Information processing method, information processing system, and program

Abstract

The present disclosure pertains to an information processing method and an information processing system that enable the realization of a post quantum and highly secure practical digital signature, and also pertains to a program. The present invention sets s∈Rq as a secret key, sets F(s) comprising multi-order multivariate polynomials that form a Ring-MQ (multivariate quadratic) function as a public key, generates a digital signature on the basis of the secret key, and verifies whether the digital signature is normal by means of the public key. The present invention can be applied to a digital signature system.

Description

Information processing method, information processing system, and program

[0001] The present disclosure relates to an information processing method, an information processing system, and a program, and in particular to an information processing method, an information processing system, and a program that enable the realization of a practical electronic signature that is highly secure and quantum-resistant.

[0002] With the rapid development of information processing and communication technologies, the digitization of documents, both public and private, is progressing rapidly. Accordingly, electronic signatures are being used to safely manage electronic documents.

[0003] Digital signatures are used to identify the creator of an electronic document. Therefore, if a malicious third party forges a digital signature, the digital document may be forged, so high security is required.

[0004] To date, in order to increase the security of electronic signatures, signature schemes have been proposed that utilize difficult mathematical problems for which no efficient algorithms exist, such as the prime factorization problem or the discrete logarithm problem, which pose a high computational complexity.

[0005] However, when quantum computers are put into practical use, these mathematical problems will be able to be solved at a speed fast enough for practical use, and current electronic signature methods will no longer be able to provide sufficient security.

[0006] Therefore, an electronic signature method using multi-order multivariate problems has been proposed as a quantum-resistant problem that differs from problems that can be solved by quantum computers, such as the prime factorization problem and the discrete logarithm problem (see Patent Document 1).

[0007] JP 2012-098690 A

[0008] However, while electronic signature methods that utilize multi-order multivariate problems, such as the technology described in Patent Document 1, can improve quantum resistance, they are known to increase the data size of the electronic signature and slow down the calculation speed, making them impractical.

[0009] For this reason, despite the recognition that quantum resistance will be compromised, digital signature methods that utilize problems other than multi-order multivariate problems continue to be adopted.

[0010] The present disclosure has been made in light of the above circumstances, and in particular, makes it possible to realize a practical electronic signature that is quantum-resistant and highly secure.

[0011] In an information processing method according to one aspect of the present disclosure, s∈R ｑ as a private key, and F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function as a public key, and generating a digital signature based on the private key, and verifying whether the digital signature is authentic using the public key.

[0012] An information processing system and a program according to an embodiment of the present disclosure include a method for processing s∈R ｑ as a private key and F(s) consisting of a multi-degree multivariate polynomial forming a Ring-MQ (Multivariate Quadratic) function as a public key; an electronic signature generation unit that generates an electronic signature based on the private key; and an electronic signature verification unit that verifies whether the electronic signature is authentic using the public key; and a program that causes a computer to function as the key generation unit, the electronic signature generation unit, and the electronic signature verification unit.

[0013] In one aspect of the present disclosure, s∈R ｑ is set as a private key, F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function is set as a public key, a digital signature is generated based on the private key, and whether the digital signature is authentic or not is verified using the public key.

[0014] FIG. 1 is a diagram illustrating an overview of the present disclosure. FIG. 2 is a diagram illustrating a Ring-MQ function calculation process. FIG. 3 is a flowchart illustrating the Ring-MQ function calculation process of FIG. 2. FIG. 4 is a diagram illustrating an example of the configuration of an authentication protocol used in the electronic signature system of the present disclosure. FIG. 5 is a diagram illustrating an example of the configuration of a prover-side information processing device of FIG. 4. FIG. 6 is a diagram illustrating an example of the configuration of a verifier-side information processing device of FIG. 4. FIG. 7 is a flowchart illustrating authentication information verification processing by the authentication protocol of FIG. 4. MPC 1 is a diagram for explaining a soundness error, a soundness error, a signature length of a digital signature for each digital signature method, and an example of the configuration of a general-purpose computer.

[0015] Preferred embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted.

[0016] Hereinafter, embodiments of the present technology will be described. The description will be made in the following order: 1. Overview of the present disclosure 2. Preferred embodiments 3. Examples of implementation by software

[0017] <<1. Overview of the Present Disclosure>> <General Digital Signature Scheme> The present disclosure is directed to realizing a practical digital signature that is highly secure and quantum-resistant. Therefore, first, a general digital signature scheme will be briefly described.

[0018] FIG. 1 shows an electronic signature system for implementing a general electronic signature method.

[0019] Unlike paper documents, it is not possible to affix a seal or write a signature on digitized data. Therefore, to prove the creator of digitized data, an electronic mechanism that has the same effect as affixing a seal or writing a signature on a paper document is required. Such a mechanism is called an electronic signature. For example, a mechanism in which signature data known only to the data creator is associated with the data and provided to the recipient, and the recipient then verifies the signature data, is called an electronic signature method.

[0020] An electronic signature system 1 that realizes the electronic signature method is composed of, for example, a signer-side information processing device 2 and a verifier-side information processing device 3 .

[0021] The signer's information processing device 2 and the verifier's information processing device 3 are information processing devices used by the signer and the verifier, respectively, and are configured to be able to communicate with each other.

[0022] The signer side information processing device 2 includes a key generation unit Gen and an electronic signature generation unit Sig.

[0023] The key generation unit Gen generates a private key (signature key) sk unique to the signer and a public key (verification key) pk, and transmits and outputs only the public key pk to the verifier side information processing device 3.

[0024] The digital signature generation unit Sig applies a hash function to the document M to generate a hash value h. The digital signature generation unit Sig generates a digital signature σ based on the hash value h using the private key sk. The digital signature generation unit Sig then transmits the document M and the digital signature σ to the verifier-side information processing device 3.

[0025] On the other hand, the verifier side information processing device 3 includes a digital signature verification unit Ver.

[0026] Upon receiving the public key pk, the document M, and the digital signature σ, the digital signature verification unit Ver verifies the digital signature σ using the public key pk.

[0027] Therefore, the private key sk remains completely secret from anyone other than the signer, and the verifier proves that the signer has the private key sk.

[0028] (Digital Signature Scheme Using the LWE Problem) In the above, when a hash value h generated from a document M is signed using a private key sk, a digital signature σ is generated by signing the hash value h generated from the document M with the private key sk. At this time, it is assumed that the digital signature σ can only be verified with the public key pk, and that the private key sk cannot be found from the public key pk.

[0029] This is because the public key pk is generated by inputting the private key sk into a predetermined function, meaning that information signed with the private key sk can only be verified with the corresponding public key pk.

[0030] Therefore, if the private key sk can be obtained by performing a predetermined calculation from the public key pk, the confidentiality of the private key sk will be lost, making it possible for a third party to tamper with the document M.

[0031] Because the private key sk needs to be kept confidential, the predetermined function used to generate the public key pk from the private key sk has until now been a system using functions that are difficult to solve even using a computer, such as the prime factorization problem or the discrete logarithm problem. This has prevented the private key sk from being derived from the public key pk, and maintained the confidentiality of the private key sk.

[0032] However, with the advent of quantum computers, it has become possible to easily solve functions related to problems that were previously considered difficult to solve, such as the prime factorization problem and the discrete logarithm problem, because solution algorithms exist. In other words, with the advent of quantum computers, it has become possible to derive the private key sk from the public key pk, making it increasingly difficult to ensure the confidentiality of the private key sk.

[0033] In light of this, there is a demand for an electronic signature method that makes it difficult to derive the private key sk from the public key pk, even when using a quantum computer.

[0034] In the following, an electronic signature method in which it is difficult to derive a private key sk from a public key pk even using a quantum computer will also be referred to as a highly quantum-resistant electronic signature method or an electronic signature method using a quantum-resistant encryption method.

[0035] Therefore, a digital signature scheme using the LWE (Learning with Error) problem has been proposed as one of the quantum-resistant digital signature schemes. The following formula (1) shows an example of a function for generating a private key and a public key when using the LWE problem.

[0036]

[0037] Here, equation (1) defines the secret key as s∈(F ｑ ) ｎ When this is the case, (a ｉ , b ｉ ) is the public key. In other words, the formula (1) is made up of linear equations from i=1 to m, and each linear equation contains e ｉ The LWE (Learning with Error) problem is used to calculate the private key from the public key, making it difficult to calculate the matrix. This is why it is said that even with a quantum computer, it is impossible to derive the private key from the public key in a digital signature scheme that uses the LWE (Learning with Error) problem.

[0038] In addition, in formula (1), F ｑ It is expressed that s and a are finite fields of order q. ｉ is a vector. ｑ ) ｎ is expressed by adding a subscript q and a superscript n to the bold F in (1).

[0039] In the digital signature scheme using the LWE problem in equation (1), the number of instances is often m = n, and F ｑ element O(n ２ ) by vector dot product operation. ２ ) times are required.

[0040] However, in the case of the electronic signature method shown in formula (1), it is known that the data size of the electronic signature becomes large and the time cost involved in the calculation is high. Because of the high difficulty of the calculation, it is said that although it is possible to ensure security, it is not practical.

[0041] (Digital Signature Scheme Using the Ring-LWE Problem) Therefore, a digital signature scheme using the Ring-LWE problem as shown in the following formula (2) has been proposed.

[0042]

[0043] Here, equation (2) defines the secret key as s∈R. ｑ When this is the case, (a ｉ , b ｉ ) is the public key. In other words, equation (2) is composed of linear equations from i = 1 to m. However, in the digital signature scheme using the Ring-LWE problem, it is assumed that only m = 1 is used.

[0044] In addition, in formula (2), F ｑ It is expressed that a is a finite field of order q. a is not a vector but a polynomial. Also, s is not a vector but a polynomial.

[0045] Also, f(X) contains X Ｎ +1 (N: power of 2) is often used. Furthermore, m=1 is often used.

[0046] That is, when using the Ring-LWE problem, the number of instances is m=1, so F ｑ It is said that it can be expressed with O(n) elements.

[0047] As mentioned above, in the case of a digital signature scheme using the LWE problem, the number of multiplications is O(n ２ ) times were required.

[0048] On the other hand, in the case of a digital signature scheme using Ring-LWE, the instance (a, a·s+e) is calculated by FFT (Fast Fourier Transform) / NTT (Number-Theoretic Transform). ｑ The number of multiplications is O(n log n), which reduces the amount of calculation. Note that in the digital signature scheme using Ring-LWE, a and s are polynomials.

[0049] However, in the case of digital signature schemes using the Ring-LWE problem, in practice instances are often derived from a seed, so the effect of improving calculation speed is greater than the effect of reducing the data size of the digital signature.

[0050] Furthermore, in the case of a digital signature method obtained by applying the Fiat-Shamir transformation to an interactive protocol, the challenge space in the challenge-and-response based protocol used in the interactive protocol is F ｑ From R ｑ Therefore, the soundness error is reduced.

[0051] In other words, the electronic signature method using the Ring-LWE problem requires less computational effort than the electronic signature method using the LWE problem, can achieve faster calculation speeds, and can also reduce soundness errors.

[0052] (Electronic signature scheme using the multi-order multivariate problem (MQ problem)) Above, we have explained electronic signature schemes using the LWE (Learning with Error) problem and the Ring-LWE problem as examples of highly quantum-resistant electronic signature schemes.

[0053] However, the LWE problem is not the only difficult problem that has been proposed; other problems have also been proposed, and in recent years, a digital signature scheme using the multivariate quadratic problem (MQ) has also been proposed.

[0054] The MQ problem is a problem that uses MQ functions, and has long been recognized as being difficult. Therefore, digital signature schemes using the MQ problem have been known to be highly secure. However, it has been pointed out that digital signature schemes using the MQ problem are difficult to handle in practice, as the size of the digital signature increases and the calculation speed slows. For this reason, despite its recognized high reliability, digital signature schemes using the MQ problem have been avoided, and digital signature schemes using other problems that are not as quantum-safe as digital signature schemes using the MQ problem have been chosen instead.

[0055] The MQ function is, for example, m n-variable quadratic polynomials f1(x1, . . . , xn), . . . , fm(x1, . . . , xn) defined on a ring K.

[0056] For example, vector s = (s1, ..., sn) ∈ K ｎLet us consider the case where y = (y1, ..., ym) = (f1(s), ..., fm(s)) is calculated by substituting into this MQ function.

[0057] In this case, due to the characteristics of the MQ function, even if f1(x1, . . . , xn), . . . , fm(x1, . . . , xn) are known, restoring the vector s from y is a difficult process.

[0058] Therefore, by utilizing the characteristics of this MQ function and substituting the vector s, which serves as the private key, into the MQ function to obtain the value y, the value y is used as the public key. This is the electronic signature method using the MQ problem, which generates a highly confidential private key and public key.

[0059] More specifically, the function dealing with the MQ problem is, for example, a function as shown in the following equation (3).

[0060]

[0061] Here, equation (3) defines the secret key as s∈(F ｑ ) ｎ Then, F(s) is F(s) = s Ｔ A ｉ s+b ｉ Ｔ s+c ｉ In equation (3), s and b are quadratic polynomials, which are used as the public key. ｉ The "T" in the upper right corner is a transposition symbol.

[0062] That is, equation (3) is composed of m quadratic equations, where i = 1 to m, and it is said that because the degree is high, it cannot be solved quickly even with a quantum computer.

[0063] In equation (3), s and b written in bold are vectors, and A is a matrix.

[0064] In addition, in the digital signature scheme using the MQ problem shown in formula (3), the number of instances is often m=n. ｑ element O(n ３ ) can be expressed in F ｑ The number of multiplications is O(n ３ ) times are required.

[0065] Also, for each i, A ｉ Since s is the product of a matrix and a vector, the number of multiplications is n ２ In addition, s Ｔ And, (A ｉ s+b ｉ ) and the product (= s Ｔ A ｉ s+b ｉ Ｔ s) is a vector-vector multiplication, so it is n times, and the range of i is 1≦i≦m, so the total number of multiplications is mn ２ × mn. In other words, when m = n, which is often used as a parameter, the total number of multiplications is n ３ +n ２ This will be the number of times.

[0066] As such, electronic signature methods using the MQ problem are known to be highly secure, but because they require a large amount of calculation and it is not possible to increase the calculation speed, they are considered to be difficult to use in practice.

[0067] (Electronic signature method using the Ring-MQ problem) Therefore, in this disclosure, we propose an electronic signature method in which the MQ problem is replaced with the Ring-MQ problem, just as in the case where the LWE problem is replaced with the Ring-LWE problem, thereby making it possible to increase the computational complexity and computational speed of the electronic signature method.

[0068] The Ring-MQ problem is to define the secret key as s∈R. q When this is done, two multiplications are performed in order, one of which is F ｑ It consists of multiplication and addition operations of R q The problem is to find s from the value of the public key F(s) related to the Ring-MQ function F, which is composed of the above multiplications.

[0069] More specifically, as shown in FIG. 2, the Ring-MQ function calculation process is a F algorithm of an input secret key s and a parameter A. ｑ The sum-of-products calculation process C1 executes the sum-of-products calculation above, and the calculation result of the sum-of-products calculation process C1 and the secret key s are used to calculate the sum-of-products. ｑ This is realized by the multiplication process C2 that performs the above multiplication (product).

[0070] The Ring-MQ function calculation process in FIG. 2 obtains a public key F(s) from an input private key s by the process shown in the flowchart in FIG.

[0071] That is, in step S1, the product-sum calculation process C1 sets a parameter A.

[0072] In step S2, the product-sum calculation process C1 receives input of the secret key s.

[0073] In step S3, the product-sum calculation process C1 performs F of the parameter A and the secret key s. ｑ The sum of products is calculated and output to the multiplication process C2.

[0074] In step S4, the multiplication process C2 is performed to obtain the F of the parameter A and the secret key s. ｑ The product is obtained by multiplying the product-sum calculation result in by the secret key s.

[0075] In step S5, the multiplication process C2 is performed to obtain the F of the parameter A and the secret key s. ｑ The multiplication result obtained by multiplying the product-sum calculation result in by the private key s is output as the public key F(s).

[0076] Through the above process, the public key F(s) is obtained from the private key s. At this time, the problem of obtaining the private key s from the public key F(s) is the Ring-MQ problem.

[0077] More specifically, the Ring-MQ problem is a problem of finding a private key s from the value of a public key F(s) shown in the following equation (4).

[0078]

[0079] Here, equation (4) defines the secret key as s∈R. ｑ Then, F(s) = s・A ｉ (s) + b ｉ s+c ｉ is the public key. s is not a vector but a polynomial. Furthermore, although equation (4) is composed of quadratic equations with i=1 to m, the number of instances is assumed to be m=1.

[0080] Therefore, in the digital signature scheme using the Ring-MQ problem of formula (4), the instance is F ｑ element O(n ２ ) units. ｑ The number of multiplications is O(n ２ ) times, and the number of multiplications in the MQ problem is O(n ３ ) times, it will be smaller than that.

[0081] Furthermore, since the number of instances corresponding to the function in the Ring-MQ problem is assumed to be m = 1, F of A(s) ｑ The above multiplication count is calculated as follows:

[0082] That is, the operation of making the elements of Rq correspond to a vector is defined as vec, as shown in the following equation (5).

[0083]

[0084] Also, from the definition of A, the corresponding a ｉｊ ∈F ｑ (a finite field of order q), calculation can be performed as shown in the following equation (6).

[0085]

[0086] As shown in equation (6), multiplication appears only in matrix operations, so the number of multiplications is n ２ This will be the number of times.

[0087] Furthermore, R between s and (A(s)+b) ｑ The above multiplication (= s・A ｉ (s) + b ｉ s) is obtained by padding the n coefficients of s to 2n-1 with zeros and then using FFT. ｑ The number of multiplications above is 3n log 2n + 4n times.

[0088] That is, in the case of a digital signature scheme using the MQ problem, the private key s is composed of a vector, but in the case of a digital signature scheme using the Ring-MQ problem, the private key s is a polynomial rather than a vector. Therefore, in the digital signature scheme using the Ring-MQ problem, it is possible to reduce the amount of calculation required for processing while ensuring security equivalent to that of the scheme using the MQ problem.

[0089] Similarly to the case where the LWE problem is turned into a Ring-LWE problem, when the MQ problem is turned into a Ring-MQ problem, the challenge space is F ｑ From R ｑ Therefore, the soundness error is reduced.

[0090] As described above, by using the Ring-MQ problem instead of the MQ problem in an electronic signature scheme, it is possible to reduce the amount of calculation and increase the calculation speed without reducing the security obtained by using the MQ problem, and it is also possible to reduce soundness errors.

[0091] This makes it possible to realize a practical digital signature scheme using the MQ problem by using the Ring-MQ problem.

[0092] As a result, it is possible to realize a practical electronic signature scheme that is highly secure and quantum-resistant.

[0093] Therefore, hereinafter, a digital signature system that applies a digital signature method using the Ring-MQ problem proposed in this disclosure will be described.

[0094] <<2. Preferred Embodiment>> Next, an example configuration of an electronic signature system will be described when the technology of the present disclosure is applied to the general electronic signature system of Fig. 1. This example configuration is obtained by applying a known method (such as Fiat-Shamir transformation) to convert an authentication protocol configuration example using the Ring-MQ problem into an electronic signature system. Therefore, in the following explanation, an example configuration of an authentication protocol using the Ring-MQ problem will be described with reference to Fig. 4. Regarding the conversion from an authentication protocol to an electronic signature system, an example using Fiat-Shamir transformation will be described after the explanation of the authentication protocol.

[0095] The authentication protocol 11 in FIG. 4 is a protocol in which a verifier verifies that a prover holds a private key, without knowing the prover's private key, based on signature information (electronic signature) generated using a private key held only by the prover.

[0096] The authentication protocol 11 comprises a prover-side information processing device 31 used by the prover, and a verifier-side information processing device 32 used by the verifier.

[0097] In the authentication protocol 11, the prover side information processing device 31 returns a response to a challenge from the verifier side information processing device 32, and the verifier side information processing device 32 verifies the contents of the response, thereby executing an authentication protocol to verify that the prover holds the private key.

[0098] The authentication protocol in authentication protocol 11 is an interactive protocol consisting of an odd number of passes, such as three passes or five passes, depending on the number of exchanges between two parties. Note that, in the following of this disclosure, an example of five passes will be described, but the number of passes may be three passes or seven passes or more, as long as it is an odd number.

[0099] The prover information processing device 31 is included in the signer information processing device 2 of Fig. 1, and includes a key generation unit 51 and an authentication information generation unit 52. The unit that receives the hash values ​​h1 and h2 of the verifier information processing device 32 and generates challenges ε and ch accordingly is also included in the signer information processing device 2 of Fig. 1.

[0100] The key generation unit 51 generates a private key sk and a public key pk to be used for the electronic signature, and supplies the public key pk to the verifier-side information processing device 32 for sharing. Here, the private key sk=s and the public key pk=(A, b, y) are assumed, where y is a function that deals with the Ring-MQ problem, i.e., y=s·A(s)+b·s. Furthermore, since the private key sk=s is a function that deals with the Ring-MQ problem, the private key s is a polynomial, and is not a vector as in the case of dealing with the MQ problem.

[0101] The authentication information generation unit 52 generates hash values ​​h1 and h2 and supplies them to the verifier information processing device 32. At this time, after supplying the hash value h1 to the verifier information processing device 32, the authentication information generation unit 52 acquires a challenge ε ​​selected and supplied (returned) by the verifier, generates a hash value h2 using the challenge ε, and transmits the hash value h2 to the verifier information processing device 32.

[0102] After transmitting the hash value h2, the authentication information generation unit 52 generates a response σ′, which is signature information, based on the challenge ch supplied from the verifier side information processing device 32, and supplies it to the verifier side information processing device 32 together with the document M.

[0103] The verifier information processing device 32 includes an authentication information verification unit 71. The authentication information verification unit 71 receives the document M and the response σ′ and verifies the response σ′. The configuration that realizes the function corresponding to the authentication information verification unit 71 is included in the verifier information processing device 3 in FIG. 1.

[0104] The authentication information verification unit 71 acquires the hash values ​​h1 and h2 supplied from the prover side information processing device 31, and generates a challenge using an algorithm related to the Fiat-Shamir transformation, and supplies it to the prover side information processing device 31.

[0105] More specifically, the authentication information verification unit 71 acquires the hash value h1 when it is supplied from the prover side information processing device 31, then selects a challenge ε ​​and supplies it to the prover side information processing device 31. The authentication information verification unit 71 then acquires a hash value h2 generated based on the challenge ε, and after acquiring the hash value h2, generates a challenge ch and supplies it to the prover side information processing device 31.

[0106] When the authentication information verification unit 71 acquires the response σ′ supplied from the prover-side information processing device 31 along with the document M based on the challenge ch, it uses the pre-shared public key pk and the information contained in the response σ′ to calculate hash values ​​h1′ and h2′ corresponding to the hash values ​​h1 and h2, and verifies whether the response σ′ is legitimate by comparing it with the hash values ​​h1 and h2 supplied in generating the challenge.

[0107] In Figure 4, the path along which the authentication information generation unit 52 supplies the hash value h1 is the first path, the path along which the authentication information verification unit 71 supplies the challenge ε ​​is the second path, the path along which the authentication information generation unit 52 supplies the hash value h2 is the third path, the path along which the authentication information verification unit 71 supplies the challenge ch is the fourth path, and the path along which the authentication information generation unit 52 supplies the document M and the response σ' is the fifth path.

[0108] That is, the five passes from the first pass to the fifth pass are the odd-numbered five-pass process described above. Note that the process in which the key generation unit 51 supplies the public key pk to the authentication information verification unit 71 is a process prior to the fifth pass. In addition, the verifier information processing device 32 may separately transmit the verification result of the response σ' to the prover information processing device 31.

[0109] <Configuration Example of Prover-Side Information Processing Device> Next, a configuration example of the prover-side information processing device 31 will be described with reference to FIG.

[0110] The prover side information processing device 31 is composed of a control unit 101, an input unit 102, an output unit 103, a memory unit 104, a communication unit 105, a drive 106, and a removable storage medium 107, which are connected to each other via a bus 108 and can send and receive data and programs.

[0111] The control unit 101 is composed of a processor and a memory, and controls the overall operation of the prover side information processing device 31. The control unit 101 also includes a key generation unit 51 and an authentication information generation unit 52. Note that the key generation unit 51 and the authentication information generation unit 52 have been explained with reference to Fig. 4, so their explanation will be omitted.

[0112] The input unit 102 is made up of input devices such as a keyboard, a mouse, and a touch panel through which a user inputs operation commands, and supplies various input signals to the control unit 101 .

[0113] The output unit 103 is controlled by the control unit 101 and includes a display unit and an audio output unit. The output unit 103 outputs and displays an operation screen and images of processing results on the display unit, which is made up of a display device such as an LCD (Liquid Crystal Display) or an organic EL (Electro Luminescence) display. The output unit 103 also controls the audio output unit, which is made up of an audio output device, to play various sounds, music, sound effects, and the like.

[0114] The storage unit 104 is composed of a hard disk drive (HDD), a solid state drive (SSD), or a semiconductor memory, and is controlled by the control unit 101 to write or read various data and programs.

[0115] The communication unit 105 is controlled by the control unit 101 and realizes communication via wired or wireless means, such as LAN (Local Area Network) or Bluetooth (registered trademark), and transmits and receives various data and programs to and from the verifier side information processing device 32 and various other devices via the network as necessary.

[0116] The drive 106 reads and writes data from and to a removable storage medium 107 such as a magnetic disk (including a flexible disk), an optical disk (including a CD-ROM (Compact Disc-Read Only Memory) and a DVD (Digital Versatile Disc)), a magneto-optical disk (including an MD (Mini Disc)), or a semiconductor memory.

[0117] <Configuration Example of Verifier Information Processing Device> Next, a configuration example of the verifier information processing device 32 will be described with reference to FIG.

[0118] The verifier side information processing device 32 is composed of a control unit 131, an input unit 132, an output unit 133, a memory unit 134, a communication unit 135, a drive 136, and a removable storage medium 137, which are connected to each other via a bus 138 and can send and receive data and programs.

[0119] The control unit 131 is composed of a processor and a memory, and controls the overall operation of the verifier information processing device 32. The control unit 131 also includes an authentication information verification unit 71. Note that the authentication information verification unit 71 has been described with reference to FIG. 4, so its description will be omitted.

[0120] The components from the input unit 132 to the bus 138 have the same configuration as the components from the input unit 102 to the bus 108 described with reference to FIG. 5, and therefore a description thereof will be omitted.

[0121] <Authentication Information Verification Processing> Next, the authentication information verification processing according to the authentication protocol 11 in FIG. 4 will be described with reference to the flowchart in FIG.

[0122] In step S31, the key generating unit 51 of the prover side information processing device 31 generates a secret key sk. In this example, as described above, the secret key sk is set as sk=s.

[0123] In step S32, the key generation unit 51 generates a public key pk based on the private key sk, supplies the private key sk and the public key pk together to the authentication information generation unit 52, and controls the communication unit 105 to distribute and share the public key pk with the verifier side information processing device 32.

[0124] The public key pk is defined as pk=(A, b, y), where y is a function y=s·A(s)+b·s consisting of a multi-degree multivariate polynomial that deals with the Ring-MQ problem.

[0125] In step S 51 , the authentication information verifying unit 71 of the verifier information processing device 32 controls the communication unit 135 to obtain the public key pk supplied from the prover information processing device 31 .

[0126] In step S33, the authentication information generating unit 52 calculates a hash value h1 by calculating the following equation (7), and transmits the hash value h1 to the verifier side information processing device 32.

[0127]

[0128] That is, "Generate seed tree {seed ｉ}i=1,...,N [s] ｉ , [a] ｉ , [c] ｉ ←seed ｉ , the authentication information generating unit 52 generates a seed value seed for i=1, . . . N−1. ｉ and a seed value seed ｉ Based on this, a random number [s] ｉ , [a] ｉ , [c] ｉ Generate.

[0129] The authentication information generating unit 52 also generates a random number [s] ｉ , [a] ｉ , [c] ｉ Based on this, a = [a] １ + ... + [a] N , c=-a・s, [s] N = s - [s] １ - ... - [s] N－１ and [c] N = c - [c] １ - ... - [c] N－１ Calculate.

[0130] Furthermore, the authentication information generating unit 52 generates a seed value seed for i=1, . . . N−1. ｉMultiplying this by the Comm function gives the commitment value Comm ｉ =Comm(seed ｉ ) and for i=N, the commitment value comm Ｎ =Comm(seed Ｎ , [s] Ｎ , [c] Ｎ ) is calculated.

[0131] Then, the authentication information generating unit 52 generates the commitment value comm ｉ is multiplied by the hash function Hash to obtain a hash value h1=Hash(M, comm １ , ..., comm Ｎ ) and transmits it to the verifier side information processing device 32.

[0132] In step S52, the authentication information verifying unit 71 acquires the hash value h1 supplied from the prover side information processing device 31.

[0133] In step S53, the authentication information verification unit 71 calculates q ｎ Ring R exists as a street ｑ Then, the authentication information verifying unit 71 transmits the selected challenge ε ​​to the prover side information processing device 31.

[0134]

[0135] In step S 34 , the authentication information generating unit 52 acquires the challenge ε ​​from the verifier side information processing device 32 .

[0136] In step S35, the authentication information generating unit 52 calculates a hash value h2 by calculating the following equation (9), and transmits the hash value h2 to the verifier side information processing device 32.

[0137]

[0138] That is, the authentication information generating unit 52 generates [z] for i=1, . . . , N. ｉ = y - b [s] ｉ , [w] ｉ = A([s] ｉ ), [α] ｉ= ε · [w] ｉ + [a] ｉ , α = [α] １ +...+[α] Ｎ Calculate.

[0139] Furthermore, the authentication information generating unit 52 generates [v] for i=1, . . . , N. ｉ = α · [s] ｉ -[c] ｉ −ε ⋅ [z] ｉ Calculate.

[0140] Furthermore, the authentication information generating unit 52 generates a predetermined set of broad ｉ = ([α] ｉ , [v] ｉ ) to create a

[0141] Then, the authentication information generating unit 52 generates a set of broad ｉ is multiplied by the hash function Hash to obtain a hash value h2 = Hash(M, broad １ ,...,broad Ｎ ) and transmits it to the verifier side information processing device 32.

[0142] In step S54, the authentication information verifying unit 71 acquires the hash value h2 supplied from the prover side information processing device 31.

[0143] In step S55, the authentication information verification unit 71 selects which of the N verification patterns to use, as shown in the following equation (10). ｉ Then, the authentication information verification unit 71 issues the selected verification pattern as a challenge ch and transmits it to the prover side information processing device 31.

[0144]

[0145] In step S36, the authentication information generating unit 52 acquires the challenge ch from the verifier side information processing device 32.

[0146] In step S37, the authentication information generating unit 52 generates a response σ′ by calculating the following formula (11), and transmits it together with the document M to the verifier side information processing device 32 as a response.

[0147]

[0148] That is, "Generate path from {seed ｉ} ｉ As shown by "seed value and ch", the authentication information generating unit 52 ｉ Based on the challenge channel, seed ｃｈ Seed value other than ｉ A value path called a seed tree path is generated for calculating

[0149] Furthermore, the authentication information generating unit 52 generates a value view according to the challenge ch. If the challenge ch is N, the value view is set to the value path itself. Otherwise (if the challenge ch is other than N), the value view is set to {path, [s] Ｎ , [c] Ｎ}.

[0150] Then, the authentication information generating unit 52 calculates the value view and [α] ｃｈ , comm ｃｈ Based on this, the response σ′={view, [α] ｃｈ , comm ｃｈ} and transmits it together with the document M to the verifier side information processing device 32.

[0151] In step S56, the authentication information verification unit 71 obtains the response σ′ and the document M.

[0152] In step S57, the authentication information verification unit 71 calculates the following equation (12) to analyze the response σ′ and calculates hash values ​​h1′ and h2′ in the challenge ch that correspond to the hash values ​​h1 and h2 in the challenge ch.

[0153]

[0154] That is, "For i≠ch seed" in equation (12) ｉ ←view com ｉ = comm(seed ｉ ) [s] ｉ , [a] ｉ , [c] ｉ ←seed ｉ ", the authentication information verification unit 71 checks the seed value seed for i other than i=ch. ｉ Let view be the function comm ｉ = comm(seed ｉ ) (where, for i=N, comm(seed Ｎ , [s] Ｎ , [c] Ｎ ) and calculate the random number [s] ｉ , [a] ｉ , [c] ｉ Generate.

[0155] In addition, the authentication information verification unit 71 checks whether [z] is true for i other than i=ch. ｉ = y - b [s] ｉ , [w] ｉ = A([s] ｉ ), [α] ｉ = ε · [w] ｉ + [a] ｉ Furthermore, the authentication information verification unit 71 calculates α=[α] １ +...+[α] Ｎ That is, the authentication information verification unit 71 calculates [α] other than i=ch derived using the public key pk. ｉ and the sum of [α] included in the response σ ｃｈ α is calculated by adding

[0156] Furthermore, the authentication information verification unit 71 checks whether [v] is true for i other than i=ch. ｉ = α · [s] ｉ -[c] ｉ −ε ⋅ [z] ｉ Calculate.

[0157] Also, the authentication information verification unit 71 checks whether [v] ｃｈ =-[v] １ - ... - [v] NThat is, the authentication information verification unit 71 calculates [v] other than i=ch. ｉ By subtracting all of [v] ｃｈ Calculate.

[0158] Then, the authentication information verification unit 71 checks whether the set broad ｉ = ([α] ｉ , [v] ｉ The authentication information verification unit 71 calculates the commitment value comm ｉ is multiplied by the hash function Hash to obtain a hash value h1′=Hash(M, comm １ , ..., comm Ｎ The authentication information verification unit 71 generates a set of broad ｉ is multiplied by the hash function Hash to obtain a hash value h2′=Hash(M, broad １ ,...,broad Ｎ ) to generate the

[0159] That is, the authentication information verification unit 71 derives the commitment value comm other than i=ch derived using the document M and the public key pk. ｉ , and the commitment value comm for i=ch included in the response σ′ ｃｈ is used to generate a hash value h1'.

[0160] In addition, the authentication information verification unit 71 uses the document M and the public key pk to derive a set broad other than i=ch. ｉ (=([α] ｉ , [v] ｉ )) and [α] of i=ch included in response σ' ｃｈ And the derived [v] ｃｈ The set obtained from ｃｈ (=([α] ｃｈ , [v] ｃｈ )) to generate a hash value h2'.

[0161] That is, the authentication information verification unit 71 calculates hash values ​​h1' and h2' corresponding to the hash values ​​h1 and h2 from the public key pk and the response σ'.

[0162] In step S58, the authentication information verification unit 71 determines whether or not the hash values ​​h1 and h2 obtained before generating the challenge ch match the corresponding hash values ​​h1' and h2', as shown in equation (13).

[0163]

[0164] If the two match in step S58, the process proceeds to step S59, and the authentication information verification unit 71 determines that the response σ′ is authentic.

[0165] If the two do not match in step S60, the process proceeds to step S60, and the authentication information verification unit 71 determines that the response σ′ is not authentic.

[0166] In step S61, the authentication information verification unit 71 transmits the verification result to the prover side information processing device 31.

[0167] In step S38, the authentication information generating unit 52 acquires the verification result.

[0168] Here, we will explain the conversion from an authentication protocol using the Fiat-Shamir transformation to an electronic signature system. Through the above series of processes, it becomes possible to verify whether a response σ′ is legitimate by comparing hash values ​​h1 and h2 generated by the prover-side information processing device 31 with hash values ​​h1′ and h2′ generated from a response σ′ based on hash values ​​h1 and h2 in the verifier-side information processing device 32 using a function that handles the Ring-MQ problem. In the above authentication protocol 11, instead of receiving a challenge ε ​​and ch from the verifier, the prover generates a challenge ε ​​and ch using hash values ​​(e.g., h1 and h2) generated immediately before receiving the challenge, sets an electronic signature σ=(h1, h2, σ′), and regards the prover as the signer. This allows the technology disclosed herein to be applied to the electronic signature system 1 of FIG. 1.

[0169] Furthermore, by applying the technology of the present disclosure, in the calculation of the following formula (14) for finding [z] in formula (9) and formula (12) when calculating the hash value h2, F ｑThe number of multiplications required is O(n log n).

[0170]

[0171] On the other hand, in a conventional digital signature verification process using a function that handles the MQ problem, the calculation of the above-mentioned formula (14) is performed as shown in the following formula (15).

[0172]

[0173] That is, in equation (15), for i=1, . . . N, γ ｉ and (y ｉ -b ｉ [s] ｉ ) and the sum of products is calculated.

[0174] As a result, F in the calculation of equation (15) ｑ The number of multiplications required is O(n ２ ) times. Therefore, in the digital signature verification process using the function that handles the Ring-MQ problem of the present disclosure, ｑ The number of multiplications O(n log n) for this is O(n log n), which is the number of multiplications using a function that handles the conventional MQ problem. ２ ) times, it is possible to reduce the amount of calculation and improve the calculation speed.

[0175] For a digital signature method using functions that deal with the conventional MQ problem, please refer to "Building MPCitH-based Signatures from MQ, MinRank, RankSD and PKP Thibauld Feneuil1,2 1CryptoExperts, Paris, France 2Sorbonne Universit´e, CNRS, INRIA, Institut de Math´ematiques de Jussieu-Paris Rive Gauche, Ouragan, Paris, France". Also, hereinafter, "Building MPCitH-based Signatures from MQ, MinRank, RankSD and PKP Thibauld Feneuil1,2 1CryptoExperts, Paris, France 2Sorbonne Universit´e, CNRS, INRIA, Institut de Math´ematiques de Jussieu-Paris Rive Gauche, Ouragan, Paris, France" will be simply referred to as the reference.

[0176] Also, for i=1,...,N, γ ｉ Since the above is not necessary, the respective sampling steps themselves are not necessary, and the calculation load can be reduced.

[0177] This allows us to solve the Ring-MQ problem (R ｑ In the digital signature verification process of the present disclosure using ｑ :=F ｑ Using the degree deg f of the polynomial f used when defining [X] / (f(X)), (1 / (q ｄｅｇ ｆ )), whereas in the digital signature verification process using a function that handles the conventional MQ problem, (2 / q-1 / q ２ ) and can be made smaller.

[0178] In other words, the electronic signature verification process disclosed herein can reduce the amount of calculation and improve the calculation speed, while also reducing the false-positive probability, enabling more accurate electronic signature verification.

[0179] <Comparison of Communication Amounts Between Digital Signature Methods Using the Ring-MQ Problem and the MQ Problem> Next, a comparison of communication amounts between digital signature methods using the Ring-MQ problem and the MQ problem will be described.

[0180] According to the above-mentioned reference, the amount of communication when the above-mentioned MPC (Multi-Party Computation) is converted into ZKP using MPCitH (Sacrificing) is expressed by the following equation (16).

[0181]

[0182] where λ is a security parameter, τ is the number of parallel repetitions, N is the number of parties in the MPC, and cost MPC is the traffic-dependent part of the MPC protocol.

[0183] Furthermore, the cost MPC is expressed as shown in Fig. 8. In Fig. 8, from the top to the left, the cost of the part that depends on the communication volume of the MPC protocol is shown for each of the digital signature scheme that handles the MQ problem without using an extension field, the digital signature scheme that handles the MQ problem using an extension field, and the digital signature scheme that handles the Ring-MQ problem of the present disclosure. MPC and Soundness Error.

[0184] In other words, in the case of a digital signature scheme that deals with the MQ problem without using an extension field, the partial cost that depends on the communication volume of the MPC protocol is MPC is ((2n+1) log q), and the soundness error is (1 / N+(1-1 / N)-(2 / q-1 / q ２ )).

[0185] In addition, in the case of a digital signature scheme that deals with the MQ problem using an extension field, the partial cost that depends on the communication volume of the MPC protocol is MPC is ((n+nη+η)·log q) using the parameter η used in the reference, and the soundness error is (1 / N+(1−1 / N)·(2 / q η −1 / q ２η )).

[0186] Furthermore, in the case of the digital signature method that deals with the Ring-MQ problem of this disclosure, the partial cost that depends on the communication volume of the MPC protocol MPC is ((3deg f) log q), and the soundness error is (1 / N + (1-1 / N) (2 / q ｄｅｇ ｆ )).

[0187] From these comparisons, it is clear that the electronic signature scheme that deals with the Ring-MQ problem disclosed herein can reduce communication volume when compared with electronic signature schemes that deal with the MQ problem without using extension fields and electronic signature schemes that deal with the MQ problem using extension fields.

[0188] <Comparison of Signature Lengths of Digital Signatures> Next, a comparison of the signature lengths of digital signatures in digital signature schemes using the Ring-MQ problem and the MQ problem will be described with reference to FIG.

[0189] Figure 9 shows, from the top right of the figure, information regarding the signature length for each of the electronic signature schemes that deal with the MQ problem without using an extension field, the electronic signature scheme that deals with the MQ problem using an extension field, and the electronic signature scheme that deals with the Ring-MQ problem of the present disclosure.

[0190] In addition, in FIG. 9, from the right in the figure, the number of parties N in the MPC, the field F ｑ the order q of the ｑ the degree n (=deg f) of the modulus polynomial f of the algorithm, the number of parallel repetitions τ, and the signature length.

[0191] That is, in the case of a digital signature scheme that handles the MQ problem without using an extension field, the number of MPC parties N is 256, q is 256, η is 1, n is 40, the number of parallel repetitions τ is 39, and the signature size is 9463B.

[0192] In addition, in the case of a digital signature scheme that handles the MQ problem using an extension field, the number of MPC parties N is 256, q is 256, η is 2, n is 40, the number of parallel repetitions τ is 25, and the signature length (Signature Size) is 7114B.

[0193] In the case of the electronic signature scheme that deals with the Ring-MQ problem disclosed herein, the number of MPC parties N is 256, q is 256, η is -, n is 40, the number of parallel repetitions τ is 16, and the signature size is 4544B.

[0194] As shown in FIG. 9, it is clear that the electronic signature method disclosed herein that addresses the Ring-MQ problem can reduce the encryption cost to approximately half of that of other electronic signature methods.

[0195] As a result, the digital signature method of the present disclosure that addresses the Ring-MQ problem makes it possible to improve communication speed and processing speed related to calculations.

[0196] As described above, the electronic signature method using the function that deals with the Ring-MQ problem disclosed herein makes it possible to reduce the amount of calculation, improve the calculation speed, and reduce the load associated with the calculation.

[0197] Furthermore, since it is possible to reduce the amount of communication and the signature length, it is possible to improve the communication speed and reduce the load related to communication.

[0198] By using a function that handles the Ring-MQ problem, it is possible to reduce the amount of calculation and communication, thereby reducing the load related to calculation and communication, and making it possible to make the electronic signature method practical while ensuring the security of the electronic signature method for the MQ problem.

[0199] As a result, it is possible to realize a practical electronic signature system that is highly secure and quantum-resistant.

[0200] Although the above description has been given of an example relating to a digital signature system, it may also be applied to a stream cipher.

[0201] <<3. Example of Execution by Software>> The above-described series of processes can be executed by hardware, but can also be executed by software. When the series of processes is executed by software, the program constituting the software is installed from a recording medium into a computer incorporated in dedicated hardware, or into, for example, a general-purpose computer that can execute various functions by installing various programs.

[0202] 10 shows an example of the configuration of a general-purpose computer. This computer has a built-in CPU (Central Processing Unit) 1001. An input / output interface 1005 is connected to the CPU 1001 via a bus 1004. A ROM (Read Only Memory) 1002 and a RAM (Random Access Memory) 1003 are connected to the bus 1004.

[0203] The input / output interface 1005 is connected to an input unit 1006 including input devices such as a keyboard and a mouse through which a user inputs operation commands, an output unit 1007 that outputs a processing operation screen and images of processing results to a display device, a storage unit 1008 including a hard disk drive or the like that stores programs and various data, and a communication unit 1009 including a LAN (Local Area Network) adapter or the like that executes communication processing via a network typified by the Internet. Also connected is a drive 1010 that reads and writes data from / to a removable storage medium 1011 such as a magnetic disk (including a flexible disk), an optical disk (including a CD-ROM (Compact Disc-Read Only Memory) and a DVD (Digital Versatile Disc)), a magneto-optical disk (including an MD (Mini Disc)), or a semiconductor memory.

[0204] The CPU 1001 executes various processes in accordance with a program stored in a ROM 1002 or a program read from a removable storage medium 1011 such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, installed in a storage unit 1008, and loaded from the storage unit 1008 into a RAM 1003. The RAM 1003 also stores data necessary for the CPU 1001 to execute various processes as appropriate.

[0205] In a computer configured as described above, the CPU 1001 performs the above-described series of processes by, for example, loading a program stored in the memory unit 1008 into the RAM 1003 via the input / output interface 1005 and the bus 1004 and executing it.

[0206] The program executed by the computer (CPU 1001) can be provided by being recorded on a removable storage medium 1011 such as a package medium, for example. The program can also be provided via a wired or wireless transmission medium such as a local area network, the Internet, or digital satellite broadcasting.

[0207] In a computer, a program can be installed in the storage unit 1008 via the input / output interface 1005 by inserting a removable storage medium 1011 into the drive 1010. The program can also be received by the communication unit 1009 via a wired or wireless transmission medium and installed in the storage unit 1008. Alternatively, the program can be installed in advance in the ROM 1002 or the storage unit 1008.

[0208] The program executed by the computer may be a program that processes in chronological order according to the order described in this specification, or may be a program that processes in parallel or at the required timing, such as when called.

[0209] 10 realizes the functions of the control unit 101 in FIG. 5 and the control unit 131 in FIG.

[0210] In this specification, a system refers to a collection of multiple components (devices, modules (components), etc.), regardless of whether all of the components are housed in the same housing. Therefore, multiple devices housed in separate housings and connected via a network, and a single device housed in a single housing with multiple modules, are both systems.

[0211] The embodiments of the present disclosure are not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present disclosure.

[0212] For example, the present disclosure can be configured as a cloud computing system in which a single function is shared and processed collaboratively by multiple devices via a network.

[0213] Furthermore, each step described in the above flowchart can be executed by one device, or can be shared and executed by a plurality of devices.

[0214] Furthermore, when one step includes multiple processes, the multiple processes included in that one step can be executed by one device or can be shared and executed by multiple devices.

[0215] The present disclosure can also be configured as follows: <1> s∈R ｑan information processing method comprising the steps of: setting a private key F(s) as an F(s) and a public key F(s) consisting of a multi-degree multivariate polynomial forming a Ring-MQ (Multivariate Quadratic) function; generating a digital signature based on the private key; and verifying whether the digital signature is authentic using the public key. <2> The information processing method according to <1>, wherein the public key is F(s) = (A, b, y) consisting of the multi-degree multivariate polynomial forming the Ring-MQ function, where y = s·A(s) + b·s. <3> The information processing method according to <1>, wherein the private key is kept private by a prover; the public key is made public and shared with a verifier who verifies whether the digital signature is authentic; a prover-side device operated by the prover generates the digital signature based on a challenge, the private key, and the public key provided by a verifier-side device operated by the verifier; and the verifier-side device verifies the digital signature based on the challenge and the public key. <4> The information processing method according to <3>, wherein the challenge is generated by an algorithm based on a Fiat-Shamir transformation. <5> The information processing method according to <3>, wherein the challenge is information selected by the verifier by operating the verifier-side device.<6> The information processing method described in <3>, wherein the prover device generates a first hash value based on a plurality of random numbers based on a seed value consisting of patterns of 1, ..., N and a first calculation result calculated from the private key, and transmits the first hash value to the verifier device; receives a pattern selected by the verifier from the patterns of 1, ..., N supplied from the verifier device as a challenge; generates the electronic signature based on the random number corresponding to the pattern used as the challenge and the first calculation result, and transmits the electronic signature to the verifier device; the verifier device receives the first hash value from the prover device and transmits the pattern selected by the verifier from the patterns of 1, ..., N to the prover device as a challenge; calculates a value corresponding to the first hash value from the electronic signature based on the pattern selected as the challenge, the public key, and information included in the electronic signature, and verifies the electronic signature based on whether it matches the first hash value received from the prover device. <7> The prover device generates a first hash value based on a plurality of random numbers based on the seed value consisting of the pattern 1, ..., N and a first calculation result calculated from the private key, and transmits the first hash value to the verifier device, and q is supplied from the verifier device. ｎ Ring R exists as a street ｑthe verifier receives the first hash value, transmits the selected random number to the prover device, receives the second hash value transmitted from the prover device, and transmits the pattern to the prover device as a challenge; the verifier calculates values ​​corresponding to the first hash value and the second hash value from the electronic signature based on the pattern selected as the challenge, the public key, and information included in the electronic signature, and verifies the electronic signature based on whether the first hash value and the second hash value received from the prover device match. <8> s∈R ｑ an information processing system comprising: a key generation unit that sets F(s) as a private key and F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function as a public key; an electronic signature generation unit that generates an electronic signature based on the private key; and an electronic signature verification unit that verifies whether the electronic signature is authentic using the public key. ｑ a key generation unit that sets F(s) as a private key and F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function as a public key; an electronic signature generation unit that generates an electronic signature based on the private key; and an electronic signature verification unit that verifies whether the electronic signature is authentic using the public key.

[0216] 11 Authentication protocol, 31 Prover side information processing device, 32 Verifier side information processing device, 51 Key generation unit, 52 Authentication information generation unit, 71 Authentication information verification unit

Claims

1. s∈R ｑ as a private key, and F(s) consisting of a multi-degree multivariate polynomial forming a Ring-MQ (Multivariate Quadratic) function as a public key, generating a digital signature based on the private key, and verifying whether the digital signature is authentic by using the public key.

2. The information processing method according to claim 1, wherein the public key is F(s) = (A, b, y) consisting of a multi-degree, multivariate polynomial that forms the Ring-MQ function, where y = s·A(s) + b·s.

3. The information processing method of claim 1, wherein the private key is kept private by a certifier, the public key is made public and is shared with a verifier who verifies whether the electronic signature is genuine, a certifier device operated by the certifier generates the electronic signature based on a challenge, the private key, and the public key supplied by a verifier device operated by the verifier, and the verifier device verifies the electronic signature based on the challenge and the public key.

4. The information processing method according to claim 3, wherein the challenge is generated by an algorithm based on the Fiat-Shamir transformation.

5. The information processing method according to claim 3, wherein the challenge is information selected by the verifier by operating the verifier side device.

6. The information processing method according to claim 3, wherein the prover device generates a first hash value based on a plurality of random numbers based on a seed value consisting of patterns of 1, ..., N and a first calculation result calculated from the private key, and transmits the first hash value to the verifier device; receives a pattern selected by the verifier from the patterns of 1, ..., N supplied from the verifier device as a challenge; generates the electronic signature based on the random numbers corresponding to the pattern as the challenge and the first calculation result, and transmits the electronic signature to the verifier device; the verifier device receives the first hash value from the prover device, transmits the pattern selected by the verifier from the patterns of 1, ..., N to the prover device as a challenge; calculates a value corresponding to the first hash value from the electronic signature based on the pattern selected as the challenge, the public key, and information included in the electronic signature, and verifies the electronic signature based on whether it matches the first hash value received from the prover device.

7. The prover device generates a first hash value based on a plurality of random numbers based on the seed value consisting of the pattern of 1, ..., N and a first calculation result calculated from the private key, and transmits the first hash value to the verifier device; ｎ Ring R exists as ｑ 7. The information processing method according to claim 6, further comprising: receiving a random number selected by the verifier from a source as a selected random number; generating a second hash value different from the first hash value based on a second calculation result calculated from the plurality of random numbers, the selected random number, and the public key, and transmitting the second hash value to the verifier side device; receiving a pattern selected by the verifier as a challenge; generating the electronic signature based on a random number corresponding to the pattern as the challenge, the first calculation result, and the second calculation result, and transmitting the electronic signature to the verifier side device; the verifier side device receives the first hash value, transmits the selected random number to the prover side device, receives the second hash value transmitted from the prover side device, and transmits the pattern as a challenge to the prover side device; calculating values ​​corresponding to the first hash value and the second hash value from the electronic signature based on the pattern selected as the challenge, the public key, and information included in the electronic signature, and verifying the electronic signature based on whether or not the first hash value and the second hash value received from the prover side device match.

8. s∈R ｑ a key generation unit that sets a private key to F(s) and a public key to F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function; an electronic signature generation unit that generates an electronic signature based on the private key; and an electronic signature verification unit that verifies whether the electronic signature is authentic by using the public key.

9. s∈R ｑ a key generation unit that sets F(s) as a private key and F(s) consisting of a multi-degree multivariate polynomial that forms a Ring-MQ (Multivariate Quadratic) function as a public key; an electronic signature generation unit that generates an electronic signature based on the private key; and an electronic signature verification unit that verifies whether the electronic signature is authentic using the public key.

Images