Device and non-interactive blind signature system

Abstract

A device according to one aspect generates a prior signature with a non-interactive blind signature and comprises: a first key generation unit that generates a public key PKS which includes a public key pks and a random number y of a prescribed digital signature and a secret key SKS which includes the public key PKS and a secret key sks of the digital signature; and a prior signature generation unit that uses the secret key sks which is included in the secret key SKS, the public key PKR of a device which generates a signature from the prior signature, and a nonce value to generate a prior signature psig by the digital signature using the public key PKR and the nonce value as a message.

Description

DEVICE AND NON-INTERACTIVE BLIND SIGNATURE SYSTEM - Patent application

[0001] The present disclosure relates to an apparatus and a non-interactive blind signature system.

[0002] One known digital signature technique is called blind signature, which allows a signature to be generated while keeping the message secret from the signer. Generally, interactive communication between two parties is essential for generating a blind signature. However, a non-interactive blind signature technique is also known, which allows a signature to be generated through non-interactive communication if the message to be signed is random (Non-Patent Document 1).

[0003] In the non-interactive blind signature scheme described in the above-mentioned non-patent document 1, security is guaranteed by assuming the existence of an idealized hash function called a random oracle or the existence of a legitimate third party called a CRS (common random string).

[0004] Lucjan Hanzlik, "Non-interactive blind signatures for random messages," In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 722-752. Springer, 2023.

[0005] However, non-blind signatures, which assume the existence of a legitimate third party, have the problem that security cannot be guaranteed if the third party commits fraud.

[0006] The present disclosure has been made in consideration of the above points, and aims to realize a non-interactive blind signature scheme that is guaranteed to be secure without assuming the existence of a legitimate third party.

[0007] According to one aspect of the present disclosure, there is provided an apparatus for generating a pre-signature using non-interactive blind signatures, the apparatus including: a public key pk of a predetermined digital signature; ｓ and a public key PK containing a random number y. Ｓ and the public key PK Ｓand the digital signature private key sk ｓ A secret key SK containing Ｓ a first key generation unit that generates the secret key SK; Ｓ The private key sk included in ｓ and a public key PK of the device that generates the signature from the pre-signature. Ｒ and the nonce value, Ｒ and a pre-signature generation unit that generates a pre-signature psig using the nonce value as a message and the digital signature.

[0008] It is possible to realize non-interactive blind signatures with guaranteed security without assuming the existence of a legitimate third party.

[0009] FIG. 1 is a diagram for explaining an example of a conventional blind signature; FIG. 1 is a diagram for explaining an example of a conventional non-interactive blind signature; FIG. 2 is a diagram showing an example of the overall configuration of a non-interactive blind signature system according to the present embodiment; FIG. 3 is a diagram showing an example of the functional configuration of a recipient device according to the present embodiment; FIG. 4 is a diagram showing an example of the functional configuration of a signer device according to the present embodiment; FIG. 5 is a diagram showing an example of the functional configuration of a verifier device according to the present embodiment; FIG. 6 is a flowchart showing an example of a recipient's key generation process; FIG. 7 is a flowchart showing an example of a signer's key generation process; FIG. 8 is a sequence diagram showing an example of a signature generation and acquisition process; FIG. 9 is a sequence diagram showing an example of a signature verification process; FIG. 10 is a diagram showing an example of a computer hardware configuration.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Prior Art> First, the prior art of blind signature and non-interactive blind signature will be described.

[0012] Blind signatures are a type of anonymous signature scheme that allows a user (hereafter referred to as the recipient) who has the message to be signed to generate a signature while keeping the message confidential from the signer. Blind signatures are also a type of digital signature that originated as an application of electronic cash.

[0013] A simple application of blind signatures is anonymous authentication. For example, suppose you create an account for an application and want an administrator to generate a signature for your ID. By using blind signatures, you can generate a signature while keeping your ID secret from the administrator. During actual authentication, you simply present your ID and the signature generated by blind signatures.

[0014] An example of a conventional blind signature will be described with reference to Fig. 2. Fig. 1 is a diagram for explaining an example of a conventional blind signature.

[0015] As shown in Fig. 1, in conventional blind signatures, signature generation and verification are realized by the following steps S11 to S17. In the following, it is assumed that the signature verifier has obtained the signer's public key pk before executing step S17, which will be described later. Note that the recipient, signer, and verifier below more precisely refer to the devices, equipment, terminals, etc. that will be the recipient, signer, and verifier, respectively.

[0016] S11: The recipient generates a confidential message M by M←Mask(m), where m is the message to be signed, and Mask is an algorithm that takes message m as input and outputs confidential message M. Note that confidential message M is a message in which the contents of message m are kept confidential by encryption or the like.

[0017] S12: The recipient sends the secret message M to the signer.

[0018] S13: The signer issues psig←Issue ｓｋ (M) generates a pre-signature psig, where sk is the signer's private key, ｓｋ is an algorithm that takes a secret key sk and a secret message M as input and outputs a pre-signature psig.

[0019] S14: The signer sends the pre-signed psig to the recipient.

[0020] S15: The recipient generates a signature sig by sig←Obtain(psig), where Obtain is an algorithm that takes the pre-signature psig as input and outputs the signature sig.

[0021] S16: The recipient sends (m, sig) to the verifier.

[0022] S17: The verifier ←Verify ｐｋ The signature sig is verified by (m, sig), where pk is the signer's public key, ｐｋ is an algorithm that takes a public key pk, a message m, and a signature sig as input and outputs 1 or 0. For example, 1 indicates successful verification, and 0 indicates unsuccessful verification.

[0023] Note that the above steps S12 and S14 correspond to interactive communication between the recipient and the signer.

[0024] <<Non-interactive blind signatures>> Interactive communication between two parties is essential when generating a blind signature, but non-interactive blind signatures (NIBS: Non-interactive Blind Signatures for random messages) are known that can generate a signature through non-interactive communication if the message to be signed is random (Non-Patent Document 1). Considering the application of the above blind signatures to anonymous authentication, if it is acceptable for the ID to be a random value, non-interactive blind signatures can be a powerful application technology.

[0025] An example of a conventional non-interactive blind signature scheme will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining an example of a conventional non-interactive blind signature scheme.

[0026] As shown in Figure 2, in conventional non-interactive blind signatures, signature generation and verification are realized by the following steps S21 to S25. In the following, it is assumed that the signature verifier has acquired the signer's public key pk before executing step S25, which will be described later. In addition, the signer obtains the recipient's public key pk ｒ It is assumed that the recipient, signer, and verifier below are, more precisely, the devices, equipment, terminals, etc. that will act as the recipient, signer, and verifier, respectively.

[0027] S21: The signer is psig←Issue ｓｋ (nonce, pk ｒ ) to generate a pre-signature psig, where sk is the signer's private key, nonce is a nonce value, and Issue ｓｋ is a private key sk, a nonce value nonce, and a public key pk ｒ This is an algorithm that takes as input the above and outputs a pre-signature psig.

[0028] S22: The signer sends the pre-signed psig to the recipient.

[0029] S23: The recipient receives (m, sig)←Obtain ｓｋ_ｒ Generate a message m and a signature sig by (nonce, psig). Here, sk_r is "sk ｒ " and is the recipient's private key. ｓｋ_ｒ is the private key sk ｒ This is an algorithm that takes a nonce value nonce and a pre-signature psig as input and outputs a message m and a signature sig.

[0030] S24: The recipient sends (m, sig) to the verifier.

[0031] S25: The verifier 1 / 0←Verify ｐｋ The signature sig is verified by (m, sig), where pk is the signer's public key, ｐｋ is an algorithm that takes a public key pk, a message m, and a signature sig as input and outputs 1 or 0. For example, 1 indicates successful verification, and 0 indicates unsuccessful verification.

[0032] <Problems with Conventional Non-Interactive Blind Signatures> In the non-interactive blind signature scheme described in Non-Patent Document 1, security (i.e., anonymity) is guaranteed by assuming the existence of an idealized hash function called a random oracle or the existence of a legitimate third party called a CRS. However, in reality, it is difficult to strictly realize a random oracle. Furthermore, there is a risk that anonymity may be breached if the third party commits fraud.

[0033] Therefore, below we propose a non-interactive blind signature method whose security is guaranteed without assuming the existence of a third party (hereinafter referred to as the "proposed method", or when it is explicitly stated that it is a non-interactive blind signature method, as the "non-interactive blind signature method related to the proposed method").

[0034] <Preparation> First, prepare the technology that is the premise of the proposed method.

[0035] <Digital Signature> The digital signature SIG is composed of the following three probabilistic polynomial-time algorithms (SIG.Gen, SIG.Sign, SIG.Verify).

[0036] SIG. Gen (1 κ ): Security parameter 1 κ is input, and the verification key pk ｓ and the signing key sk ｓ The key pair (pk ｓ , sk ｓ ) is output.

[0037] S.I.G. Sign(sk ｓ , m): signature key sk ｓ and the message m as input, and outputs a signature σ.

[0038] S.I.G. Verify(pk ｓ , m, σ): verification key pk ｓ It takes the message m and the signature σ as input and outputs 1 or 0. For example, 1 indicates successful verification and 0 indicates unsuccessful verification.

[0039] Non-interactive commitment scheme COM is a non-interactive commitment scheme with security parameter 1. κ It is a polynomial-time algorithm that takes a message m and a random number r as input and outputs a commitment c. That is, c←COM(1 κ , m; r). For simplicity, the security parameter 1 κ is omitted, and c←COM(1 κ , m; r) will also be expressed as c←COM(m; r).

[0040] The above non-interactive commitment scheme COM is assumed to satisfy the properties of complete binding and (T, ε)-secrecy.

[0041] Here, complete binding means that the following holds true for any attacker A with unlimited computing power:

[0042] Pr[COM(m ０ ;r ０ ) = COM(m １ ;r １ ) ∧m ０ ≠m １ | (m ０ , r ０ , m １ , r １ )←A]=0 Note that (m ０ , r ０ , m １ , r １ )←A is the attacker A's (m ０ , r ０ , m １ , r １ ) is selected.

[0043] In addition, (T, ε)-secrecy means that any T-time probabilistic algorithm A can be used to verify the validity of the experimental Exp. ｈｉｄｉｎｇ This refers to the case where (A) has an advantage of at most ε.

[0044] Step 1: T-time probabilistic algorithm A (m ０ , m １ ) is output.

[0045] Step 2: Randomly select b∈{0,1} and generate a random number r, and set c←COM(m ｂ ;r) is calculated.

[0046] Step 3: Commitment c is given to T-time probabilistic algorithm A, which outputs a guess b' of the value b used to calculate commitment c.

[0047] Step 4: If b=b', then Exp ｈｉｄｉｎｇ (A)=1, otherwise Exp ｈｉｄｉｎｇ Output (A)=0.

[0048] In this case, the advantage of the T-time probabilistic algorithm A is Adv = 2Pr [Exp ｈｉｄｉｎｇ(A) is defined as [(A)=1]-1.

[0049] <Non-Interactive Zero-Knowledge Proof> For a relation R, let NP language L be L:={x|∃w:(x, w)∈R}. Note that x is also called a "problem" or "proposition", and w is also called a "witness" or "solution".

[0050] In this case, for an NP language L, Non-Interactive Witness-Indistinguishable Proof Systems (NIWI), a type of non-interactive zero-knowledge proof, is composed of two probabilistic polynomial-time algorithms (NIWI.Prove, NIWI.Verify) (Reference 1).

[0051] NIWI. Prove (1 κ , x, w): security parameter 1 κ Proposition x and solution w are input, and proof π ｎｉｗｉ Output.

[0052] NIWI. Verify(x, π ｎｉｗｉ ): Proposition x and proof π ｎｉｗｉ It takes input and outputs 1 or 0. For example, 1 is the proof π ｎｉｗｉ is correct, 0 is proof π ｎｉｗｉ indicates that is incorrect.

[0053] Verifiable Random Functions The Verifiable Random Functions (VRF) are composed of four probabilistic polynomial-time algorithms (VRF.Gen, VRF.Eval, VRF.Prove, and VRF.Verify).

[0054] VRF. Gen (1 κ ): Security parameter 1 κ is input, and the verification key pk ｖｒｆ and the private key sk ｖｒｆ The key pair (pk ｖｒｆ , sk ｖｒｆ ) is output.

[0055] VRF. Eval (sk ｖｒｆ , x): private key sk ｖｒｆ and the value x as input and outputs the evaluation y.

[0056] VRF. Prove (sk ｖｒｆ , x): private key sk ｖｒｆ and the value x as input, and the proof π ｖｒｆ Output.

[0057] VRF. Verify(pk ｖｒｆ , π ｖｒｆ , x, y): verification key pk ｖｒｆ and prove π ｖｒｆ It takes the value x and the evaluation y as input and outputs 1 or 0. For example, 1 indicates successful verification and 0 indicates unsuccessful verification.

[0058] <<Unidirectional substitution group>> f: {0,1} κ →{0, 1} κ Let F be a one-way permutation function. Then, F = {f: {0, 1} κ →{0, 1} κ} will be called a unidirectional permutation family.

[0059] <Proposed method> Below, PK Ｒ and S.K. Ｒ are the recipient's public key and private key, PK Ｓ and S.K. Ｓ Let be the signer's public key and private key, respectively.

[0060] Also, let NIWI=(NIWI.Prove, NIWI.Verify) be a non-interactive witness indistinguishability proof system for the following NP language L.

[0061] L = {(m,PK Ｓ = (pk ｓ , f, y), c （０） , c （１） ) | (m, pk ｓ , c （０） , c （１） ) ∈ L ０ ∨(m, pk ｓ , c （０） , c （１） ) ∈ L １} where L ０ and L １are as follows, respectively.

[0062] L ０ = {(m,PK Ｓ , c （０） ,・)|∃(nonce,PK Ｒ , psig,r （０） ), SIG. Verify(pk ｓ , (nonce, PK Ｒ ), psig)=1}∧VRF. Verify(pk ｖｒｆ , π ｖｒｆ , nonce, m)=1∧c （０） =COM((nonce, PK Ｒ ), psig;r （０） ) L １ = {(·,PK Ｓ , , c （１） ) | ∃ (a, r （１） ), y=f(a)∧c （１） =COM(a;r （１） )} Note that c （０） and c （１） are the commitments described below, and r （０） and r （１） are commitments c （０） and c （１） is the random number used to calculate

[0063] In this case, the non-interactive blind signature scheme according to the proposed method is composed of the following five algorithms (RKeyGen, SKeyGen, Issue, Obtain, and Verify).

[0064] ≪RKeyGen≫ RKeyGen (1 κ ) is security parameter 1 κ The recipient's public key PK is obtained by the following steps 1-1 to 1-3 using the input Ｒ and the private key SK Ｒ The key pair (PK Ｒ , S.K. Ｒ ) is output.

[0065] Step 1-1: (pk ｖｒｆ , sk ｖｒｆ )←VRF. Gen (1 κ ) Step 1-2: PK Ｒ ←pkｖｒｆ ;SK Ｒ ← (PK Ｒ , sk ｖｒｆ ) Step 1-3: (PK Ｒ , S.K. Ｒ )

[0066] ≪SKeyGen≫ SKeyGen (1 κ ) is security parameter 1 κ The signer's public key PK is obtained by the following steps 2-1 to 2-4 using the input Ｓ and the private key SK Ｓ The key pair (PK Ｓ , S.K. Ｓ ) is output.

[0067] Step 2-1: (pk ｓ , sk ｓ ) ← SIG. Gen (1 κ ) Step 2-2: f←F; y←{0,1} κ Step 2-3: PK Ｓ ←(pk ｓ , f, y); SK Ｓ ← (PK Ｓ , sk ｓ ) Step 2-4: (PK Ｓ , S.K. Ｓ )

[0068] ≪Issue≫ Issue (SK Ｓ , P.K. Ｒ , nonce) is the signer's private key SK Ｓ and the recipient's public key PK Ｒ and the nonce value nonce are input, and a pre-signature psig is output according to the following steps 3-1 to 3-3.

[0069] Step 3-1: (PK Ｓ , sk ｓ )←SK Ｓ Step 3-2: psig←SIG.sign(sk ｓ , (nonce, PK Ｒ )) Step 3-3: Output psig

[0070] ≪Obtain≫ Obtain (SK Ｒ , P.K. Ｓ, psig, nonce) is the recipient's private key SK Ｒ and the signer's public key PK Ｓ The pre-signature psig and the nonce value nonce are input, and a pair (m, sig) of message m and signature sig or ⊥ is output by the following steps 4-1 to 4-11.

[0071] Step 4-1: (PK Ｒ = pk ｖｒｆ , sk ｖｒｆ )←SK Ｒ ; (pk ｓ , f, y) ← PK Ｓ Step 4-2: SIG. Verify (pk ｓ , (nonce, PK Ｒ )) = 0, output ⊥ Step 4-3: m ← VRF.Eval(sk ｖｒｆ , nonce) Step 4-4: π ｖｒｆ ←VRF. Prove (sk ｖｒｆ , nonce) Step 4-5: c （０） ←COM((nonce, PK Ｒ ), psig;r （０） ) Step 4-6:c （１） ←COM(0;r （１） ) Step 4-7: x←(m, pk ｓ , c （０） , c （１） ) Step 4-8: w←(nonce, psig, PK Ｒ , π ｖｒｆ , r （０） , , ) Step 4-9: π ｎｉｗｉ ←NIWI. Prove (1 κ , x, w) Step 4-10: sig←(c （０） , c （１） , π ｎｉｗｉ ) Step 4-11: Output (m, sig)

[0072] ≪Verify≫ Verify (PK Ｓ , m, sig) is the signer's public key PK Ｓ The message m and the signature sig are input, and 1 or 0 is output according to the following steps 5-1 to 5-3.

[0073] Step 5-1: pkｓ ←PK Ｓ ; (c （０） , c （１） , π ｎｉｗｉ ) ← sig Step 5-2: x ← (m, pk ｓ , c （０） , c （１） ) Step 5-3: NIWI. Verify(x,π ｎｉｗｉ )

[0074] A non-interactive blind signature system 1 for realizing the non-interactive blind signature according to the above-mentioned proposed method will be described below.

[0075] <Overall Configuration Example> An overall configuration example of the non-interactive blind signature system 1 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the overall configuration of the non-interactive blind signature system 1 according to this embodiment.

[0076] 3, the non-interactive blind signature system 1 according to this embodiment includes a recipient device 10, a signer device 20, and a verifier device 30. The recipient device 10, the signer device 20, and the verifier device 30 are communicatively connected via a communication network 40 including, for example, the Internet.

[0077] The receiver device 10 is a device, equipment, terminal, etc. that serves as a receiver. The signer device 20 is a device, equipment, terminal, etc. that serves as a verifier. The verifier device 30 is a device, equipment, terminal, etc. that serves as a verifier.

[0078] The recipient device 10, signer device 20, and verifier device 30 can be realized using various devices, equipment, terminals, etc., such as a PC (personal computer), a smartphone, a tablet terminal, a wearable device, a general-purpose server, an IoT device, an industrial device, etc.

[0079] <Functional Configuration Example> <Recipient Device 10> An example of the functional configuration of the recipient device 10 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the functional configuration of the recipient device 10 according to this embodiment.

[0080] 4, the recipient device 10 according to this embodiment includes a communication unit 101, a key generation unit 102, and a signature generation unit 103. These units are implemented, for example, by one or more programs installed in the recipient device 10, which are executed by a processor such as a CPU (Central Processing Unit). The recipient device 10 according to this embodiment also includes a storage unit 104. The storage unit 104 is implemented, for example, by a storage area of ​​various storage devices such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory.

[0081] The communication unit 101 receives a pre-signature psig from the signer device 20 and transmits a pair (m, sig) of a message m and a signature sig to the verifier device 30 .

[0082] The key generation unit 102 executes RKeyGen, a non-interactive blind signature method according to the proposed method, and generates a public key PK Ｒ and the private key SK Ｒ The key pair (PK Ｒ , S.K. Ｒ ) to generate the

[0083] The signature generation unit 103 executes Obtain, a non-interactive blind signature algorithm according to the proposed method, to generate a pair (m, sig) of a message m and a signature sig.

[0084] The storage unit 104 stores various data (e.g., key pairs (PK Ｒ , S.K. Ｒ ), a pair (m, sig) of a message m and a signature sig, etc.

[0085] <<Signer Device 20>> An example of the functional configuration of the signer device 20 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the functional configuration of the signer device 20 according to this embodiment.

[0086] 5, signer device 20 according to this embodiment includes communication unit 201, key generation unit 202, and pre-signature generation unit 203. Each of these units is realized, for example, by a processor such as a CPU executing one or more programs installed in signer device 20. Signer device 20 according to this embodiment also includes storage unit 204. Storage unit 204 is realized, for example, by a storage area of ​​various storage devices such as an HDD, SSD, or flash memory.

[0087] The communication unit 201 transmits the pre-signature psig to the recipient device 10 .

[0088] The key generation unit 202 executes SKeyGen, a non-interactive blind signature method according to the proposed method, and generates a public key PK Ｓ and the private key SK Ｓ The key pair (PK Ｓ , S.K. Ｓ ) to generate the

[0089] The pre-signature generation unit 203 executes a non-interactive blind signature issue according to the proposed method and generates a pre-signature psig.

[0090] The storage unit 204 stores various data (for example, a key pair (PK Ｓ , S.K. Ｓ ) etc.) are stored.

[0091] <Verifier Device 30> An example of the functional configuration of the verifier device 30 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the verifier device 30 according to this embodiment.

[0092] 6, the verifier device 30 according to this embodiment includes a communication unit 301 and a verification unit 302. These units are realized, for example, by a processor such as a CPU executing one or more programs installed in the verifier device 30. The verifier device 30 according to this embodiment also includes a storage unit 303. The storage unit 303 is realized, for example, by a storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0093] The communication unit 301 receives a pair (m, sig) of a message m and a signature sig from the recipient device 10 .

[0094] The verification unit 302 executes non-interactive blind signature verification according to the proposed method and verifies the signature sig.

[0095] The storage unit 303 stores various data (for example, the signer's public key PK Ｓ etc.)

[0096] <Processing details> <Recipient's key generation process> Recipient's public key PK Ｒ and the private key SK Ｒ The key pair (PK Ｒ , S.K. Ｒ The process of generating the key will be described with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the receiver's key generation process.

[0097] The key generation unit 102 of the recipient device 10 executes RKeyGen, a non-interactive blind signature method according to the proposed method, and generates a public key PK Ｒ and the private key SK Ｒ The key pair (PK Ｒ , S.K. Ｒ ) (step S101). That is, the key generation unit 102 generates the security parameter 1 κ is input, and the public key PK is obtained by the above steps 1-1 to 1-3. Ｒ and the private key SK Ｒ The key pair (PK Ｒ , S.K. Ｒ ) is output.

[0098] The key generation unit 102 of the receiver device 10 generates the key pair (PK Ｒ , S.K. Ｒ ) is stored in the storage unit 104, and the public key PK Ｒ The public key PK is made public by any method (step S102). Ｒ As a method for disclosing the public key PK, for example, Ｒ Examples include registering with the

[0099] <<Signer's key generation process>> Signer's public key PK Ｓ and the private key SK Ｓ The key pair (PK Ｓ , S.K. ＳThe process of generating the key for the signer will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the process of generating the key for the signer.

[0100] The key generation unit 202 of the signer device 20 executes SKeyGen, a non-interactive blind signature method according to the proposed method, and generates a public key PK Ｓ and the private key SK Ｓ The key pair (PK Ｓ , S.K. Ｓ ) (step S201). That is, the key generation unit 202 generates the security parameter 1 κ is input, and the signer's public key PK is obtained by the above steps 2-1 to 2-4. Ｓ and the private key SK Ｓ The key pair (PK Ｓ , S.K. Ｓ ) is output.

[0101] The key generation unit 202 of the signer device 20 generates the key pair (PK Ｓ , S.K. Ｓ ) is stored in the storage unit 204, and the public key PK Ｓ is made public by any method (step S202). Ｓ As a method for disclosing the public key PK, for example, Ｓ Examples include registering with the

[0102] <<Signature Generation and Acquisition Processing>> The processing for generating and acquiring a pair (m, sig) of a signature sig and a message m will be described with reference to Fig. 9. Fig. 9 is a sequence diagram showing an example of the signature generation and acquisition processing.

[0103] The pre-signature generation unit 203 of the signer device 20 executes the non-interactive blind signature issue according to the proposed method to generate a pre-signature psig (step S301). Ｓ and the recipient's public key PK Ｒ and the nonce value nonce are input, and a pre-signature psig is output according to the above steps 3-1 to 3-3.

[0104] The communication unit 201 of the signer device 20 transmits the pre-signature psig generated in step S301 to the recipient device 10 (step S302).

[0105] The signature generation unit 103 of the recipient device 10 executes Obtain, a non-interactive blind signature according to the proposed method, to generate a pair (m, sig) of a message m and a signature sig (step S303). Ｒ and the signer's public key PK Ｓ Using the pre-signature psig and the nonce value nonce as inputs, the signature generation unit 103 generates a pair (m, sig) of message m and signature sig through the above steps 4-1 to 4-11. Note that if ⊥ is output in the above step 4-2, the signature generation unit 103 stops the process.

[0106] The communication unit 101 of the receiver device 10 stores the pair (m, sig) of the message m and the signature sig generated in step S303 in the storage unit 104 (step S304).

[0107] <<Signature Verification Process>> The process of verifying the signature sig will be described with reference to Fig. 10. Fig. 10 is a sequence diagram showing an example of the signature verification process.

[0108] The communication unit 101 of the receiver device 10 transmits a pair (m, sig) of a message m and a signature sig to the verifier device 30 (step S401).

[0109] The verification unit 302 of the verifier device 30 executes the non-interactive blind signature verification according to the proposed method and verifies the signature sig (step S402). Ｓ The message m and the signature sig are input, and the above steps 5-1 to 5-3 are followed to output 1 indicating successful verification or 0 indicating unsuccessful verification.

[0110] <Hardware Configuration Example> The receiver device 10, signer device 20, and verifier device 30 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 11. Fig. 11 is a diagram showing an example of the hardware configuration of the computer 500.

[0111] 11 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0112] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0113] The external I / F 503 is an interface with an external device such as a recording medium 503 a. Examples of the recording medium 503 a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0114] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0115] 11 is an example, and is not limited to this example of the hardware configuration of the computer 500. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0116] <Summary> As described above, the non-interactive blind signature system 1 according to this embodiment can realize non-interactive blind signatures with guaranteed security without assuming the existence of a legitimate third party. In this case, the non-interactive blind signature system 1 according to this embodiment uses NIWI, which is a zero-knowledge proof that can be generated without assuming the existence of a legitimate third party. By using NIWI, it is no longer necessary to assume the existence of a legitimate third party, but another condition required for NIWI must be met. To meet this condition, the proposed method uses the signer's public key PK Ｓ (Steps 2-2 to 2-3 above), the recipient enters the random number y into （０） and the value c that commits to 0 （１） are used as part of the signature sig (steps 4-5 to 4-6 and 4-10 above).

[0117] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0118] [References] Reference 1: Michael Backes, Nico Dottling, Lucjan Hanzlik, Kamil Kluczniak, and Jonas Schneider, "Ring Signatures: Logarithmic-Size, No Setup --- from Standard Assumptions," 2019.

[0119] 1 Non-interactive blind signature system 10 Recipient device 20 Signer device 30 Verifier device 40 Communication network 101 Communication unit 102 Key generation unit 103 Signature generation unit 104 Memory unit 201 Communication unit 202 Key generation unit 203 Pre-signature generation unit 204 Memory unit 301 Communication unit 302 Verification unit 303 Memory unit 500 Computer 501 Input device 502 Display device 503 External I / F 503a Recording medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage device 508 Processor 509 Bus

Claims

1. A device for generating a pre-signature using non-interactive blind signatures, comprising: a public key pk for a given digital signature; ｓ and the public key PK containing the random number y. Ｓ and the public key PK Ｓ and the digital signature private key sk ｓ A secret key SK containing Ｓ a first key generation unit that generates the secret key SK; Ｓ The private key sk included in ｓ and a public key PK of the device that generates the signature from the pre-signature. Ｒ and the nonce value, Ｒ and a pre-signature generation unit that generates a pre-signature psig using the digital signature and the nonce value as a message.

2. A device for generating a signature and a message from a pre-signature psig using non-interactive blind signatures, comprising: a verifiable random function public key pk ｖｒｆ public key PK containing Ｒ and the public key PK Ｒ and the secret key sk of the verifiable random function ｖｒｆ A secret key SK containing Ｒ a second key generation unit that generates the secret key SK; Ｒ and the public key PK of the device that generated the pre-signature psig. Ｓ and the pre-signature psig and the nonce value to obtain a commitment c of the pre-signature psig and the nonce value. （０） and 0 commitment c （１） and the private key SK Ｒ The private key sk included in ｖｒｆ and a message m representing an evaluation of the nonce value according to 3. A non-interactive blind signature system including at least a signer device that generates a pre-signature using a non-interactive blind signature and a recipient device that generates a message and a signature from the pre-signature, wherein the signer device has a public key pk for a predetermined digital signature. ｓ and the public key PK containing the random number y. Ｓ and the public key PK Ｓ and the digital signature private key sk ｓ A secret key SK containing Ｓ a first key generation unit that generates the secret key SK; Ｓ The private key sk included in ｓ and the recipient device's public key PK Ｒ and the nonce value, Ｒ and a pre-signature generation unit that generates a pre-signature psig using the digital signature and the nonce value as a message, and the recipient device includes a public key pk of a verifiable random function. ｖｒｆ The public key PK includes Ｒ and the public key PK Ｒ and the secret key sk of the verifiable random function ｖｒｆ A secret key SK containing Ｒ a second key generation unit that generates the secret key SK; Ｒ and the public key PK Ｓ and the pre-signature psig and the nonce value to obtain a commitment c of the pre-signature psig and the nonce value. （０） and 0 commitment c （１） and the private key SK Ｒ The private key sk included in ｖｒｆ and a signature generation unit that generates a message m representing an evaluation of the nonce value according to 4. The non-interactive blind signature system further includes a verifier device that verifies the signature sig, and the signature generation unit generates the message m and the public key PK. Ｓ The public key pk included in ｓ and the commitment c （０） and the commitment c （１） and a solution including the nonce value and the pre-signature psig, a non-interactive witness indistinguishable proof system can prove π ｎｉｗｉ and generate the proof π ｎｉｗｉ and the verifier generates the signature sig including the proof π for the proposition included in the signature sig. ｎｉｗｉ 4. The non-interactive blind signature system according to claim 3, further comprising a verification unit that verifies the signature sig and sets the result of the verification as the verification result of the signature sig.

Images