Electronic signature system and electronic signature method

Abstract

An electronic signature system according to one aspect of the present invention includes: a key generation unit that generates, for the i-th ring member of a traceable ring signature, a secret key ski composed of (k +1) secret keys and a public key pki obtained by aggregating (k +1) public keys; a signature generation unit that generates a signature σ on the basis of a secret key skπ of a signer π, a message m, and an event L including a public key list of the public key pki; a verification unit that verifies the signature σ' on the basis of an event L' including the public key list, a message m', and a signature σ'; and a tracking unit that outputs a public key of a signer that has double signed, on the basis of two sets of messages and signatures for the same event L" (m1, σ1) and (m2, σ2). The signature generation unit generates secret information σπ of the signer on the basis of a k-wise hash function, and generates the signature σ including information calculated from the secret information σπ and zero knowledge proof information that the signature has the secret information σπ.

Description

Electronic signature system and electronic signature method

[0001] The present disclosure relates to an electronic signature system and an electronic signature method.

[0002] The number of transactions with digital signatures is increasing, especially in the context of blockchain technology. A typical digital signature has a one-to-one correspondence with a public key used to verify the signature, so it is possible to identify the signer by tracing the public key from the signature attached to each transaction (in other words, the signer can be tracked).

[0003] On the other hand, there are an increasing number of use cases where the privacy of signers needs to be protected, and a digital signature called a ring signature has been put into practical use in blockchain. A ring signature is a digital signature that makes it impossible to identify the actual signer among multiple signers (in other words, a digital signature that makes it impossible to identify or trace the actual signer). Furthermore, among ring signatures, there are traceable ring signatures that can identify or trace the signer only in the event of fraud such as double signing (also called double use of a signature or simply double use) (Non-Patent Document 1).

[0004] Eiichiro Fujisaki, Koutarou Suzuki: Traceable Ring Signature. Public Key Cryptography 2007: 181-200.

[0005] However, since the anonymity of conventional traceable ring signatures is guaranteed under computational assumptions, if an attacker who can violate these computational assumptions appears, the anonymity will be broken.

[0006] The present disclosure has been made in view of the above points, and aims to realize a traceable ring signature that does not require any computational complexity assumptions.

[0007] The electronic signature system according to one aspect of the present disclosure is an electronic signature system that realizes electronic signatures using traceable ring signatures, and wherein, where k is a predetermined integer of 1 or more, a private key sk consisting of k+1 private keys is used for the i-th ring member of the traceable ring signature. ｉand a public key pk that aggregates k+1 public keys. ｉ and a key generation unit that generates the private key sk of the ring member i=π who will be the signer. π , the message m to be signed, and all public keys pk ｉ a signature generating unit that generates a signature σ for the event L and the message m based on an event L including a public key list representing a list of messages, a verification unit that verifies the signature σ' based on an event L' including the public key list, a message m' to be verified, and the signature σ' for the event L' and the message m'; and a verification unit that verifies two sets (m １ , σ １ ) and (m ２ , σ ２ ) based on two signatures σ １ and σ ２ a tracing unit that outputs the public key of the signer who performed the double use if the signer has double-used the secret information σ of the signer based on a k-wise hash function; π and generating the secret information σ π and the signature is calculated from secret information σ π and zero-knowledge proof information that proves that the user has

[0008] It is possible to realize a traceable ring signature that does not require computational complexity assumptions.

[0009] FIG. 1 is a diagram showing the overall configuration of a remittance system according to an embodiment. FIG. 2 is a diagram showing the functional configuration of a remittance device according to an embodiment. FIG. 3 is a diagram showing the functional configuration of a remittance device according to an embodiment. FIG. 4 is a diagram showing the functional configuration of a verifier / tracer device according to an embodiment. FIG. 5 is a flowchart showing key generation processing according to an embodiment. FIG. 6 is a sequence diagram showing remittance processing according to an embodiment. FIG. 7 is a flowchart showing tracking processing according to an embodiment. FIG. 8 is a diagram showing an example of the hardware configuration of a computer.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Proposed Method> Below, we propose a traceable ring signature that does not require any computational assumptions.

[0012] Let G be a multiplicative group of prime order q, and let g and h be generators of G. Also, H: {0, 1} ＊ →G×Z ｑ , H': {0, 1} ＊ →G, H'': {0,1} ＊ →Z ｑ are different hash functions. Hereinafter, the total number of participants (also called "ring members") in the traceable ring signature is n, and the ordered set of n ring members is N = {1, ..., n}. Also, the public key of the ith ring member (hereinafter also called "ring member i") is pk ｉ Let pk be a list of n public keys. Ｎ = (pk １ , ..., pk ｎ ) pk Ｎ is also called a public key list. Furthermore, let k be a preset integer equal to or greater than 1, and let K = {0, 1, ..., k}. Note that (q, g, h, H, H', H'', N, K) are public information.

[0013] The traceable ring signature according to the proposed method is composed of four functions or algorithms (Gen, Sig, Ver, and Trace). Each function or algorithm will be described in detail below.

[0014] Gen is a key generation function or algorithm, and the key pair (pk ｉ , sk ｉ ) is generated and output. ｉ is the public key of ring member i, sk ｉ is the private key of ring member i.

[0015] Step 1-1: x ｉ，０ , x ｉ，１ , ..., x ｉ，ｋ ←G Step 1-2: y by the following ｉ get.

[0016] Step 1-3: pk ｉ←y ｉ ;sk ｉ ←(x ｉ，０ , x ｉ，１ , ..., x ｉ，ｋ ) Step 1-4: (pk ｉ , sk ｉ ) is output.

[0017] Here, the above steps 1-1 and 1-3 are performed on k+1 secret keys x ｉ，ｊ (j=0, 1, ..., k), and these k+1 secret keys are called a secret key sk ｉ Furthermore, the above steps 1-2 and 1-3 generate the following k+1 public keys, and aggregate these k+1 public keys to form a public key pk ｉ This means that:

[0018] <<Sig>> Sig is a signature function or algorithm, and the event L=(issue, pk Ｎ ) and the message m ∈ {0, 1} to be signed for the event L ＊ and the signer's private key sk ｉ The signature σ is generated and output by the following steps 2-1 to 2-5. Hereinafter, the signer is assumed to be π∈N. Note that issue∈{0, 1} ＊ can be any value. Events are also called "tags" etc.

[0019] Step 2-1: (h, X)←H(L); σ π get.

[0020] Step 2-2: A ０ ←H'(L, m); A １ ← (σ π / A ０ ) １／π Step 2-3: For all i≠π, σ ｉ ←A ０ A １ ｉ Step 2-4: By following (a) to (e) below, we can generate a non-interactive zero-knowledge proof c for the following language Lang. Ｎ = (c １ , ..., c ｎ ) and zＮ = (z １，０ , z １，１ , ..., z ｎ，ｋ ) to generate the

[0021] where σ Ｎ = (σ １ , ..., σ ｎ ), x Ｋ = (x ０ , ..., x ｋ )

[0022] (a) w ０ , ..., w ｋ ←Z ｑ ; π and b π get.

[0023] (b) For all i≠π, z ｉ，０ , ..., z ｉ，ｋ , c ｉ ∈Z ｑ After obtaining a, ｉ and b ｉ get.

[0024] (c) c←H''(L, m, A ０ , A １ , a Ｎ , b Ｎ ) where a Ｎ = (a １ , ..., a ｎ ), b Ｎ = (b １ , ..., b ｎ )

[0025] (d) c π ←c-Σ ｊ≠π c ｊ (mod q), z for all j∈K π，ｊ ←lol ｊ -c ｊ x π，ｊ (mod q).

[0026] (e) (c) Ｎ , z Ｎ ) as a proof for the language Lang.

[0027] Step 2-5: σ = (A １ , c Ｎ , z Ｎ ) as the signature for (L, m).

[0028] <<Ver>> Ver is a signature verification function or algorithm that verifies an event L, a message m, and a signature σ=(A １ , c Ｎ , z Ｎ ) is input, and a value indicating whether the verification is successful or unsuccessful is output by the following steps 3-1 to 3-3.

[0029] Step 3-1: (h, X) ← H(L); A ０ ←H'(L, m); for all i∈N, σ ｉ ←A ０ A １ ｉ Step 3-2: For all i∈N, a ｉ and b ｉ get.

[0030] Step 3-3:c １ = H″(L, m, A ０ , A １ , a Ｎ , b Ｎ ), a value indicating successful verification is output, and otherwise a value indicating unsuccessful verification is output.

[0031] Trace is a tracing function or algorithm that takes an event L and two pairs of a message and a signature (m, σ) and (m', σ') related to the event L as input, and traces the string "indep" or "linked" or the public key pk∈pk by the following steps 4-1 to 4-3. Ｎ Hereinafter, σ = (A １ , c Ｎ , z Ｎ ), σ′=(A １ ', c Ｎ ', z Ｎ ',s Ｎ ').

[0032] Step 4-1: Set L to (issue, pk Ｎ) and parse it into (h, X) ← H(L), A ０ ←Let H'(L, m), then for all i∈N, σ ｉ ←A ０ A １ ｉ ∈G. Similarly, A ０ Let '←H'(L,m') and for all i∈N, σ ｉ '←A ０ 'A １ ' ｉ ∈G.

[0033] Step 4-2: For all i∈N, σ ｉ = σ ｉ 'If pk ｉ to a TList, where TList is initialized to an empty list.

[0034] Step 4-3: If there is only one element in TList, output pkεTList, and TList=pk Ｎ If pk∈TList is true, "linked" is output, otherwise "indep" is output. Note that when pk∈TList is output, it means that a double signature was made by the ring member corresponding to the public key pk. When "linked" is output, it means that m=m', and the two signatures σ and σ' were generated by the same signer (the signer is not specified). When "indep" is output, it means that the two signatures σ and σ' were generated by different signers.

[0035] The traceable ring signature method proposed above does not make any computational assumptions, and therefore anonymity is unconditionally guaranteed no matter how many times a signature is made, as long as it is within a predetermined number of k times. This is because the secret information required to trace a person who has double-spended the signature is generated using the output value of a k-wise hash function (step 2-1 above). Note that a k-wise hash function has the characteristic that its output value appears completely random even to an attacker with infinite computing power, so long as it is used within k times. Therefore, no matter what kind of attacker appears, anonymity can be guaranteed as long as the signer does not reveal his or her private key within the predetermined k times.

[0036] [Example] Hereinafter, as an example of an electronic signature system that realizes a traceable ring signature according to the proposed method described above, a case where the traceable ring signature is applied to an electronic cash remittance system 1 will be described.

[0037] <Application to electronic cash protocol> Consider the case of paying electronic cash using the electronic cash protocol. For example, let T[j-1] be the currency token to be used. In this case, the currency token T[j] generated when paying the currency is as follows. Note that j is an index or the like that represents the history of the token.

[0038] T[j]=((H １ (T[j-1]), pku2), S[j]) S[j]=Sig((H １ (T[j-1]), pku2), sku1) where S[j] is the signature for the currency token T[j], H １ (·) is a hash function, sku1 is the sender's private key, pku2 is the recipient's public key, and Sig(·) is a signature function that is not a traceable ring signature function. Note that "remittance" may also be called "payment," and "received payment" may also be called "receipt," etc.

[0039] In the above currency payment example, the sender (more precisely, their pseudonym) can be identified from the public key pku1. Therefore, we consider applying the traceable ring signature method to the signature function part in the above currency payment example.

[0040] However, if the traceable ring signature proposed by the proposed method is simply applied, it may not be possible to identify the sender if the sender makes an unauthorized payment (for example, a double payment using a double signature).

[0041] Assuming double spending, the currency tokens generated when paying currency are T[j] and T[j]' as follows.

[0042] T[j]=((H １ (T[j-1]), pku2), S[j]) S[j]=Sig(L, (H １ (T[j-1]), pku2), sku1) T'[j]=((H１ (T[j-1]), pku3), S'[j]) S'[j]=Sig(L', (H １ (T[j-1]), pku3), sku1) where sku1 is the sender's private key, pku2 and pku3 are the recipient's public keys, and Sig is the signature function for the traceable ring signature used in the proposed method.

[0043] If pku2≠pku3, the messages to be signed are different, but if pku2=pku3, the messages to be signed are the same between double-spending transactions. Therefore, the traceable ring signature according to the proposed method cannot detect double-spending. This is because the tracing function of the traceable ring signature according to the proposed method identifies the signer if the same signer generates signatures for different messages in the same event L.

[0044] Furthermore, since the signer can freely set the issue included in event L, if the same event L is used for all payments, the sender can be identified from multiple legitimate remittances by the same sender.

[0045] Therefore, when applying the traceable ring signature according to the proposed method to the signature function part in the above currency payment example, the following (A) and (B) are implemented. This makes it possible to achieve anonymity of signers and identification of signers in the case of double-spending in electronic cash protocols.

[0046] (A) The payer sends a nonce to the sender, and this nonce is included in the message to be signed. This allows a different message to be signed for each remittance.

[0047] (B) The signer (sender) does not decide the event value (i.e., decides the issue) at the time of remittance, but rather the event value is uniquely determined from the history of tokens up to that point.

[0048] Specifically, the currency token T[j] generated when paying currency is as follows:

[0049] T[j]=((H １(T[j-1]), pku2, nonce_u2), S[j]) S[j]=Sig(L, (H １ (T[j-1]), pku2, nonce_u2), sku1) L=(issue, pk Ｎ ), issue = H １ (T[j-1]) where nonce_u2 is the nonce generated by the payee.

[0050] This allows for tracking of the signer in the case of double usage, since different messages are signed by the same signer in the same event L.

[0051] As a specific example, let us assume a double spend and let the following two currency tokens be generated when paying currency: T[j] and T′[j].

[0052] T[j]=((H １ (T[j-1]), pku2, nonce_u2), S[j]) S[j]=Sig(L, (H １ (T[j-1]), pku2, nonce_u2), sku1) L=(issue, pk Ｎ ), issue = H １ (T[j-1]) T'[j]=((H １ (T[j-1]), pku3, nonce_u3), S'[j]) S'[j]=Sig(L', (H １ (T[j-1]), pku3, nonce_u3), sku1) L'=(issue, pk Ｎ ), issue = H １ (T[j-1]) Here, sku1 is the sender's private key, pku2 and pku3 are the recipient's public keys, nonce_u2 is a nonce generated by the recipient having public key pku2, and nonce_u3 is a nonce generated by the recipient having public key pku3.

[0053] This results in a signature for a different message in the same event L (i.e., when the same currency token is used), so that the signer can be traced using the tracing function Trace.

[0054] The public key of the payee is pk Ｎor may be included in pk Ｎ It does not have to be included in the

[0055] <Example of Overall Configuration of Remittance System 1> An example of the overall configuration of the remittance system 1 according to this embodiment is shown in Figure 1. As shown in Figure 1, the remittance system 1 according to this embodiment includes a plurality of remittance device(s) 10, one or more remittance receiver device(s) 20, and one or more verifier / tracer device(s) 30. These devices are communicatively connected via a communication network 40 including, for example, the Internet.

[0056] The remitter device 10 is a computer or computer system used or managed by a remitter (signer). Each signer is a ring member. Each signer is not limited to a specific person, but may be, for example, a settlement institution such as a bank or financial institution. Hereinafter, the remitter device 10 used or managed by a ring member i will be referred to as the "remitter device 10". ｉ " will be expressed as ".

[0057] The receiver device 20 is a computer or computer system used or managed by the receiver. The receiver is not limited to a specific person, but may be, for example, a settlement institution such as a bank or financial institution.

[0058] The verifier / tracer device 30 is a computer or computer system used or managed by a party (hereinafter also referred to as the verifier / tracer) that verifies the signature and, if the verification is successful, executes the remittance transaction / transfer, and traces the sender who made the double spend. However, the party that executes the remittance transaction / transfer if the verification is successful and the party that traces the sender who made the double spend may be different parties. For example, if the electronic cash protocol uses a blockchain, the verifier / tracer device 30 may be a node or the like that makes up a blockchain network.

[0059] The remitter device 10, the receiver device 20, and the verifier / tracker device 30 can be realized, for example, by a PC (personal computer), a general-purpose server, a smartphone, a tablet terminal, a wearable device, etc.

[0060] <Example of Functional Configuration> Hereinafter, an example of the functional configuration of the remitter device 10, the receivable device 20, and the verifier / tracer device 30 included in the remittance system 1 according to this embodiment will be described.

[0061] <<Remitter Device 10>> An example of the functional configuration of the remitter device 10 according to this embodiment is shown in Figure 2. As shown in Figure 2, the remitter device 10 according to this embodiment includes a key generation unit 101, a currency token creation unit 102, and a transaction issuance unit 103. Each of these units is implemented, for example, by one or more programs installed in the remitter device 10, which are executed by a computing device such as a CPU (Central Processing Unit). The remitter device 10 according to this embodiment also includes a memory unit 104. The memory unit 104 is implemented, for example, by a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory.

[0062] The key generation unit 101 generates a key pair of its own public key and private key by executing a key generation function Gen for a traceable ring signature according to the proposed method, and stores the key pair of its own public key and private key in the storage unit 104.

[0063] The currency token creation unit 102 creates a currency token including a message and its signature, using the nonce received from the money recipient device 20. Specifically, the currency token creation unit 102 creates a currency token T[j] to be generated when paying currency as follows:

[0064] T[j]=((H １ (T[j-1]), pku2, nonce_u2), S[j]) S[j]=Sig(L, (H １ (T[j-1]), pku2, nonce_u2), sku1) L=(issue, pk Ｎ ), issue = H １ (T[j-1]) where Sig is the signature function of the traceable ring signature according to the proposed method, m=(H １ (T[j-1]), pku2, nonce_u2) is a message, and S[j] is a signature.１ (·) is a hash function, sku1 is the sender's private key, pku2 is the receiver's public key, and nonce_u2 is the value of the nonce received from the receiver's device 20.

[0065] The transaction issuing unit 103 issues a remittance transaction that includes the currency token T[j]. That is, the transaction issuing unit 103 creates the remittance transaction and sends it to the verifier / tracker device 30.

[0066] The storage unit 104 stores various information necessary for creating a currency token, issuing a remittance transaction, etc. (for example, its own private key sku1, public information (q, g, h, H, H', H'', N), public key list pk Ｎ etc.)

[0067] In addition, the remittance transaction includes a public key list pk Ｎ However, for simplicity, the following will be used as the public key list pk Ｎ This section will be omitted for certificates of

[0068] <<Payment Receiver Device 20>> Fig. 3 shows an example of the functional configuration of the payment receiver device 20 according to this embodiment. As shown in Fig. 3, the payment receiver device 20 according to this embodiment has a nonce generation unit 201. The nonce generation unit 201 is realized, for example, by a processing unit such as a CPU that executes one or more programs installed in the payment receiver device 20. The payment receiver device 20 according to this embodiment also has a memory unit 202. The memory unit 202 is realized, for example, by a storage device such as an HDD, SSD, or flash memory.

[0069] The nonce generation unit 201 generates a nonce and sends it to the remitter device 10. Note that the nonce may be, for example, a random value or a random number.

[0070] The storage unit 202 stores information (for example, a seed) for generating a nonce.

[0071] <Verifier / Tracker Device 30> An example of the functional configuration of the verifier / tracker device 30 according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the verifier / tracker device 30 according to this embodiment has a signature verification unit 301, a transaction execution unit 302, and a tracer unit 303. Each of these units is realized, for example, by a processing unit such as a CPU executing one or more programs installed in the verifier / tracker device 30. The verifier / tracker device 30 according to this embodiment also has a memory unit 304. The memory unit 304 is realized, for example, by a storage device such as an HDD, SSD, or flash memory.

[0072] The signature verification unit 301 verifies the signature S[j] included in the remittance transaction received from the remitter device 10 by executing the signature verification function Ver of the traceable ring signature according to the proposed method.

[0073] If the signature verification unit 301 successfully verifies the signature S[j], the transaction execution unit 302 executes the remittance transaction, thereby realizing an actual remittance transaction from the remitter to the recipient.

[0074] The tracing unit 303 executes the tracing function Trace of the traceable ring signature according to the proposed method, and if (m, σ) and (m', σ') for the same event L correspond to double use, identifies the public key of the signer who performed the double use.

[0075] The storage unit 304 stores information necessary for signature verification, tracing, etc. (for example, public information (q, g, h, H, H', H'', N), a public key list pk Ｎ , message and signature pairs to be tracked, etc.

[0076] <Key Generation Process> The key generation process according to this embodiment will be described with reference to Fig. 5. ｉ is the key pair (pk ｉ , sk ｉ ) will be described.

[0077] Remitter device 10 ｉThe key generation unit 101 of the traceable ring signature algorithm executes the key generation function Gen of the traceable ring signature algorithm according to the proposed method to generate a key pair (pk ｉ , sk ｉ ) (step S101). That is, the key generation unit 101 generates a key pair (pk ｉ , sk ｉ ) is generated and output.

[0078] Remitter device 10 ｉ The key generation unit 101 of the ｉ , sk ｉ ) is stored in the storage unit 104 (step S102). ｉ is made public to other ring members.

[0079] <Remittance Processing> The remittance processing according to this embodiment will be described with reference to FIG.

[0080] The nonce generation unit 201 of the money receiver device 20 generates a nonce and sends it to the money sender device 10 (step S201). The method of transmission is not particularly limited, and may be, for example, transmitted via the communication network 40 or by other methods (for example, short-range wireless communication, reading of code information, etc.).

[0081] The currency token creation unit 102 of the remitter device 10 uses the nonce received from the remitter device 20 to create a currency token T[i] including the message m and the signature σ (step S202). That is, the currency token creation unit 102 creates the following currency token T[i]:

[0082] T[i]=(m,σ) m=(H １ (T[j-1]), pku2, nonce_u2) σ=S[j] S[j]=Sig(L, m, sku1) L=(issue, pk Ｎ ), issue = H １(T[j-1]) where Sig is the signature function of the traceable ring signature according to the proposed method, and nonce_u2 is the value of the nonce received from the payee device 20. Also, sku1 is the private key of the sender (that is, if the sender is ring member π, sku1=sk π ), pku2 is the public key of the payee. The payee is not necessarily a ring member, but if the payee is a ring member, pku2∈pk Ｎ The signature σ is generated by the above steps 2-1 to 2-5.

[0083] The transaction issuing unit 103 of the remitter device 10 issues a remittance transaction including the currency token T[i] created in step S202 above (step S203). For example, if the electronic cash protocol uses a blockchain, the transaction issuing unit 103 sends the remittance transaction to the verifier / tracker device 30, which is a node that constitutes the blockchain network.

[0084] The signature verification unit 301 of the verifier / tracker device 30 verifies the signature σ for (L, m) by executing the signature verification function Ver of the traceable ring signature according to the proposed method (step S204). That is, the signature verification unit 301 verifies the signature σ for (L, m) according to the above steps 3-1 to 3-3.

[0085] If the signature verification in step S204 is successful, the transaction execution unit 302 of the verifier / tracker device 30 executes the remittance transaction (step S205), thereby realizing the actual remittance transaction from the remitter to the recipient.

[0086] <Tracking Process> The tracking process according to this embodiment will be described with reference to FIG. 7. In the following, it is assumed that (m, σ) and (m′, σ′) relating to the same event L are stored in the storage unit 304. In addition, σ=(A １ , c Ｎ , z Ｎ ), σ′=(A １ ', c Ｎ ', z Ｎ ',s Ｎ').

[0087] The tracking unit 303 acquires (m, σ) and (m′, σ′) relating to the same event L from the storage unit 304 (step S301).

[0088] The tracing unit 303 executes the tracing function Trace of the traceable ring signature according to the proposed method to find the character string “indep” or “linked” or the public key pk∈pk Ｎ In other words, the tracing unit 303 outputs the character string “indep” or “linked” or the public key pkεpk as a tracing result in the above steps 4-1 to 4-3. Ｎ As a result, for example, if a currency token is double-spent, the public key of the sender who made the double-spent can be obtained.

[0089] <Hardware Configuration Example> The remitter device 10, receivable device 20, and verifier / tracker device 30 included in the remittance system 1 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 8. The computer 500 shown in Fig. 8 comprises an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is communicatively connected via a bus 509.

[0090] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0091] The external I / F 503 is an interface with an external device such as a recording medium 503a. The computer 500 can read from and write to the recording medium 503a via the external I / F 503. Examples of the recording medium 503a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0092] The communication I / F 504 is an interface for connecting the computer 500 to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a storage device (storage device) such as an HDD, SSD, or flash memory. The processor 508 is an arithmetic device such as a CPU.

[0093] The remitter device 10, receiver device 20, and verifier / tracker device 30 included in the remittance system 1 according to this embodiment can realize the various processes described above by having, for example, the hardware configuration of a computer 500 shown in Figure 8. Note that the hardware configuration of the computer 500 shown in Figure 8 is merely an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0094] <Summary> As described above, the electronic signature system that realizes the traceable ring signature according to the proposed method can unconditionally guarantee anonymity no matter how many times a signature is made, as long as it is within a predetermined k number of times, without making any computational assumptions. Therefore, by applying the electronic signature system that realizes the traceable ring signature according to the proposed method to an electronic cash remittance system or the like, it becomes possible to guarantee anonymity no matter what kind of attacker appears, as long as the signer does not reveal his or her private key, as long as it is within the predetermined k number of times.

[0095] It goes without saying that the electronic cash remittance system is just one application example of the electronic signature system that realizes the traceable ring signature related to the proposed method, and that it can be applied to various systems other than the electronic cash remittance system.

[0096] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0097] 1 Remittance system 10 Remitter device 20 Recipient device 30 Verifier / Tracer device 40 Communication network 101 Key generation unit 102 Currency token creation unit 103 Transaction issuing unit 104 Memory unit 201 Nonce generation unit 202 Memory unit 301 Signature verification unit 302 Transaction execution unit 303 Tracing unit 304 Memory unit 500 Computer 501 Input device 502 Display device 503 External I / F 503a Recording medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage device 508 Processor 509 Bus

Claims

1. An electronic signature system that realizes electronic signatures using traceable ring signatures, in which a secret key sk consisting of k+1 secret keys is generated for the i-th ring member of the traceable ring signature, where k is a predetermined integer of 1 or more. ｉ and a public key pk that aggregates k+1 public keys. ｉ and a key generation unit that generates a private key sk of the ring member i=π who is the signer. π , the message m to be signed, and all public keys pk ｉ a signature generation unit that generates a signature σ for the event L and the message m based on an event L including a public key list representing a list of messages, a verification unit that verifies the signature σ' based on an event L' including the public key list, a message m' to be verified, and the signature σ' for the event L' and the message m'; and a verification unit that verifies two sets (m) of messages and signatures related to the same event L''. １ , σ １ ) and (m ２ , σ ２ ) based on two signatures σ １ and σ ２ a tracing unit that, if a signature is used twice, outputs the public key of the signer who used the signature twice, and the signature generating unit generates the secret information σ of the signer based on a k-wise hash function. π and generating the secret information σ π and the signature is calculated from secret information σ π and generating the signature σ including zero-knowledge proof information that proves that the signature satisfies the above requirement.

2. The signature generation unit generates the signer's private key sk π = (x π，０ , x π，１ , ..., x π，ｋ ) (where each x π，ｊ is an element of a multiplicative group G of prime order q), and a hash function H: {0, 1} ＊ →G×Z ｑ After calculating (h, X) ← H(L) using π，ｊ X ｊ the k-wise hash function by calculating the sum of j=0 to j=k−1 of π The electronic signature system of claim 1 , wherein 3. The signature generation unit uses a hash function H': {0, 1} ＊ → Using G, A ０ ←After calculating H'(L, m), A １ ← (σ π / A ０ ) １／π Thus, the secret information σ π The electronic signature system of claim 2 , wherein the information is calculated from 4. An electronic signature system that realizes electronic signatures using traceable ring signatures, where k is a predetermined integer of 1 or more, and for the i-th ring member of the traceable ring signature, a private key sk consisting of k+1 private keys is generated. ｉ and a public key pk that aggregates k+1 public keys. ｉ and a key generation procedure for generating a private key sk of the ring member i=π who will be the signer. π , the message m to be signed, and all public keys pk ｉ a signature generation procedure for generating a signature σ for the event L and the message m based on an event L containing a public key list representing a list of messages L and m; a verification procedure for verifying the signature σ' based on an event L' containing the public key list, a message m' to be verified, and the signature σ' for the event L' and the message m'; and a verification procedure for verifying two pairs (m) of messages and signatures for the same event L''. １ , σ １ ) and (m ２ , σ ２ ) based on two signatures σ １ and σ ２ a tracing step of outputting the public key of the signer who has double-used the secret information σ of the signer based on a k-wise hash function, if the secret information σ of the signer has been double-used; π and generating the secret information σ π and the signature is calculated from secret information σ π and generating the signature σ including zero-knowledge proof information that proves that the signature σ has been obtained.

Images