according to this embodiment will be described below with reference to FIG. 4. The key generation process shown in FIG. 4 is executed by each ring member terminal 10. i The case where the key generation process is executed will be described.

[0033] Ring member terminal 10 i The group signature processing unit 101 generates the signature key sk by the following steps 1-1 to 1-3. i and verification key pk i is generated (step S101).

[0034] Step 1-1: Ring member terminal 10 i The group signature processing unit 101 of m×k uniformly randomly from X i Generate.

[0035] Step 1-2: Next, ring member terminal 10 i The group signature processing unit 101 of Y i ←AX i Let's say.

[0036] Steps 1-3: Then, ring member terminal 10 i The group signature processing unit 101 of pk i ←Y i ,sk i ←X i Let's say.

[0037] Next, the ring member terminal 10 i The group signature processing unit 101 of i Other ring member terminal 10 j (j≠i, j∈[N]) (step S102).

[0038] In addition, the ring member terminal 10 i The group signature processing unit 101 of i is made public (step S103).

[0039] <Group signature creation and verification process> Next, the group signature creation and verification process according to this embodiment will be described while referring to FIG. 5.

[0040] The group signature processing unit 101 of the ring member terminal 10 creates a group signature according to the following procedures 2-1 to 2-9 (step S201).

[0041] Procedure 2-1: The group signature processing unit 101 of the ring member terminal 10 π creates a ring member public key list L by L←{pk1,···,pk N}. This ring member public key list L is publicly available to other ring member terminals 10 and the verifier terminal 20.

[0042] Note that the group signature processing unit 101 of the ring member terminal 10 π may create a ring member public key list L by, for example, L←{pk1,···,pk N'}(N'<N). At this time, the signer may be able to select or specify which ring member's public key to include in the ring member public key list L. When the ring member public key list L is created by L←{pk1,···,pk N'}, in each subsequent procedure, N may be replaced with N'.

[0043] Procedure 2-2: Next, the group signature processing unit 101 of the ring member terminal 10 π creates tag information T by H←H2(L), T←HX π . This tag information T is publicly available to other ring member terminals 10 and the verifier terminal 20.

[0044] Procedure 2-3: Next, the group signature processing unit 101 of the ring member terminal 10 π randomly generates u from the discrete normal distribution D σ m . Note that u is represented by m discrete values (integer values).

[0045] Step 2-4: Next, ring member terminal 10 π The group signature processing unit 101 of π+1 ← Calculate H1(L,T,M,Au,Hu), where M is the message.

[0046] Step 2-5: For i=π+1, ,N,1, ,π-1, the ring member terminal 10 i The group signature processing unit 101 of i ←HX i Tag information T i This tag information T i is made public to the other ring member terminals 10 and the verifier terminal 20.

[0047] Step 2-6: Next, ring member terminal 10 π The group signature processing unit 101 of σ m From s i (where i=π+1,···,N,1,···,π-1) is randomly generated.

[0048] Step 2-7: Next, ring member terminal 10 π The group signature processing unit 101 of i+1 ←H1(L,T,M,As i +Y i c i ,Hs i +T i c i ) is calculated.

[0049] Step 2-8: Ring member terminal 10 π The group signature processing unit 101 of π ←uX π c π Let's say.

[0050] Step 2-9: Then, ring member terminal 10 π The group signature processing unit 101 of N , T) to create a signature Π.

[0051] Next, the ring member terminal 10 π Group signature processing unit 101 transmits the signed message (M, Π) to verifier terminal 20 (step S202). At this time, the sender of the signed message (M, Π) is information representing the ring signature group.

[0052] Upon receiving the signed message (M, Π), the signature verification processing unit 201 of the verifier terminal 20 verifies the signature Π through the following steps 3-1 to 3-3 (step S203).

[0053] Step 3-1: The signature verification processing unit 201 of the verifier terminal 20 calculates |s i In other words, the signature verification processing unit 201 determines whether there exists an i such that |≧β. i The signature verification processing unit 201 determines whether there exists an i where |s is not smaller. i If there exists an i such that |≧β, the verification fails.

[0054] Step 3-2: Next, the signature verification processing unit 201 of the verifier terminal 20 calculates c i+1 ←H1(L,T,M,As i +Y i c i ,Hs i +T i c i ) is calculated.

[0055] Step 3-3: Then, the signature verification processing unit 201 of the verifier terminal 20 calculates c1=H1(L, T, M, As N +Y N c N ,Hs N +T N c N ) is satisfied. The signature verification processing unit 201 determines whether c1=H1(L, T, M, As N +Y N c N ,Hs N +T N c N) is satisfied, the verification is successful, otherwise the verification is unsuccessful.

[0056] <Duplicate signature detection process> The double signature detection process according to this embodiment will be described below with reference to FIG. 6. In the following, when two signatures Π=(c1, s1, . . . , s N ,T) and Π'=(c1',s1',...,s N We will now explain how to determine whether a signature (T', T') is a double signature.

[0057] The signature verification processing unit 201 of the verifier terminal 20 acquires two signatures Π and Π' (step S301).

[0058] Next, the signature verification processing unit 201 of the verifier terminal 20 obtains tag information T and T' from the two signatures Π and Π', respectively (step S302).

[0059] Next, the signature verification processing unit 201 of the verifier terminal 20 determines whether T=T' is satisfied (step S303).

[0060] If it is determined in step S303 above that T=T′ is satisfied, the signature verification processing unit 201 of the verifier terminal 20 determines that the two signatures Π and Π′ are dual signatures (i.e., signatures by the same signer) (step S304).

[0061] On the other hand, if it is not determined in step S303 that T=T' is satisfied, the signature verification processing unit 201 of the verifier terminal 20 determines that the two signatures Π and Π' are not duplicated signatures (step S305).

[0062] <Example of Hardware Configuration of Ring Member Terminal 10 and Verifier Terminal 20> The ring member terminal 10 and the verifier terminal 20 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 7. The computer 500 shown in Fig. 7 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0063] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0064] The external I / F 503 is an interface with an external device such as a recording medium 503a. The computer 500 can read from and write to the recording medium 503a via the external I / F 503. Examples of the recording medium 503a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0065] The communication I / F 504 is an interface for connecting the computer 500 to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a storage device (storage device) such as an HDD, SSD, or flash memory. The processor 508 is an arithmetic device such as a CPU.

[0066] The ring member terminal 10 and the verifier terminal 20 according to this embodiment can realize the various processes described above by having, for example, the hardware configuration of a computer 500 shown in Fig. 7. Note that the hardware configuration of the computer 500 shown in Fig. 7 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0067] <Summary> As described above, in the ring signature system 1 according to this embodiment, the Fiat-Shamir transform (Schnorr signature) is applied to a lattice-based combinable ring signature (LRS), thereby simplifying the ring signature mechanism. This makes it easier to implement than conventional combinable ring signatures based on quantum-resistant cryptography, which, for example, reduces implementation costs and allows implementation on terminals with insufficient hardware resources. Furthermore, in the ring signature system 1 according to this embodiment, a combinable ring signature based on quantum-resistant cryptography is implemented without the need for a trapdoor, which allows for smaller key lengths and signature lengths, thereby enabling efficient ring signatures.

[0068] Furthermore, the ring signature system 1 according to this embodiment can detect double signatures. Therefore, when applied to a blockchain, for example, it becomes possible to detect fraud such as double spending of currency while protecting the privacy and anonymity of signers.

[0069] The combinable ring signature constructed in this embodiment has anonymity, linkability, and untraceability, similar to conventional combinable ring signatures based on quantum-resistant cryptography.

[0070] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0071] 1 Ring Signature System 10 Ring Member Terminals 20 Verifier terminal 30 Communication Network 101 Group signature processing unit 102 Storage section 201 Signature verification processing unit 202 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. A ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal that verifies a ring signature, The member terminal a key generation unit configured to generate a public key and a private key of a lattice cryptosystem as a verification key and a signature key, respectively; a signature generation unit configured to generate a signature for a message by a combinable ring signature to which a Schnorr signature is applied, using its own signature key and a verification key of another member terminal; The verifier terminal a verification unit configured to verify the signature using a verification key of the member terminal and the message.

2. The signature generation unit The ring signature system of claim 1, configured to generate its own tag information using a hash value of the verification key list of the other member terminal and its own signature key, and to generate a signature including the tag information.

3. The signature generation unit When the index representing each of the other member terminals is i=1, . . . , π−1, π+1, . . . , N, and the index representing itself is i=π, c π＋１ ←H １ (L, T, M, Au, Hu) (where L is the verification key list, T is its own tag information, M is the message, A is pre-given public information, u is a random number, and H is a hash value of the verification key list L), and c ｉ＋１ ←H １ (L, T, M, As ｉ +Y ｉ c ｉ , Hs ｉ +T ｉ c ｉ ) (where i=1,..., π-1, π+1,..., N, s ｉ is a random number, Y ｉ is the verification key of the member terminal corresponding to index i, T ｉ is the tag information of the member terminal corresponding to index i), c π Using s π Calculate (c １ , s １ , ..., s Ｎ 3. The ring signature system of claim 2, wherein the ring signature system is configured to generate the signature as follows:

4. The signature generation unit s π ←u-X π c π (However, X π is his own signing key) π 4. The ring signature system of claim 3, configured to calculate:

5. The verification unit For i=1, . . . , N−1, c ｉ＋１ ←H １ (L, T, M, As ｉ +Y ｉ c ｉ , Hs ｉ +T ｉ c ｉ ) and c １ = H １ (L, T, M, As Ｎ +Y Ｎ c Ｎ , Hs Ｎ +T Ｎ c Ｎ 5. The ring signature system according to claim 3, wherein the signature verification is considered successful if

6. A member terminal in a ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal that verifies a ring signature, a key generation unit configured to generate a public key and a private key of a lattice cryptosystem as a verification key and a signature key, respectively; A terminal having a signature generation unit configured to generate a signature for a message using its own signature key and a verification key of another member terminal by a combinable ring signature to which a Schnorr signature is applied.

7. A method for use in a ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal that verifies a ring signature, comprising: The member terminal a key generation procedure for generating a public key and a private key of the lattice cryptography as a verification key and a signing key, respectively; a signature generation procedure for generating a signature for a message using its own signature key and the verification keys of the other member terminals by a combinable ring signature to which a Schnorr signature is applied; The verifier terminal, a verification procedure for verifying the signature using a verification key of the member terminal and the message;

8. A program that causes a computer to function as a member terminal or a verifier terminal included in the ring signature system according to claim 1.

Images