Digital signature system and method

Abstract

The present invention provides a system that simultaneously reduces the risk of both loss and leakage of a key for a digital signature. This digital signature system comprises first and second signature generation devices, each of which comprises at least a processor and a communication interface, and which are communicably connected to each other. The first signature generation device executes: a process for receiving a first parameter created using a first signature key and first biometric information, and storing same in a storage unit; a process for generating a difference key and generating a second parameter from the difference key and the first parameter; and a process for transmitting the second parameter to the second signature generation device. The second signature generation device executes: a process for acquiring second biometric information and generating a second signature key from the second biometric information and the second parameter; and a process for using the second signature key to generate a second signature for a message, and transmitting the second signature to the first signature generation device. The first signature generation device executes a process for receiving the second signature, and using at least the difference key and the second signature to generate and output a first signature for a case in which the message was signed with the first signature key.

Description

Digital signature system and method

[0001] The present invention relates to a digital signature system, an apparatus, a method, and a recording medium.

[0002] Digital signatures are a technology that can verify the author of a document and that it has not been tampered with since its creation.

[0003] <Digital signature algorithm> Key generation: Generate a pair of signing key (private key) sk and verification key (public key) vk. (sk, vk)←KeyGen(1 κ ) ...(1) κ is a security parameter.

[0004] Signature: Generate a signature σ for document M using signing key sk. σ←Sign(sk, M) ...(2)

[0005] Verification: Verify the validity of the pair of document M and signature σ using verification key vk. 0 / 1←Verify(vk, M, σ) ...(3) 1: Accept, 0: Reject

[0006] With digital signatures, if the public key is made public, anyone who obtains the pair of document and signature can verify it. In other words, the signature is verified to see if it was created for the document using the verification key, which is a public key, and the signing key, which is a private key corresponding to the public key. Digital signatures are used for various purposes, such as protecting email (S / MIME (Secure / Multipurpose Internet Mail Extensions)) and electronic contracts. For example, instead of a seal on a written contract, the contractor's digital signature is added to the electronic data of the contract. In addition, when transferring virtual currency, a message containing information such as "how much to send to which address" and the sender's digital signature for that message are recorded on the blockchain. The transfer process is completed when this signature is correctly verified.

[0007] In digital signatures, security is lost if the signing key is lost or stolen, but it is difficult for ordinary users to properly manage signing keys. If signing keys are not properly managed, there is a risk that the signing key will be lost or stolen. If signing keys are not properly managed, the "signer" may not be able to generate a valid signature (e.g., if the signing key is lost), or someone other than the "signer" may be able to generate a valid signature (e.g., if the signing key is stolen).

[0008] The security of digital signatures is based on the fact that the signing key is managed secretly. If an attacker obtains a signing key, they can generate a valid signature. In other words, what a digital signature guarantees is that "the person who holds the signing key has affixed a signature to a document," not that "the signer affixed a signature to a document." The more keys a user manages, the more difficult management becomes. Non-Patent Document 1, for example, is referred to as an example of digital signatures that allow for distributed key management, such as multi-signatures.

[0009] A digital signature using biometric information has been proposed as a fuzzy signature (Patent Document 1).

[0010] Key generation: A verification key is generated from biometric information.

[0011] Signature: Generate a signature σ for document M using biometric information.

[0012] Verification: The correctness of the message and signature pair is verified using the verification key.

[0013] Japanese Patent No. 6096893 Japanese Patent Application Laid-Open No. 2021-087167

[0014] Antonio Nicolosi, et al., "Proactive Two-Party Signatures for User Authentication," Conference: Proceedings of the Network and Distributed System Security Symposium, NDSS 2003, San Diego, California, USADavid Derler1, et al., "Key-Homomorphic Signatures: Definitions and Applications to Multiparty Signatures and Non-Interactive Zero-Knowledge," Designs, Codes and Cryptography 87, 1372-1413, 2019Dodis et al., "Fuzzy Extractors: How to Generate Strong Keys From Biometrics and Other Noisy Data," Eurocrypt, pp. 523-540, (2004).

[0015] In biometric digital signatures, the risk of losing a key is reduced compared to digital signatures by using biometric information instead of a key. However, when using a key that relies on biometric information, leakage of the biometric information means leakage of the key. Because it is difficult to change biometric information, once biometric information is leaked, the key generated from that biometric information can no longer be used safely.

[0016] An object of the present invention is to provide a system, an apparatus, a method, and a program recording medium that simultaneously reduce the risks of both key loss and key leakage in digital signatures.

[0017] A digital signature system according to one aspect of the present invention includes first and second signature generation devices, each of which includes at least a processor and a communication interface and is communicatively connected. The first signature generation device receives first parameters created using a first signature key and first biometric information and stores them in a storage unit, generates a differential key and generates second parameters from the differential key and the first parameters, and transmits the second parameters to the second signature generation device. The second signature generation device receives second biometric information and generates a second signature key from the second biometric information and the second parameters, generates a second signature for a message using the second signature key, and transmits the second signature to the first signature generation device. The first signature generation device receives the second signature and uses at least the differential key and the second signature to generate and output a first signature that would result if the message were signed with the first signature key.

[0018] A digital signature method according to one aspect of the present invention includes the steps of: a first node receiving first parameters created using first biometric information and a first signing key; the first node generating a differential key, generating second parameters from the differential key and the first parameters, and transmitting the second parameters to a second node; the second node generating a second signing key from second biometric information acquired by the second node and the second parameters; using the second signing key to generate a second signature for the acquired message and transmitting the second signature to the first node; and the first node using at least the second signature and the differential key to generate and output a first signature for the message signed with the first signing key.

[0019] According to one aspect of the present invention, there is provided a recording medium (a computer-readable non-transitory medium) having recorded thereon a program for causing a first and second processing device, which are communicatively connected to each other, to respectively execute the following processes: a process by a first processing device receiving first parameters created using first biometric information and a first signature key and storing them in a memory unit; a process by which a differential key is generated, and second parameters are generated from the differential key and the first parameters, and transmitted to the second processing device; a process by the second processing device generating a second signature key from the acquired biometric information and the second parameters, and using the second signature key to generate a second signature for a message, and transmitted to the first processing device; and a process by the first processing device generating and outputting a signature for the message, using the second signature for the message and the differential key, that would result from signing the message with the first signature key.

[0020] According to the present invention, it is possible to simultaneously reduce the risks of both key loss and key leakage in digital signatures.

[0021] FIG. 1 is a diagram for explaining an embodiment of the present invention. FIG. 2 is an explanatory diagram for explaining calculation processing of an embodiment of the present invention. FIG. 3 is a diagram for explaining an embodiment of the present invention. FIG. 4 is a diagram for explaining a modified example of an embodiment of the present invention. FIG. 5 is a diagram for explaining a processing sequence of an embodiment of the present invention. FIG. 6 is a diagram for explaining a processing sequence of an embodiment of the present invention. FIG. 7 is a diagram for explaining a processing sequence of an embodiment of the present invention. FIG. 8 is a diagram for explaining calculation processing of another embodiment of the present invention. FIG. 9 is a diagram for explaining another embodiment of the present invention. FIG. 10 is a diagram for explaining yet another embodiment of the present invention. (A) and (B) are diagrams for explaining an example of implementation on a computer.

[0022] An embodiment of the present invention will be described. According to one embodiment, one of the signing keys distributed and stored among two parties is replaced with biometric information. The advantage of biometric information is that it is difficult to link to others (i.e., difficult to steal) and difficult to lose its link to the user. Rather than generating a signature using only biometric information, one of the two signing keys is replaced with biometric information. Because a signing key generated from biometric information is used in pairs with another signing key, by changing the other signing key, it is possible to link a single biometric part (e.g., face, fingerprint, finger veins, iris, etc.) to multiple keys. The other signing key paired with the biometric information may be stored in a device such as a user's local computer, token, or IC card, a cloud server, or a server managed by a service provider. According to one embodiment, the risks of key loss and leakage in digital signatures can be simultaneously reduced.

[0023] FIG. 1 is a diagram illustrating a schematic configuration example of an embodiment of the present invention. Referring to FIG. 1, a digital signature system 100 includes a key generation device 120, a first signature generation device 130, a second signature generation device 140, and a verification device 150. In the key registration phase, the key generation device 120 generates a first random number x, which serves as a first signature key, which is a private key. The key generation device 120 generates a verification key vk, which is a public key, from the first signature key x, which is a private key, and transmits the verification key vk to the verification device 150. The key generation device 120 and the verification device 150 are connected to each other via a network (e.g., at least one of a wired local area network (LAN), a wireless LAN, a wide area network (WAN), a mobile communication network, a virtual network, and the like). The verification key vk may be registered and stored in a public key database or the like in association with a key ID or the like.

[0024] The key generation device 120 acquires first biometric information w, applies an encoding function (Encode) to the first signature key x to convert it into an encoding key ENC(x), and combines (e.g., by addition or exclusive OR) the encoding key ENC(x) with the first biometric information w to generate a first parameter s (e.g., s:=ENC(x)+w). The key generation device 120 transmits the generated first parameter s to the first signature generation device 130. The key generation device 120 and the first signature generation device 130 are connected to each other via a network (e.g., at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like). The first parameter s may be referred to as a "shared key." The application of the encoding function (Encode) and the decryption function (Decode) is referred to as encoding / decryption.

[0025] The key generation device 120 transmits the first parameter s based on the first biometric information w only to the first signature generation device 130. It is not necessary for the key generation device 120 to transmit anything to the second signature generation device 140. In the stage of actually signing (signature phase), the second signature generation device 140 generates a second signature key x' based on the second parameter s' generated by the first signature generation device 130 and the second biometric information w' acquired by the second signature generation device 140 for signing.

[0026] That is, in the signature phase, the first signature generation device 130 generates a uniformly random second random number Δ from an information source and sets this as a differential key Δ. Δ is also referred to as a shift amount. The first signature generation device 130 applies an encoding function (Encode) to this differential key Δ to generate a value ENC(Δ), and generates a second parameter s' (e.g., s':=ENC(Δ)+s), which is the result of an operation (e.g., an addition result or an exclusive OR result) between the value ENC(Δ) and the first parameter s from the key generation device 120, and transmits this to the second signature generation device 140. The first signature generation device 130 and the second signature generation device 140 are communicatively connected via a network (e.g., at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0027] The second signature generation device 140 receives the second parameter s′ transmitted from the first signature generation device 130 .

[0028] The second signature generation device 140 acquires second biometric information w' to generate a signature key, and applies a decryption function (Decode) to the difference between the second parameter s' and the second biometric information w' (s'-w') to obtain a value x' (=DEC(s'-w')), which is the second signature key. The second signature key x' is also called a "temporary key."

[0029] The second signature generation device 140 generates a second signature for the message M using the second signature key x′: σ′←Sign(x′, M) . . . (4) and transmits it to the first signature generation device 130 .

[0030] The first signature generation device 130 generates a first signature σ (=Sign(x,M)) for message M using the first signature key x from the second signature σ' (=Sign(x',M)) for message M using the second signature key x' by the key homomorphic operation KHom(Δ,σ') using the second signature σ' (=Sign(x',M)) and the differential key Δ. σ (=Sign(x,M)) ← KHom(Δ,σ') ... (5)

[0031] The first signature generation device 130 transmits the first signature σ = Sign(x, M) to the verification device 150. The first signature generation device 130 and the verification device 150 are communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0032] The verification device 150 verifies the first signature σ = Sign(x, M) using the verification key vk and the message M. 0 / 1 ←Verify(vk, M, σ) ... (6) If accepted, it is set to 1, and if rejected, it is set to 0. The verification device 150 may transmit the verification result to, for example, the first signature generation device 130, which is the sender.

[0033] Fig. 2 illustrates the calculation process in each device described above with reference to Fig. 1. Although some of the explanation overlaps with the above explanation, the following provides additional information about the calculation.

[0034] The key generation device 120 executes a key generation algorithm for the digital signature method. The parameter pp is determined in advance according to the security parameter κ and is made public to the user (setup). pp ← Setup(1 κ ) ...(7)

[0035] The parameter pp is a parameter common to the system, and is referred to here as a public parameter. The setup may be performed, for example, before the system is operated, and each of the devices 120, 130, 140, and 150 in the digital signature system 100 can use (share) the public parameter pp.

[0036] The key generation device 120 generates a signature key (private key) and a verification key (public key) according to the public parameters pp. (sk, vk) ← KeyGen(pp) ... (8)

[0037] In the key generation of equation (8), the key generation device 120 uniformly randomly selects a first random number x from the information source and sets it as a secret key sk. sk ← x ... (9)

[0038] The key generation device 120 generates a verification key vk from the first random number x: vk ← VKGen(x) ... (10)

[0039] The secret key sk in equation (9), and therefore the first random number x, is defined as the first signature key.

[0040] The key generating device 120 encodes the first signature key x to convert it into an encoding key, and combines the encoding key ENC(x) with the first biometric information w to generate a first parameter s: s := ENC(x) + w ... (11)

[0041] ENC / DEC are encoding / decoding functions (algorithms) (Non-Patent Document 3). The encoding function ENC converts plaintext x contained in the information source space into code c. The decoding function DEC converts code c back into plaintext x. c←ENC(x) ...(12) x←DEC(c) ...(13)

[0042] Here, for a code c' whose difference from c, the code of any plaintext x included in the information source space, is within the correction capability t, the following must hold: x = DEC(c') ...(14).

[0043] A linear code is an error-correcting code that has linearity with respect to the code.

[0044] Linearity: ENC(x) + ENC(x') ...(15) is the codeword of x+x', i.e., x+x' = DEC(ENC(x) + ENC(x')) ...(16) In equation (16), the "+" on the left and right sides do not have to be the same operation.

[0045] For encoding, for example, an error-correcting code (such as a Hamming code, a BCH code, or a low-density parity-check (LDPC) code) may be used. Alternatively, for example, lattice coding may be used. More specifically, methods using integer lattices, methods using triangular lattices, and methods using more complex lattices are known (see Patent Document 2, etc.).

[0046] The second signature generation device 140 newly acquires the second biometric information w' of the user, and applies the decryption function DEC to the difference between the second parameter s' and the second biometric information w': s'-w', to obtain the value x' = DEC(s' - w') ... (17) as the second signature key.

[0047] The difference operation: s'-w' includes a term (ENC(x)+ENC(Δ)) that shifts the encoded first signature key ENC(x) by the value ENC(Δ) obtained by encoding the differential key Δ, and a difference term (w-w') between the first biometric information w and the second biometric information w'. s'-w'=s+ENC(Δ)-w'=ENC(x)+w+ENC(Δ)-w'=ENC(x+Δ)+(w-w') ...(18)

[0048] That is, if the error (w-w') between the first and second biometric information falls within the range of correction capability, the decryption result DEC(s'-w') of s'-w' is x+Δ, and the second signing key x' is given by x' = x + Δ ...(19), which is the value obtained by shifting the first signing key x by the differential key Δ.

[0049] The second signature generation device 140 generates a second signature for the message M using the second signature key x′ (=x+Δ): σ′←Sign(x′, M) ... (20) and transmits it to the first signature generation device 130 .

[0050] The first signature generation device 130 generates a first signature σ (=Sign(x, M)) with the first signature key x for the message M using the second signature σ′ and the differential key Δ, through the key homomorphic operation KHom(Δ,σ′). σ ← KHom(Δ,σ′) ... (21)

[0051] The key homomorphic operation in equation (21): σ ← KHom(Δ, σ') indicates that an algorithm can be constructed to generate a signature σ for a message M using the first signing key x from the second signature σ' and the differential key Δ.

[0052] A brief explanation of key homomorphism will be given below. As an example, Schnorr signature, which has key homomorphism, will be used for explanation (see Non-Patent Document 2). In the following, the private key sk and public key pk in Non-Patent Document 2 will be referred to as the signature key sk and verification key vk, respectively.

[0053] <Example 1: Schnorr signature> Setup: Setup(1 κ ), a prime number p of order κ bits (i.e., however, is a ceiling function that represents rounding up to an integer value), and then select g uniformly at random from G (g← R G), hash function H: G × M → {0, 1} n is a hash function family {H k} k Let (G, g, H) be the public parameter pp. pp ← (G, g, H) ...(22)

[0054] Key generation: KeyGen(pp) generates a signing key and a verification key according to the public parameters pp. x is chosen uniformly at random from Zp (the set of integers 0 to p (= Z / pZ)) (x← R Zp). The verification key and signing key are determined and output as follows: Verification key: vk ← g x , Signing key: sk ← x ...(23)

[0055] Signature: In Sign(sk, M), r is chosen uniformly at random from Zp (r← R Zp), and output the signature σ calculated as follows: c ← H(g r ,M) y ← r + x・c mod p σ ← (c, y) ...(24)

[0056] Verification: In Verify(Vk, M, σ), c = H(((g x ) -c g y mod p), M) holds, output 1, otherwise output 0.

[0057] Key homomorphism: If a signature σ ←Sign(sk, M) = (c, y) is a valid signature for message M under verification key vk, then a new signature calculated using differential key Δ: σ' ← (c, y') y' ← y + c ・Δ mod p ...(25) is the verification key vk'=g x＋Δ　　　　　...(26) proves that the signature for message M is correct. That is, the following holds: H(vk' -c g y' , M) =H((g x+Δ ) -c g y＋c・Δ , M) =H((g x+Δ ) -c g r+ x・ｃ＋c・Δ , M) =H(g r ,M)=c ...(27)

[0058] Non-Patent Document 2 discloses an algorithm Adapt that includes a conversion process for converting a signature σ based on a signing key sk into a signature σ' based on sk + Δ. In this embodiment, an algorithm for converting a second signature σ' based on a signing key sk + Δ into a signature σ based on (sk + Δ) - Δ is called KHom. Although KHom does not match Adapt in Non-Patent Document 2, it may correspond to the conversion process in Adapt where the shift Δ is changed to -Δ.

[0059] The verification device 150 receives the first signature σ from the first signature generation device 130 and verifies the correctness of the set of the message M and the first signature σ using the verification key vk.

[0060] Fig. 3 is a diagram illustrating an example of the configuration of each device in Fig. 1. The key generation device 120 includes a biometric information acquisition unit 121 including a sensor (not shown) that acquires first biometric information w of a user (or an interface that receives the first biometric information w acquired by an external sensor via a network such as a communication line), a signature key / verification key generation unit 122 that generates a first signature key x and generates a verification key vk that is a public key corresponding to the first signature key x, a first parameter generation unit 123 that generates a first parameter s using the first signature key x and the first biometric information w, a verification key transmission unit 124 that transmits the verification key vk to the verification device 150, and a first parameter transmission unit 125 that transmits the first parameter s to the first signature generation device 130.

[0061] The first signature generation device 130 includes a first parameter acquisition unit 131 that receives a first parameter s transmitted from the key generation device 120, a memory unit 132 that stores the first parameter s acquired by the first parameter acquisition unit 131, a signature generation unit 135 that transmits and receives information to and from the first signature generation device 130 and generates a first signature σ for the message, and a transmission unit 136 that transmits the first signature σ to the verification device 150.

[0062] The second signature generation device 140 includes a biometric information acquisition unit 143 including a sensor (not shown) for acquiring second biometric information w' of a user, a message acquisition unit 144 for acquiring a message M, and a signature generation unit 145 for transmitting and receiving information between the second signature generation device 140 and the first signature generation device 130 to generate a second signature key x' and generate a second signature σ' for the message M. The second signature generation device 140 may also include a transmission unit 146 for receiving the first signature σ generated by the first signature generation device 130 and transmitting it to the verification device 150. The sensor (not shown) in the biometric information acquisition unit 143 has the same configuration as the sensor (not shown) in the biometric information acquisition unit 121 of the key generation device 120.

[0063] The verification device 150 includes a verification key acquisition unit 151 that receives the verification key vk generated by the key generation device 120, a memory unit 152 that stores the received verification key vk, a message acquisition unit 154 that acquires a message, a signature acquisition unit 155 that receives the first signature σ generated by the first signature generation device 130, and a signature verification unit 156 that verifies the correctness of the set of the verification key vk generated by the key generation device 120, the message M, and the first signature σ received from the first signature generation device 130.

[0064] FIG. 4 is a diagram illustrating a modification of the embodiment shown in FIG. 3. The verification key transmission unit 124 of the key generation device 120 may upload the verification key vk to a key server 160 (public key database) via the Internet 170, for example, rather than directly transmitting the verification key vk to the verification device 150, and make the verification key vk available on the Internet 170. The key server 160 stores the verification key vk in association with a key ID, etc. In this case, the verification key acquisition unit 151 of the verification device 150 accesses the key server 160 via the Internet 170, for example, to acquire the verification key vk. The configurations of the first signature generation device 130 and the second signature generation device 140 are the same as those shown in FIG. 3.

[0065] Fig. 5 is a diagram for explaining an example of the processing operation at the key registration stage in the embodiment shown in Fig. 3. The key generating device 120 acquires the first biometric information w of the user (step A1).

[0066] The key generation device 120 generates a first signature key x (step A2). That is, the key generation device 120 generates a first random number x, which serves as the first signature key.

[0067] The key generating device 120 generates a verification key vk corresponding to the first signature key x (step A3).

[0068] The key generation device 120 transmits the generated verification key vk to the verification device 150 (step A4). In the example of Fig. 4, the key generation device 120 uploads the verification key vk to the key server 160 and makes it publicly available on the Internet 170, etc.

[0069] The key generating device 120 acquires the user's first biometric information w, encodes the first signature key x, and adds the biometric information w to the encoded first signature key ENC(x) to generate a first parameter s (= ENC(x) + w) (step A5).

[0070] Key generation device 120 transmits the first parameter s to first signature generation device 130 (step A6).

[0071] The verification device 150 receives the verification key vk (step D1) and stores it (step D2). The first signature generation device 130 receives the first parameter s (step B1) and stores it (step B2). In the example of Fig. 4, the verification device 150 obtains the verification key vk from the key server 160 and stores it.

[0072] FIG. 6 is a diagram for explaining an example of processing operations at the signature creation stage in the present embodiment shown in FIGS.

[0073] The first signature generation device 130 generates a second random number Δ and sets it as the differential key Δ (step B3).

[0074] The first signature generation device 130 generates a second parameter s', which is the sum (ENC(Δ)+s) of the encoded value ENC(Δ) of the differential key Δ and the first parameter s received from the key generation device 120 (step B4).

[0075] The first signature generation device 130 transmits the second parameter s' to the second signature generation device 140 (step B5).

[0076] The second signature generating device 140 acquires the second biometric information w' of the user (step C1).

[0077] The second signature generation device 140 obtains the message M (step C2).

[0078] The second signature generation device 140 receives the second parameter s' transmitted from the first signature generation device 130 (step C3).

[0079] The second signature generating device 140 decrypts the difference between the second parameter s' and the second biometric information w': s'-w' (see the following equation (1)), and uses the decrypted value as the second signature key (step C4).

[0080] The second signature generation device 140 generates a second signature for the message M using the second signature key x': σ'=Sign(x', M) (28) (step C5).

[0081] The second signature generation device 140 transmits the second signature σ′ to the first signature generation device 130 (step C6).

[0082] The first signature generation device 130 receives the second signature σ′ transmitted from the second signature generation device 140 (step B6).

[0083] Using the second signature σ' and the differential key Δ, the key homomorphic operation KHom(Δ,σ') is used to generate a first signature σ with the first signature key x from the second signature σ' for the message M with the second signature key x' (step B7).

[0084] FIG. 7 is a diagram for explaining an example of the operation of the signature verification process in the present embodiment shown in FIGS.

[0085] The verification device 150 acquires the message M (step D3).

[0086] The first signature generation device 130 transmits the first signature σ to the verification device 150 (step B8).

[0087] The verification device 150 receives the first signature σ transmitted from the first signature generation device 130 (step D4), and verifies the correctness of the pair of the message M and the first signature σ using the verification key vk (step D5).

[0088] If necessary, the verification device 150 may transmit the verification result (notification of acceptance or non-acceptance) to the sender, the first signature generation device 130 (step D6). In this case, the first signature generation device 130 receives the notification of acceptance or non-acceptance (step B9).

[0089] The timing of the verification process is arbitrary. For example, by verifying the signature stored along with the stored message M at the time when the user wants to use the message M, it is possible to verify that the message M has not been tampered with, including while it is stored. Also, one pair of message M and signature may be verified multiple times.

[0090] 8, the first signature generation device 130 may transmit the generated first signature σ to the second signature generation device 140 (step B8), and the second signature generation device 140 may transmit the first signature σ to the verification device 150 (step C9). The verification device 150 may transmit the verification result (acceptance / rejection notification) to the second signature generation device 140, which is the sender, as necessary (step D6). In this case, the second signature generation device 140 receives the acceptance / rejection notification (step C10).

[0091] Fig. 9 is a diagram for explaining the second embodiment, and corresponds to Fig. 2 described above. The difference from Fig. 2 is the first signature generation device 130. The other devices are the same as those in Fig. 2. The differences from Fig. 2 will be described below.

[0092] The first signature generation device 130 receives the message M, and generates a first signature σ using the first signature key (private key) x by the key homomorphic operation KHom(Δ,σ',M) using the second signature σ' (σ'←Sign(x',M)) for the message M using the second signature key x' (=x+Δ) transmitted from the second signature generation device 140, the differential key Δ, and the message. σ←KHom(Δ,σ',M) ...(29)

[0093] Fig. 10 is a diagram for explaining the configuration of the second embodiment, and corresponds to the above-mentioned Fig. 3. The difference from Fig. 3 is that the first signature generation device 130 includes a message acquisition unit 134.

[0094] An example of a signature that requires a message for key homomorphic operation will be described below (page 20, 4.7 Randomizable SPS by Abe et al. [AGOT14] in Non-Patent Document 2). The Rerandomizable secure structure-preserving signature (SPS) scheme in Non-Patent Document 4 is given below.

[0095] <Example 2: Rerandomizable SPS> Setup: Setup(1 κ) inputs a security parameter 1κ and outputs a bilinear group description BG: (G1, G2, GT, p, e, g, g~, Ψ) as a public parameter pp. G1 = <g>(g is the generator of G1), G2 =<g~> (g~ is a generator of G2), e is a bilinear mapping: G1×G2→GT, Ψ is an isomorphism: G2→G1, G1, G2, GT are cyclic groups of prime order p (length of bit string κ). pp ←(G1,G2,GT,p,e,g,g~,Ψ) ...(30)

[0096] Key generation: KeyGen(pp) generates a signing key and a verification key based on the public parameters pp. Random numbers x and y are selected uniformly at random from Zp: x, y ← R Zp, X ← g^x, Y ← g^y, (^ is the exponentiation operator) ...(31) Verification key: vk ←(X, Y), Signing key: sk ← (x, y) ...(32)

[0097] Signature: In Sign(sk, M), a random number r is selected uniformly at random from Zp: r ← R Zp, σ1 ← g~^r, σ2 ←M^x・g~^(r 2 +y) ...(33) to create a signature σ. σ ← (σ1, σ2) ...(34)

[0098] Randomization: Rand(M, (σ1, σ2)) selects a random number α: α ← R Z * p (Z * p is the set of integers that are Zp and prime to p) σ'1 ← σ1・g~^α, σ'2 ← σ2・σ1^(2α)・g~^α 2 ...(35) Create a signature σ' from σ' ← (σ'1, σ'2) ...(36)

[0099] Verification: Verify(vk, M, σ) : 1 if M, σ1, σ2 ∈ G2 and e(g, σ2) = e(X, M)・e(Ψ(σ1), σ1)・e(Y, g~), Otherwise return 0 ...(37)

[0100] Key homomorphism: vk is (X, Y), σ is (σ1, σ2), differential key (shift amount) Δ is (Δ1, Δ2) ∈ Zp 2 Let σ2 ' ← M^Δ1・g~^Δ2 σ ' ←Rand(M, (σ1, σ2 ' )) ...(38) and calculate σ ' The signature σ of the key homomorphic operation result is output. ' is (g~^(r+α), M^(x+Δ1)・g~^{(r+α) 2 +(y+Δ2)}) ...(39), which is a correct signature for message M under verification key vk' = (X·g^Δ1, Y·g^Δ2) ...(40).

[0101] In the above example 2, the key homomorphic operation KHom can be expressed as follows: σ← KHom(Δ,σ',M) ...(41)

[0102] FIG. 11 is a diagram illustrating the configuration of the third embodiment, and differs from FIG. 10 in that the first signature generation device 130 includes a verification key acquisition unit 137 that acquires a verification key vk from the key generation device 120. In the first signature generation device 130, the verification key vk is used by the signature generation unit 135 in the key homomorphic operation KHom, which converts the second signature σ′ generated by the second signature generation device 140 into the first signature σ. Note that the verification key acquisition unit 137 may acquire the verification key vk not from the key generation device 120 but from the key server 160 in FIG. 4. Ghadafi's Short SPS in Non-Patent Document 2 will be described below as an example of a signature that requires the verification key Vk for the key homomorphic operation.

[0103] <Example 3: Ghadafi's Short SPS> Setup: In Setup(1κ), security parameter 1 κ Input the bilinear group description BG: (G1, G2, GT, p, e, g, g~) and output it as public parameters pp. pp ← (G1, G2, GT, p, e, g, g~) ...(42)

[0104] Key generation: KeyGen(pp) generates a signing key and a verification key based on public parameters pp. : Select random numbers x and y uniformly from Zp: x, y ← R Z p , Verification key: vk ← (g~^x, g~^y), Signing key: sk ← (x, y) ...(43)

[0105] Signature: Sign(sk, (m, n^)) * Z * p Select a random number α uniformly at random from: α ← R Z * p , calculate a, b, c as follows: a ← g^ α , b ← m^α , c ← a^ x・ b^ y ...(44) Signature: σ = (a, b, c) ...(45)

[0106] Randomization: Rand(vk, (m, n~), σ) selects a random number r uniformly randomly from Zp: r ← R Z p , calculate a', b', c' as follows: a' ← a^r, b' ← b^r, c' ← c^r ...(46) Signature: σ' ← (a', b', c') ...(47)

[0107] Verification: Verify(vk, (m, n^), σ), vk= (g~ ^x , g~^ y ), σ = (a, b, c). 1, if a, b, c ∈ G1, a ≠ 1 G1 , and 1 if the following holds, otherwise 0 e(m, g~) = e(g, n~) ∧ e(a, n~) = e(b, g~) ∧ e(c, g~) = e(a, g~ -x )e(b, g~^ y ) ...(48)

[0108] Key homomorphism: Verification key vk= (g~^x, g~^y), differential key (shift amount) Δ = (Δ1, Δ2) ∈ Z 2 For p...(49), let vk' ← (g~^x・g^Δ1, g~y・g~^Δ2) σ' ← Rand(vk', (m, n~), (a, b, c ・a ^Δ1・b^Δ2 ))...(50). The transformed signature is given by (a', b', c')=(a^r, b^r, (a^x・b^y^r)=((g^α)^r, (m^α) ^r ,((g^α) ^(x+Δ1)・(m^α) ^(y+Δ2 )^r)...(51), which is a correct signature for the message pair (m, n~) under the verification key vk' =(g~^x・g^Δ1, g~y・g~^Δ2)...(52).

[0109] In equation (50), vk' is calculated based on the differential key Δ for the verification key vk. vk' = μ(Δ)vk ... (53) Therefore, the verification key vk is required in the key homomorphic operation, and the message M is also required. In the above example 3, the key homomorphic operation KHom can be expressed as follows: σ ← KHom(Δ,σ', M, vk) ... (54)

[0110] It should be noted that the first signature generation device 130 in the system configuration of FIG. 4 (where the verification key vk is made public) may also be configured to perform the key homomorphic operation KHom using the differential key Δ, the second signature σ′, the message M, and / or the verification key vk, as in the configurations described with reference to FIGS. 10 and 11 .

[0111] One application of digital signatures is authentication. A typical operational flow is for a user to generate a signature for a challenge message received from a service provider, and the service provider verifies the signature to confirm that the user possesses the signing key, i.e., that the user is a legitimate user. In this method, signing the challenge message allows it to be used for authentication, i.e., it enables biometric information to be matched while keeping the biometric information secret.

[0112] FIG. 12 is a schematic diagram illustrating an example in which the devices (120, 130, 140, 150) of the digital signature system 100 described above are implemented using computers equipped with communication functions and communicatively connectable to each other via a network. In FIG. 12(A), each device (120, 130, 140, 150) includes a processor 201, a storage device 202, an input / output device 203, and a communication interface 204. The storage device 202 may include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), a hard disk drive (HDD), a compact disc (CD), a digital versatile disc (DVD), or the like. The processor 201 executes a program (not shown) stored in the storage device 202 to realize the processing and functions of each device. The input / output device 203 may include a keyboard and a display. For example, the first signature creation device 130 may be configured to display and output the verification result (acceptance / rejection) from the verification device 150 on an output device such as a display. Furthermore, in the key generation device 120 and the second signature generation device 140 that acquire biometric information, the input device / output device 203 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) if the biometric information is a face, iris, or the like. In the case of a fingerprint, the sensor may be a fingerprint sensor, or in the case of finger veins, it may be, for example, an LED (Light Emitting Diode) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger. The sensor may also be a removable sensor, such as a USB (Universal Serial Bus) device. The communication interface 204 may include a network interface card, a transceiver, or the like, and may be configured to communicate with each other via a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, a wireless LAN, a mobile communication network, or the like.In addition, the communication interface 204 may be configured to be provided with an interface that communicates with an external sensor (e.g., a Bluetooth-connected sensor) in the key generation device 120 or the second signature generation device 140 and receives biometric information acquired by the external sensor.

[0113] FIG. 12B is a diagram illustrating an example in which the devices (120, 130, 140, 150) of the digital signature system 100 described above are implemented as virtual machines using server virtualization technology. Multiple virtual machines (VM) run on a virtualization platform 302, such as a hypervisor, implemented on a physical server machine 301. One or more of the devices (120, 130, 140, 150) of the digital signature system 100 may be implemented as virtual machines (VM). Although there is a single physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine (VM) is preferably configured to operate in an isolated environment in memory space. In this case, a program that realizes the processing of one of the devices (120, 130, 140, 150) runs on the virtual OS (Operating System) of the virtual machine. A virtual machine VM that virtually realizes one of the devices (120, 130, 140, 150) may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices (120, 130, 140, 150) via a LAN, a WAN such as the Internet, or the like via a physical interface (communication interface) of the physical machine 301.

[0114] For the first signature key x and the first biometric information w, if the first parameter s is the subtraction of ENC(x) and w (s = ENC(x) - w), and the second parameter s' is the value obtained by adding the differential key Δ to the first parameter s, then the value of x' in the above equation (17) for the second biometric information w' can be calculated by: x' = DEC(s' + w') ... (55) This is because: s' + w' = ENC(x) - w + ENC(Δ) + w' = ENC(x + Δ) + w' - w ... (56) and the calculation (addition) result of s' + w' contains the differential term w' - w between the first biometric information w and the second biometric information w'. In this case, if w' and w are equal or the error w'-w is within the range of correction capability, then x' = DEC(s'+w') = x + Δ ...(57).

[0115] Alternatively, the second parameter may be a value obtained by subtracting ENC(Δ), a value obtained by applying an encoding function (Encode) to the differential key Δ, from the first parameter (s = ENC(x) + w). That is, s' = s - ENC(Δ) = ENC(x) + w - ENC(Δ) ... (58) In this case, the above equation (17) becomes x' = DEC(s' - w') = ENC(x) + w + ENC(-Δ) - w' = ENC(x-Δ) + w - w' ... (59) If w and w' are equal or the error w - w' is within the range of correction capability, then x' = DEC(s' - w') = x - Δ ... (60) From the second signature σ' and the shift amount (-Δ), a signature σ using the first signature key x for the message M can be generated by the key homomorphic operation KHom.

[0116] In the above embodiment, a system that performs processing based on biometric information has been described as an example, but the present disclosure is not limited to biometric information and can also be realized using fuzzy information other than biometric information. For example, the present disclosure may be applied to a PUF (Physically Unclonable Function: a technology that uses individual differences that occur in the manufacturing process of IC chips, for example, to identify individuals (IC chips) in the same way as human fingerprints) that identifies semiconductor devices (IC (Integrated Circuit) chips).

[0117] The disclosures of Patent Documents 1 and 2 and Non-Patent Documents 1-3 are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the scope of the claims), and further based on the basic technical ideas thereof. Furthermore, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. In other words, the present invention naturally includes various modifications and alterations that would be possible for a person skilled in the art in accordance with the entire disclosure, including the scope of the claims, and the technical ideas thereof.

[0118] 100 Digital signature system 120 Key generation device 121 Biometric information acquisition unit 122 Signature key / verification key generation unit 123 First parameter generation unit 124 Verification key transmission unit 125 First parameter transmission unit 130 First signature generation device 131 First parameter acquisition unit 132 Storage unit 134 Message acquisition unit 135 Signature generation unit 136 Transmission unit 137 Verification key acquisition unit 140 Second signature generation device 143 Biometric information acquisition unit 144 Message acquisition unit 145 Signature generation unit 146 Transmission unit 150 Verification device 151 Verification key acquisition unit 152 Storage unit 154 Message acquisition unit 155 Signature acquisition unit 156 Signature verification unit 160 Key server (public key database) 170 Network (Internet) 200 Computer 201 Processor 202 Storage device 203 Input device / output device 204 Communication interface 300 Server 301 Physical machine 302 Virtualization platform 303 Virtual machine< / g>

Claims

1. A digital signature system comprising first and second signature generation devices, each having at least a processor and a communications interface, and communicatively connected to each other, wherein the first signature generation device executes a process of receiving first parameters created using a first signature key and first biometric information and storing the first parameters in a memory unit, a process of generating a differential key and generating second parameters from the differential key and the first parameters, and a process of transmitting the second parameters to the second signature generation device, wherein the second signature generation device executes a process of obtaining second biometric information and generating a second signature key from the second biometric information and the second parameters, a process of generating a second signature for a message using the second signature key, and transmitting the second signature to the first signature generation device, wherein the first signature generation device executes a process of receiving the second signature, and using at least the differential key and the second signature, generating and outputting a first signature that would result if the message were signed with the first signature key.

2. A digital signature system as claimed in claim 1, comprising: a key generation device having at least a processor and a communications interface, and executing the following processes: generating the first signature key and generating a verification key corresponding to the first signature key; acquiring the first biometric information, and generating the first parameters using an encoding key obtained by encoding the first signature key and the first biometric information; and transmitting the first parameters to the first signature generation device; and a verification device having at least a processor and a communications interface, and executing a process of using the verification key to verify the correctness of the message and the set of the first signature generated by the first signature generation device.

3. The digital signature system of claim 2, wherein the first signature generation device stores the first parameter received from the key generation device in the storage unit, generates the differential key, generates the second parameter from an encoded value of the differential key and the first parameter, and transmits the second parameter to the second signature generation device, the second signature generation device performs a calculation on the second parameter and the second biometric information, the calculation including a term for shifting the encoded first signature key with the encoded differential key and a difference term between the first biometric information and the second biometric information, decrypts a result of the calculation to generate the second signature key, generates the second signature for the message using the second signature key, and transmits the second signature to the first signature generation device, and the first signature generation device uses at least the second signature and the differential key to convert from the second signature to the first signature that would be obtained if the message were signed with the first signature key, which is the difference between the second signature key and the differential key.

4. A digital signature system as described in claim 3, wherein the first signature generation device obtains the message and / or the verification key, and uses the second signature and the differential key, as well as the message and / or the verification key, to convert the second signature into the first signature that results when the message is signed with the first signature key, which is the difference between the second signature key and the differential key.

5. A digital signature system as claimed in claim 3 or 4, wherein the key generation device and the first signature generation device respectively encode the first signature key and the differential key using an error correcting code or a lattice code, and the second signature generation device decodes the result of the calculation between the second parameter and the second biometric information using the error correcting code or the lattice code.

6. A key generation device having at least a processor and a communication interface, and performing the following processes: generating a first signature key; generating and publishing a verification key corresponding to the first signature key; acquiring the first biometric information; and generating a first parameter using an encoding key obtained by encoding the first signature key and the first biometric information.

7. A device having at least a processor and a communications interface, which performs the following processing: receiving second parameters obtained by calculating a value obtained by encoding a differential key to a first parameter generated using an encoded first signature key and first biometric information; acquiring second biometric information; performing a calculation between the second biometric information and the second parameter, the calculation including a term for shifting the encoded first signature key by the encoded differential key and a differential term between the first biometric information and the second biometric information; decrypting a result of the calculation to generate a second signature key; and generating a second signature for a message using the second signature key.

8. A digital signature method comprising: a step of a first node receiving first parameters created using first biometric information and a first signing key; a step of the first node generating a difference key, and generating second parameters from the difference key and the first parameters, and transmitting the second parameters to a second node; a step of the second node generating a second signing key from second biometric information acquired by the second node and the second parameters; a step of generating a second signature for an acquired message using the second signing key, and transmitting the second signature to the first node; and a step of the first node generating and outputting a first signature for the message when it is signed with the first signing key, using at least the second signature and the difference key.

9. A third node generates the first signing key, generates a verification key corresponding to the first signing key, and obtains the first biometric information, and generates the first parameter using a value obtained by encoding the first signing key and the first biometric information; a fourth node verifies the correctness of the message and the first signature set using the verification key; the first node generates the second parameter using a value obtained by encoding the differential key and the first parameter received from the third node, and transmits the second parameter to the second node; the second node obtains the second biometric information, performs an operation on the second parameter and the second biometric information, the operation including a term for shifting the encoded first signing key by the encoded differential key and a difference term between the first biometric information and the second biometric information, and decrypts a result of the operation to generate the second signing key; 9. The digital signature method according to claim 8, comprising: a step of the second node generating the second signature for the message using the second signing key and transmitting the second signature to the first node; and a step of the first node generating and outputting the first signature for the message using at least the second signature and the difference key, the first signature resulting from signing the message with the first signing key, which is the difference between the second signing key and the difference key.

10. A recording medium having recorded thereon a program for causing the first and second processing devices, which are communicatively connected to each other, to respectively execute the following processes: a process by the first processing device receiving first parameters created using first biometric information and a first signing key and storing them in a memory unit; a process by the second processing device generating a differential key, generating second parameters from the differential key and the first parameters, and transmitting the generated parameters to the second processing device; a process by the second processing device generating a second signing key from the acquired biometric information and the second parameters, generating a second signature for a message using the second signing key, and transmitting the generated signature to the first processing device; and a process by the first processing device generating and outputting a signature for the message using the second signature for the message and the differential key, which would result from signing the message with the first signing key.

Images