Non-interactive blind signature system, device, method, and program

Abstract

In a non-interactive blind signature system according to one aspect of the present disclosure, a signer device comprises: a first key generation unit that generates a public key and a secret key of a digital signature scheme as a public key and a secret key of the signer device in a blind signature; and a pre-signature generation unit that generates, as a pre-signature, a digital signature generated by means of the digital signature scheme on the basis of the secret key of the signer device, a public key of a recipient device, and a first nonce value. The recipient device comprises: a second key generation unit that generates a secret key including a q-wise hash function as a secret key of the recipient device and a commitment of the q-wise hash function as a public key of the recipient device; and a signature generation unit that generates, on the basis of the public key of the signer device, the secret key and the public key of the recipient device, a second nonce value, and the pre-signature, a message by means of the q-wise hash function and a signature by means of a dual-mode non-interactive zero-knowledge proof.

Description

Non-interactive blind signature system, device, method, and program

[0001] The present disclosure relates to a non-interactive blind signature system, apparatus, method, and program.

[0002] One known digital signature technique is called blind signature, which allows a signature to be generated while keeping the message secret from the signer. Generally, interactive communication between two parties is essential for generating a blind signature. However, a non-interactive blind signature technique is also known, which allows a signature to be generated through non-interactive communication if the message to be signed is random (Non-Patent Document 1).

[0003] Lucjan Hanzlik, "Non-interactive blind signatures for random messages," In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 722-752. Springer, 2023.

[0004] However, in existing non-interactive blind signatures, anonymity is guaranteed under computational assumptions, and therefore there is a problem in that anonymity is broken if the assumptions no longer hold.

[0005] The present disclosure has been made in consideration of the above points, and aims to realize a non-interactive blind signature scheme in which anonymity is unconditionally guaranteed as long as it is used within a predetermined number of times.

[0006] A non-interactive blind signature system according to one aspect of the present disclosure includes at least a signer device that generates a pre-signature using non-interactive blind signatures, and a recipient device that generates a message and a signature from the pre-signature, wherein the signer device includes a first key generation unit that generates a public key and a private key of a digital signature scheme as the public key and private key of the signer device in the blind signature, and a first nonce value that is used to generate the digital signature generated by the digital signature scheme based on the private key of the signer device, the public key of the recipient device, and a first nonce value. and a pre-signature generation unit that generates a digital signature as the pre-signature, and the recipient device has a second key generation unit that generates a private key including a q-wise hash function as the private key of the recipient device and a commitment of the q-wise hash function as the public key of the recipient device, and a signature generation unit that generates the message using the q-wise hash function and the signature using a dual-mode non-interactive zero-knowledge proof based on the public key of the signer device, the private key and public key of the recipient device, a second nonce value, and the pre-signature.

[0007] It is possible to realize non-interactive blind signatures that unconditionally guarantee anonymity as long as they are used within a predetermined number of times.

[0008] FIG. 1 is a diagram for explaining an example of a conventional blind signature; FIG. 1 is a diagram for explaining an example of a conventional non-interactive blind signature; FIG. 2 is a diagram showing an example of the overall configuration of a non-interactive blind signature system according to the present embodiment; FIG. 3 is a diagram showing an example of the functional configuration of a recipient device according to the present embodiment; FIG. 4 is a diagram showing an example of the functional configuration of a signer device according to the present embodiment; FIG. 5 is a diagram showing an example of the functional configuration of a verifier device according to the present embodiment; FIG. 6 is a flowchart showing an example of a signer's key generation process; FIG. 7 is a flowchart showing an example of a recipient's key generation process; FIG. 8 is a sequence diagram showing an example of a signature generation and acquisition process; FIG. 9 is a sequence diagram showing an example of a signature verification process; FIG. 10 is a diagram showing an example of a hardware configuration of a computer.

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0010] <Prior Art> First, the prior art of blind signature and non-interactive blind signature will be described.

[0011] Blind signatures are a type of anonymous signature scheme that allows a user (hereafter referred to as the recipient) who has the message to be signed to generate a signature while keeping the message confidential from the signer. Blind signatures are also a type of digital signature that originated as an application of electronic cash.

[0012] A simple application of blind signatures is anonymous authentication. For example, suppose you create an account for an application and want an administrator to generate a signature for your ID. By using blind signatures, you can generate a signature while keeping your ID secret from the administrator. During actual authentication, you simply present your ID and the signature generated by blind signatures.

[0013] An example of a conventional blind signature will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining an example of a conventional blind signature.

[0014] As shown in Fig. 1, in conventional blind signatures, signature generation and verification are realized by the following steps S11 to S17. In the following, it is assumed that the signature verifier has obtained the signer's public key pk before executing step S17, which will be described later. Note that the recipient, signer, and verifier below more precisely refer to the devices, equipment, terminals, etc. that will be the recipient, signer, and verifier, respectively.

[0015] S11: The recipient generates a confidential message M by M←Mask(m), where m is the message to be signed, and Mask is an algorithm that takes message m as input and outputs confidential message M. Note that confidential message M is a message in which the contents of message m are kept confidential by encryption or the like.

[0016] S12: The recipient sends the secret message M to the signer.

[0017] S13: The signer issues psig←Issue ｓｋ(M) generates a pre-signature psig, where sk is the signer's private key, ｓｋ is an algorithm that takes a secret key sk and a secret message M as input and outputs a pre-signature psig.

[0018] S14: The signer sends the pre-signed psig to the recipient.

[0019] S15: The recipient generates a signature sig by sig←Obtain(psig), where Obtain is an algorithm that takes the pre-signature psig as input and outputs the signature sig.

[0020] S16: The recipient sends (m, sig) to the verifier.

[0021] S17: The verifier ←Verify ｐｋ The signature sig is verified by (m, sig), where pk is the signer's public key, ｐｋ is an algorithm that takes a public key pk, a message m, and a signature sig as input and outputs 1 or 0. For example, 1 indicates successful verification, and 0 indicates unsuccessful verification.

[0022] Note that the above steps S12 and S14 correspond to interactive communication between the recipient and the signer.

[0023] <<Non-interactive blind signatures>> Interactive communication between two parties is essential when generating a blind signature, but non-interactive blind signatures (NIBS: Non-interactive Blind Signatures for random messages) are known that can generate a signature through non-interactive communication if the message to be signed is random (Non-Patent Document 1). Considering the application of the above blind signatures to anonymous authentication, if it is acceptable for the ID to be a random value, non-interactive blind signatures can be a powerful application technology.

[0024] An example of a conventional non-interactive blind signature scheme will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining an example of a conventional non-interactive blind signature scheme.

[0025] As shown in Figure 2, in conventional non-interactive blind signatures, signature generation and verification are realized by the following steps S21 to S25. In the following, it is assumed that the signature verifier has acquired the signer's public key pk before executing step S25, which will be described later. In addition, the signer obtains the recipient's public key pk ｒ It is assumed that the recipient, signer, and verifier below are, more precisely, the devices, equipment, terminals, etc. that will act as the recipient, signer, and verifier, respectively.

[0026] S21: The signer is psig←Issue ｓｋ (nonce, pk ｒ ) to generate a pre-signature psig, where sk is the signer's private key, nonce is a nonce value, and Issue ｓｋ is a private key sk, a nonce value nonce, and a public key pk ｒ This is an algorithm that takes as input the above and outputs a pre-signature psig.

[0027] S22: The signer sends the pre-signed psig to the recipient.

[0028] S23: The recipient receives (m, sig)←Obtain ｓｋ_ｒ Generate a message m and a signature sig by (nonce, psig). Here, sk_r is "sk ｒ " and is the recipient's private key. ｓｋ_ｒ is the private key sk ｒ This is an algorithm that takes a nonce value nonce and a pre-signature psig as input and outputs a message m and a signature sig.

[0029] S24: The recipient sends (m, sig) to the verifier.

[0030] S25: The verifier 1 / 0←Verify ｐｋ The signature sig is verified by (m, sig), where pk is the signer's public key, ｐｋ is an algorithm that takes a public key pk, a message m, and a signature sig as input and outputs 1 or 0. For example, 1 indicates successful verification, and 0 indicates unsuccessful verification.

[0031] <Problems with Conventional Non-Interactive Blind Signatures> In the non-interactive blind signature scheme described in Non-Patent Document 1, anonymity is guaranteed under computational complexity assumptions, and therefore there is a risk that anonymity will be breached if these assumptions no longer hold. For example, if a quantum computer or an even more powerful computer is developed, there is a risk that anonymity will be breached in the non-interactive blind signature scheme described in Non-Patent Document 1.

[0032] On the other hand, there are many existing blind signature schemes that unconditionally guarantee anonymity, such as RSA blind signature schemes and Schnorr blind signature schemes.

[0033] Therefore, below we propose a non-interactive blind signature method (hereinafter referred to as the "proposed method," or, when explicitly stating that it is a non-interactive blind signature method, as "non-interactive blind signature method related to the proposed method") that unconditionally guarantees anonymity if used within a predetermined number of times.

[0034] <Preparation> First, prepare the technology that is the premise of the proposed method.

[0035] <Digital Signature> A digital signature SIG (SIG.Gen, SIG.Sign, SIG.Verify) is composed of the following three probabilistic polynomial-time algorithms.

[0036] SIG.Gen(λ): A security parameter λ is input, and a key pair (pk, sk) consisting of a verification key pk and a signature key sk is output. Hereinafter, the verification key pk is used in the message space M ｐｋ It is assumed that the verification key pk and the signing key sk are implicitly defined. Note that the verification key pk and the signing key sk may also be called the public key and the private key, respectively.

[0037] SIG. Sign(sk, m): Signature key sk and message m ∈ M ｐｋ It takes input and outputs signature σ.

[0038] SIG.Verify(pk, m, σ): receives verification key pk, message m, and signature σ as input and outputs 1 or 0. For example, 1 indicates successful verification and 0 indicates unsuccessful verification.

[0039] <<Commitment Scheme Ensuring Unconditional Confidentiality>> The commitment scheme CMT=(CMT.Setup, CMT.Com) that satisfies unconditional confidentiality is composed of the following two probabilistic polynomial-time algorithms.

[0040] CMT.Setup(λ): Takes security parameter λ as input and outputs public parameter pp. Hereinafter, the public parameter pp is defined as the message space M ｐｐ and the random number space R ｐｐ We assume that we implicitly define

[0041] CMT.Com(pp, m; r): Public parameters pp and message m ∈ M ｐｐ and a random number r∈R ｐｐ It takes as input and outputs commitment com.

[0042] Here, the commitment method CMT that satisfies unconditional confidentiality satisfies the following properties 1-1 and 1-2.

[0043] Property 1-1 (Computational Binding): Let A be an attacker represented by any probabilistic polynomial-time algorithm. Then, Pr[m≠m′∈M ｐｐ ∧CMT.Com(pp,m;r) = CMT.Com(pp,m';r') | pp ← CMT.Setup(λ); (m,r,m',r') ← A(pp) = negl(λ), where negl(λ) denotes a negligible probability with respect to λ.

[0044] Property 1-2 (Perfect Hiding): For any attacker A, Pr[b=b'|pp←CMT.Setup(λ);(m ０ , m １ )←A(pp);b←{0,1};r←R ｐｐ ;com←CMT. Com(pp, m ｂ ;r);b'←A(pp,com)]=1 / 2 holds.

[0045] A specific example of the commitment method CMT that satisfies the above unconditional confidentiality is the Pedersen commitment method (Reference 1).

[0046] Dual-mode non-interactive zero-knowledge proof: There are two modes in dual-mode non-interactive zero-knowledge proof: binding mode and hiding mode. Let L be the NP language for the NP relation R. Ｒ In this case, the NP language L Ｒ The dual-mode non-interactive zero-knowledge proof NIZK = (NIZK.Setup, NIZK.Prove, NIZK.Verify, NIZK.Sim, NIZK.Extract) for is composed of the following five algorithms:

[0047] NIZK.Setup(λ, binding): Takes security parameter λ as input and outputs common reference information crs and trapdoor ζ for NIZK.Sim.

[0048] NIZK.Setup(λ, hiding): Takes security parameter λ as input and outputs common reference information crs and a trapdoor ξ for NIZK.Extract.

[0049] NIZK.Prove(crs, x, w): Takes common reference information crs, statement x, and evidence w as input and outputs a proof / argument π.

[0050] NIZK.Verify(crs, x, π): Takes common reference information crs, statement x, and proof / argument π as input, and outputs 1 or 0. For example, 1 indicates that the proof / argument π is correct, and 0 indicates that the proof / argument π is incorrect.

[0051] NIZK.Sim(crs, ζ, x): Given common reference information crs, trapdoor ζ, and statement x, the simulated argument π ＊ Or it outputs the symbol ⊥, which indicates failure.

[0052] NIZK.Extract(crs, ξ, x, π): Takes common reference information crs, trapdoor ξ, statement x, and proof π as input, and outputs evidence w.

[0053] Here, the dual-mode non-interactive zero-knowledge proof NIZK satisfies the following properties 2-1 to 2-6.

[0054] Property 2-1 (Mode Indistinguishability): For any security parameter λ, the advantage of attacker A in mode indistinguishability is defined below.

[0055] Adv Ａ (λ)=|Pr[mode=mode ＊ |mode←{binding, hiding}; (crs,・)←NIZK. Setup (λ, mode); mode ＊ ←A(λ, crs)]−½| where mode is randomly selected from {binding, hiding}, and random common reference information crs is obtained.

[0056] In this case, the advantage Adv is given to the attacker A, which is expressed by any probabilistic polynomial time algorithm. Ａ (λ) can be neglected.

[0057] Property 2-2 (Perfect Completeness in Both Modes): For any security parameter λ, any (x, w)∈R, crs←NIZK.Setup(λ,binding), and π←NIZK.Prove(crs,x,w), NIZK.Verify(crs,x,π) = 1 holds. Similarly, for any security parameter λ, any (x, w)∈R, crs←NIZK.Setup(λ,hiding), and π←NIZK.Prove(crs,x,w), NIZK.Verify(crs,x,π) = 1 holds.

[0058] Property 2-3 (Perfect Soundness in Binding Mode): For any attacker A, Pr[NIZK.Verify(crs, x, π) = 1 ∧ (x is in NP language L Ｒ (not included in |(crs, ξ)←NIZK.Setup(λ,binding); (x,π)←A(crs)]=0.

[0059] Property 2-4 (Extractability in Binding Mode): For any (x, π), Pr[NIZK.Verify(crs, x, π) = 1 ∧ ((x, NIZK.Extract(crs, ξ, x, π)) is not included in the NP relation R) | (crs, ξ) ← NIZK.Setup(λ, binding); (x, π) ← A(crs)] = 0 holds.

[0060] Property 2-5 (Perfect Zero-Knowledge in Hiding Mode): For any (crs, ξ) ← NIZK.Setup(λ, hiding) and any (x, w) ∈ R, the distribution of {NIZK.Prove(crs, x, w)} is perfectly indistinguishable from the distribution of {NIZK.Sim(crs, ζ, x)}.

[0061] Property 2-6 (Setup-Free for Hiding Mode): The space of the common random string (CRS) implicitly defined by the security parameter λ is SPACE ＣＲＳ In this case, Pr[crs∈NIZK.Setup(λ, hiding)|crs←SPACE ＣＲＳ ]=1−negl(λ).

[0062] According to the above property 2-6, the common reference information crs is SPACE ＣＲＳ If the data is randomly sampled from the , then it is guaranteed to be in hiding mode except with negligible probability.

[0063] A specific example of the dual-mode non-interactive zero-knowledge proof is GOS Proof (Reference 2).

[0064] <q-wise independent hash functions> The q-wise independent hash functions are a family of hash functions that can be used as random functions as long as they are used within a predetermined number of q times.

[0065] Let H be the family of hash functions. In this case, there are q distinct elements x １ , x ２ , ..., x ｑ ∈{0, 1} ａ And, y １ , y ２ , ..., y ｑ ∈{0, 1} ｂ and an element h of the function family H: {0, 1} ａ →{0, 1} ｂ For H and H, if the following is satisfied, then H is called a q-wise independent hash function.

[0066] Pr[h(x １ ) = y １ , h(x ２ ) = y ２ , ..., h(x ｑ ) = y ｑ |h←H] = (2 －ｂ ) ｑ Here, a and b are predetermined integers of 1 or more, and q is a predetermined integer of 1 or more.

[0067] <Proposed Method> The reason why the anonymity of the non-interactive blind signature scheme described in Non-Patent Document 1 must make computational assumptions is because it uses a special pseudo-random function called a verifiable random function (VRF). For this reason, the proposed method avoids the use of a verifiable random function and instead uses a commitment scheme that satisfies unconditional confidentiality, a dual-mode non-interactive zero-knowledge proof, and q-wise independent hash functions. As a result, the proposed method unconditionally guarantees anonymity as long as it is used within a predetermined number of times (specifically, within q times).

[0068] The non-interactive blind signature scheme according to the proposed method consists of five algorithms (KeyGen, RKeyGen, Issue, Obtain, and Verify).

[0069] KeyGen(λ): Takes a security parameter λ as input and outputs a key pair (pk, sk) of a signer's public key pk and private key sk. Hereinafter, the public key pk is a key pair (pk, sk) of a signer's public key pk in the nonce value space N ｐｋ We assume that we implicitly define

[0070] RKeyGen(λ): Takes security parameter λ as input and outputs a key pair (rpk, rsk) of the recipient's public key rpk and private key rsk.

[0071] Issue (sk, rpk, nonce): Signer's private key sk, recipient's public key rpk, and nonce value nonce ∈ N ｐｋ It takes as input and outputs a pre-signed psig.

[0072] Obtain(pk, rpk, rsk, nonce, psig): Takes the signer's public key pk, the recipient's key pair (rpk, rsk), the nonce value nonce, and the pre-signature psig as input, and outputs a pair (m, sig) of message m and signature sig, or the symbol ⊥ indicating failure.

[0073] Verify(pk, m, sig): takes the signer's public key pk, message m, and signature sig as input, and outputs 1 or 0. For example, 1 indicates successful verification, and 0 indicates unsuccessful verification.

[0074] <Details of each algorithm that constitutes the non-blind signature according to the proposed method> Let SIG = (SIG.Gen, SIG.Sign, SIG.Verify) be a digital signature, CMT = (CMT.Setup, CMT.Com) be a commitment scheme that satisfies unconditional confidentiality, and H be (q+2)-wise independent hash functions. Ｒ Let NIZK = (NIZK.Setup, NIZK.Prove, NIZK.Verify, NIZK.Sim, NIZK.Extract) be the dual-mode non-interactive zero-knowledge proof for

[0075] {0, 1} ＊ From SPACE ＣＲＳ Random oracle to H ｃｒｓ Similarly, {0, 1} ＊Let us define a random oracle to the space of security parameters of the commitment scheme CMT that satisfies unconditional confidentiality from H. ｐｐ In addition, the NP relation R is defined as follows:

[0076] ((pk, m), (com, h, r, nonce, psig))∈R ⇔ SIG. Verify(pk, (nonce, com), psig) = 1∧CMT. Com(H ｐｐ (0), h;r) = com ∧ h(nonce, psig) = m where h∈H.

[0077] In this case, each algorithm (KeyGen, RKeyGen, Issue, Obtain, Verify) that constitutes the non-blind signature according to the proposed method is configured as follows.

[0078] KeyGen KeyGen(λ): Using the security parameter λ as input, generate a key pair (pk, sk) using (pk, sk) ← SIG.Gen(λ), and output the key pair (pk, sk) as the signer's key pair (pk, sk). Note that this means that the key pair of a normal digital signature SIG is used as the signer's key pair.

[0079] RKeyGen RKeyGen(λ): Using the security parameter λ as input, samples the hash function h∈H and sets com←CMT.Com(H ｐｐ (0), h; r), where r∈R Ｈ_ｐｐ（０） is a random number. H_pp(0) is "H ｐｐ (0)". Then, (com, (h, r)) is output as the recipient's key pair (rpk, rsk). This means that the q-wise hash function h and the random number r are the recipient's private key rsk, and the private key rsk committed is the recipient's public key rpk. This commitment is unconditionally secure due to perfect confidentiality.

[0080] Issue Issue (sk, rpk, nonce): Signer's private key sk, recipient's public key rpk, and nonce value nonce ∈ N ｐｋUsing sk, (nonce, rpk) as input, psig←SIG.Sign(sk, (nonce, rpk)) is calculated and the pre-signature psig is output. Note that this means that a normal digital signature is used as the pre-signature.

[0081] Obtain Obtain(pk, rpk, rsk, nonce, psig): Given the signer's public key pk, the recipient's key pair (rpk, rsk), the nonce value nonce, and the pre-signature psig, if SIG.Verify(pk, (nonce, rpk), psig) = 0 (i.e., verification failed), then ⊥; otherwise, m ← h(nonce, psig) and sig ← NIZK.Prove(H ｃｒｓ (0), (pk, m), (rpk, h, r, nonce, psig)) is calculated and then (m, sig) is output. Note that this means that message m is generated using the q-wise hash function h included in the recipient's private key rsk, and that the message was generated legitimately is further proven by a dual-mode non-interactive zero-knowledge proof. This dual-mode non-interactive zero-knowledge proof is executed in confidential mode and is therefore unconditionally secure.

[0082] Verify Verify(pk, m, sig): Using the signer's public key pk, message m, and signature sig as input, verify NIZK.Verify(H ｃｒｓ (0), (m, pk), sig). Note that this means that the proof is verified using a dual-mode non-interactive zero-knowledge proof.

[0083] A non-interactive blind signature system 1 for realizing the non-interactive blind signature according to the above-mentioned proposed method will be described below.

[0084] <Overall Configuration Example> An overall configuration example of the non-interactive blind signature system 1 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the overall configuration of the non-interactive blind signature system 1 according to this embodiment.

[0085] 3, the non-interactive blind signature system 1 according to this embodiment includes a recipient device 10, a signer device 20, and a verifier device 30. The recipient device 10, the signer device 20, and the verifier device 30 are communicatively connected via a communication network 40 including, for example, the Internet.

[0086] The receiver device 10 is a device, equipment, terminal, etc. that serves as a receiver. The signer device 20 is a device, equipment, terminal, etc. that serves as a verifier. The verifier device 30 is a device, equipment, terminal, etc. that serves as a verifier.

[0087] The recipient device 10, signer device 20, and verifier device 30 can be realized using various devices, equipment, terminals, etc., such as a PC (personal computer), a smartphone, a tablet terminal, a wearable device, a general-purpose server, an IoT device, an industrial device, etc.

[0088] <Functional Configuration Example> <Recipient Device 10> An example of the functional configuration of the recipient device 10 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the functional configuration of the recipient device 10 according to this embodiment.

[0089] 4, the recipient device 10 according to this embodiment includes a communication unit 101, a key generation unit 102, and a signature generation unit 103. These units are implemented, for example, by one or more programs installed in the recipient device 10, which are executed by a processor such as a CPU (Central Processing Unit). The recipient device 10 according to this embodiment also includes a storage unit 104. The storage unit 104 is implemented, for example, by a storage area of ​​various storage devices such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory.

[0090] The communication unit 101 receives a pre-signature psig from the signer device 20 and transmits a pair (m, sig) of a message m and a signature sig to the verifier device 30 .

[0091] The key generation unit 102 executes RKeyGen, a non-interactive blind signature algorithm according to the proposed method, to generate a key pair (rpk, rsk) of a public key rpk and a private key rsk.

[0092] The signature generation unit 103 executes Obtain, a non-interactive blind signature algorithm according to the proposed method, to generate a pair (m, sig) of a message m and a signature sig.

[0093] The storage unit 104 stores various data (for example, a key pair (rpk, rsk), a pair of a message m and a signature sig (m, sig), etc.).

[0094] <<Signer Device 20>> An example of the functional configuration of the signer device 20 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the functional configuration of the signer device 20 according to this embodiment.

[0095] 5, signer device 20 according to this embodiment includes communication unit 201, key generation unit 202, and pre-signature generation unit 203. Each of these units is realized, for example, by a processor such as a CPU executing one or more programs installed in signer device 20. Signer device 20 according to this embodiment also includes storage unit 204. Storage unit 204 is realized, for example, by a storage area of ​​various storage devices such as an HDD, SSD, or flash memory.

[0096] The communication unit 201 transmits the pre-signature psig to the recipient device 10 .

[0097] The key generation unit 202 executes KeyGen, a non-interactive blind signature algorithm according to the proposed method, to generate a key pair (pk, sk) of a public key pk and a private key sk.

[0098] The pre-signature generation unit 203 executes a non-interactive blind signature issue according to the proposed method and generates a pre-signature psig.

[0099] The storage unit 204 stores various data (for example, a key pair (pk, sk), a recipient's public key rpk, etc.).

[0100] <Verifier Device 30> An example of the functional configuration of the verifier device 30 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the verifier device 30 according to this embodiment.

[0101] 6, the verifier device 30 according to this embodiment includes a communication unit 301 and a verification unit 302. These units are realized, for example, by a processor such as a CPU executing one or more programs installed in the verifier device 30. The verifier device 30 according to this embodiment also includes a storage unit 303. The storage unit 303 is realized, for example, by a storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0102] The communication unit 301 receives a pair (m, sig) of a message m and a signature sig from the recipient device 10 .

[0103] The verification unit 302 executes non-interactive blind signature verification according to the proposed method and verifies the signature sig.

[0104] The storage unit 303 stores various data (for example, the signer's public key pk, etc.).

[0105] <Processing Details> <Signer's Key Generation Processing> Processing for generating a key pair (pk, sk) of a signer's public key pk and private key sk will be described with reference to Fig. 7. Fig. 7 is a flowchart showing an example of a signer's key generation processing.

[0106] Key generation unit 202 of signer device 20 executes KeyGen, a non-interactive blind signature algorithm according to the proposed method, to generate a key pair (pk, sk) of a public key pk and a private key sk (step S101). That is, key generation unit 202 receives a security parameter λ as input, generates a key pair (pk, sk) using (pk, sk)←SIG.Gen(λ), and outputs the key pair (pk, sk) as the signer's key pair (pk, sk).

[0107] Key generation unit 202 of signer device 20 stores the key pair (pk, sk) generated in step S101 in storage unit 204, and also makes public key pk public by any method (step S102). Note that one method for making public key pk public is, for example, to register public key pk on a public server.

[0108] <<Recipient's Key Generation Process>> The process of generating a key pair (rpk, rsk) of the recipient's public key rpk and private key rsk will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the recipient's key generation process.

[0109] The key generation unit 102 of the recipient device 10 executes RKeyGen, a non-interactive blind signature algorithm according to the proposed method, to generate a key pair (rpk, rsk) of a public key rpk and a private key rsk (step S201). That is, the key generation unit 102 receives a security parameter λ as an input, samples a hash function h∈H, and generates com←CMT.Com(H ｐｐ (0), h; r) and output (com, (h, r)) as the recipient's key pair (rpk, rsk).

[0110] The key generation unit 102 of the receiver device 10 stores the key pair (rpk, rsk) generated in step S101 in the storage unit 104, and also makes the public key rpk public by any method (step S202). Note that, as a method for making the public key rpk public, for example, a method of registering the public key rpk on a public server can be given.

[0111] <<Signature Generation and Acquisition Processing>> The processing for generating and acquiring a pair (m, sig) of a signature sig and a message m will be described with reference to Fig. 9. Fig. 9 is a sequence diagram showing an example of the signature generation and acquisition processing.

[0112] The pre-signature generation unit 203 of the signer device 20 executes the non-interactive blind signature issue according to the proposed method to generate a pre-signature psig (step S301). That is, the pre-signature generation unit 203 generates a pre-signature psig by using the signer's private key sk, the recipient's public key rpk, and the nonce value nonce∈N. ｐｋUsing sk, (nonce, rpk) as input, calculate psig←SIG.Sign(sk, (nonce, rpk)) and output the pre-signature psig.

[0113] The communication unit 201 of the signer device 20 transmits the pre-signature psig generated in step S301 to the recipient device 10 (step S302).

[0114] The signature generation unit 103 of the recipient device 10 executes Obtain, a non-interactive blind signature according to the proposed method, to generate a pair (m, sig) of a message m and a signature sig (step S303). That is, the signature generation unit 103 receives the signer's public key pk, the recipient's key pair (rpk, rsk), the nonce value nonce, and the pre-signature psig as input, and if SIG.Verify(pk, (nonce, rpk), psig) = 0, it checks whether m is equal to h(nonce, psig) or sig is equal to NIZK.Prove(H ｃｒｓ The signature generation unit 103 calculates (0), (pk, m), (rpk, h, r, nonce, psig) and outputs (m, sig). Note that the signature generation unit 103 stops the process if a symbol ⊥ indicating failure is output.

[0115] The signature generation unit 103 of the recipient device 10 stores the pair (m, sig) of the message m and signature sig generated in step S303 in the storage unit 104 (step S304).

[0116] <<Signature Verification Process>> The process of verifying the signature sig will be described with reference to Fig. 10. Fig. 10 is a sequence diagram showing an example of the signature verification process.

[0117] The communication unit 101 of the receiver device 10 transmits a pair (m, sig) of a message m and a signature sig to the verifier device 30 (step S401).

[0118] The verification unit 302 of the verifier device 30 executes non-interactive blind signature verification according to the proposed method and verifies the signature sig (step S402). That is, the verification unit 302 receives the signer's public key pk, the message m, and the signature sig as inputs, and executes NIZK.Verify(H ｃｒｓ(0), (m, pk), sig) is output. This outputs 1 if the verification is successful, and 0 if the verification is unsuccessful.

[0119] <Hardware Configuration Example> The receiver device 10, signer device 20, and verifier device 30 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 11. Fig. 11 is a diagram showing an example of the hardware configuration of the computer 500.

[0120] 11 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0121] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0122] The external I / F 503 is an interface with an external device such as a recording medium 503 a. Examples of the recording medium 503 a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0123] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0124] 11 is an example, and is not limited to this example of the hardware configuration of the computer 500. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0125] <Summary> As described above, the non-interactive blind signature system 1 according to this embodiment can realize a non-interactive blind signature system in which anonymity is unconditionally guaranteed as long as it is used within a predetermined number of times. In this case, the non-interactive blind signature system 1 according to this embodiment uses a commitment scheme that ensures unconditional confidentiality, a dual-mode non-interactive zero-knowledge proof, and q-wise independent hash functions, instead of a special pseudo-random function called a verifiable random function. This is because the use of a verifiable random function requires assumptions about the computational complexity. This makes it possible to unconditionally guarantee anonymity even if, for example, a quantum computer or an even more powerful computer is developed.

[0126] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0127] [References] Reference 1: Pedersen, T.P.: Non-interactive and information-theoretic secure verifiable secret sharing. In: Feigenbaum, J. (ed.) Advances in Cryptology - CRYPTO '91, 11th 41 Annual International Cryptology Conference, Santa Barbara, California, USA, August 11-15, 1991, Proceedings. Lecture Notes in Computer Science, vol. 576, pp. 129-140. Springer (1991). Reference 2: Groth, J., Ostrovsky, R., Sahai, A.: Perfect non-interactive zero knowledge for NP. In: Vaudenay, S. (ed.) Advances in Cryptology - EUROCRYPT 2006, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, St. Petersburg, Russia, May 28 - June 1, 2006, Proceedings. Lecture.

[0128] 1 Non-interactive blind signature system 10 Recipient device 20 Signer device 30 Verifier device 40 Communication network 101 Communication unit 102 Key generation unit 103 Signature generation unit 104 Memory unit 201 Communication unit 202 Key generation unit 203 Pre-signature generation unit 204 Memory unit 301 Communication unit 302 Verification unit 303 Memory unit 500 Computer 501 Input device 502 Display device 503 External I / F 503a Recording medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage device 508 Processor 509 Bus

Claims

1. A non-interactive blind signature system including at least a signer device that generates a pre-signature using non-interactive blind signatures, and a recipient device that generates a message and a signature from the pre-signature, wherein the signer device has a first key generation unit that generates a public key and a private key of a digital signature scheme as the signer device's public key and private key in the blind signature, and a pre-signature generation unit that generates a digital signature generated by the digital signature scheme as the pre-signature based on the signer device's private key, the recipient device's public key, and a first nonce value, and the recipient device has a second key generation unit that generates a private key including a q-wise hash function as the recipient device's private key and a commitment of the q-wise hash function as the recipient device's public key, and A non-interactive blind signature system comprising: a signature generation unit that generates the message using the q-wise hash function and the signature using a dual-mode non-interactive zero-knowledge proof based on the public key of the signer device, the private key and public key of the recipient device, a second nonce value, and the pre-signature.

2. The non-interactive blind signature system described in claim 1, wherein the second key generation unit generates a private key consisting of the q-wise hash function and a random number as the private key of the recipient device, and a commitment using the random number to commit the q-wise hash function using a commitment method that satisfies unconditional confidentiality as the public key of the recipient device.

3. The non-interactive blind signature system of claim 1 or 2, wherein the signature generation unit generates the message using the q-wise hash function with the second nonce value and the pre-signature as input, and generates as the signature a proof generated by the dual-mode non-interactive zero-knowledge proof with the randomly sampled information as common reference information, the public key of the signer device and the message as a statement, and the public key and private key of the recipient device, the second nonce value, and the pre-signature as evidence.

4. The non-interactive blind signature system according to claim 3, wherein the dual-mode non-interactive zero-knowledge proof has a confidential mode and a constrained mode, and no setup is required for the confidential mode.

5. A device for generating a pre-signature using a non-interactive blind signature, comprising: a key generation unit that generates a public key and a private key of a digital signature scheme as the public key and private key of the device in the blind signature; and a pre-signature generation unit that generates, as the pre-signature, a digital signature generated by the digital signature scheme based on the private key of the device, the public key of a recipient device that receives the pre-signature, and a nonce value, with the public key of the recipient device and the nonce value as the signature targets.

6. A device for generating a message and a signature from a non-interactive blind signature pre-signature, comprising: a key generation unit that generates a private key including a q-wise hash function as the device's private key and a commitment of the q-wise hash function as the device's public key; and a signature generation unit that generates the message using the q-wise hash function with the nonce value and the pre-signature as input, based on the public key of the signer device that generates the pre-signature, the device's private key and public key, a nonce value, and the pre-signature, and generates the signature using a dual-mode non-interactive zero-knowledge proof executed in confidential mode.

7. A method used in a non-interactive blind signature system including at least a signer device that generates a pre-signature using non-interactive blind signatures and a recipient device that generates a message and a signature from the pre-signature, wherein the signer device executes: a first key generation procedure for generating a public key and a private key of a digital signature scheme as the signer device's public key and private key in the blind signature; and a pre-signature generation procedure for generating, as the pre-signature, a digital signature generated by the digital signature scheme based on the signer device's private key, the recipient device's public key, and a first nonce value; and a second key generation procedure for generating, as the recipient device's private key, a private key including a q-wise hash function and a commitment of the q-wise hash function, as the recipient device's public key. and executing a signature generation procedure to generate the message using the q-wise hash function and the signature using a dual-mode non-interactive zero-knowledge proof based on the public key of the signer device, the private key and public key of the recipient device, a second nonce value, and the pre-signature.

8. A program that causes a computer to function as the device according to claim 5 or 6.

Images