ANONYMOUS SIGNATURE SYSTEM, SIGNATURE GENERATION APPARATUS, ANONYMOUS SIGNATURE GENERATION APPARATUS, VERIFICATION APPARATUS, ANONYMOUS SIGNATURE METHOD AND PROGRAM

Abstract

An anonymous signature system in which a signature σ is anonymized by an agent specified by a signer, includes computers each including a memory and a processor configured to, from a security parameter, generate a system parameter ρ independent of the agent; from ρ, generate an agent secret key w and an agent public key gA; from ρ, generate a secret key x and a public key y of the signer; from x, a message m on which σ is to be put, and gA, generate σ to be put on m; from an identifier i of the signer, w, σ, a ring L representing a group to which the signer belongs, a list yL of public keys y of signers in L, and m, generate a ring signature σ′ by anonymizing σ; and from L, yL, m, and σ′, output a verification result b form.

Description

TECHNICAL FIELD

The present invention relates to an anonymous signature system, a signature generation apparatus, an anonymous signature generation apparatus, a verification apparatus, an anonymous signature method, and a program.

BACKGROUND ART

Anonymous signature is known as a method for electronically signing while maintaining anonymity of a signer. Ring signature is known as one of schemes of such anonymous signature. In the ring signature, although a third party can verify that a signature is created by a member of a group, which member of the group has created the signature cannot be identified, and in addition, no group manager exists.

Anonymizable signature is known as an extension of the ring signature. In the anonymizable signature, anyone who comes into possession of a message on which a signature is put can later transform the signature into an anonymous signature. Accordingly, once a signer belonging to a group (ring) hands a message on which the signer puts a signature by using an own private key over to an agent (for example, a third party that keeps and manages signatures), the signer does not need to be involved in anonymization of the signature. In other words, the signature can be anonymized only by the agent.

Meanwhile, in the anonymizable signature, a signature handed over to an agent from a signer is an ordinary signature. For example, if an attacker obtains the signature due to leakage or the like, the attacker, similarly to the agent, can find that the signer has put the signature. To overcome such a problem, agent-specified anonymizable signature is known that makes anyone but a pre-specified agent unable to find a signer (see Non-Patent Literature 1). In the agent-specified anonymizable signature, a signer generates a private key and a public key by using a system parameter made public by a specified agent, and then puts a signature on a message by using the private key. Thus, signature verification and anonymization can be performed only by the agent, so that anyone but the agent cannot find the signer even if the signature is leaked.

CITATION LIST

Non-Patent Literature

• Non-Patent Literature 1: Tetsutaro Kobayashi, Fumitaka Hoshino, “Agent-specified Anonymizable Signature”, SCIS2019, 2019.

SUMMARY OF THE INVENTION

Technical Problem

However, in the agent-specified anonymizable signature, a signer needs to generate a public key by using a system parameter made public by a specified agent, as described above. Accordingly, for example, when the signer desires to specify another agent after a public key is generated, the signer needs to regenerate a public key by using a system parameter made public by the other agent. In other words, each time the specified agent is changed, a signer spends time and effort in regenerating a public key.

An embodiment of the present invention has been made in view of the above-described respects, and an object thereof is to reduce time and effort in key generation following a change of specified agent.

Means for Solving the Problem

To achieve the object, an anonymous signature system in an embodiment of the present invention is an anonymous signature system in which a signature σ is anonymized by an agent specified by a signer, including: system parameter generation means configured to take as input a safe parameter, to generate a system parameter ρ that does not depend on the agent; setup means configured to take as input the system parameter ρ, to generate an agent private key w and an agent public key g_A; key generation means configured to take as input the system parameter ρ, to generate a private key x and a public key y of the signer; signature generation means configured to take as input the private key x, a message m on which the signature σ is to be put, and the agent public key g_A of the agent specified by the signer, to generate the signature σ to be put on the message m; anonymization means configured to take as input an identifier i of the signer, the agent private key w, the signature σ, a ring L representing a group to which the signer belongs, a list y_L of public keys y of signers belonging to the ring L, and the message m, to generate a ring signature σ′ by anonymizing the signature σ; and verification means configured to take as input the ring L, the list y_L, the message m, and the ring signature σ′, to output a verification result b for the message m.

Effects of the Invention

It is possible to reduce time and effort in key generation following a change of specified agent.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 shows an example of an overall configuration of an anonymous signature system in an embodiment of the present invention.

FIG. 2 is a flowchart showing an example of system parameter generation processing in the embodiment of the present invention.

FIG. 3 is a flowchart showing an example of setup processing in the embodiment of the present invention.

FIG. 4 is a flowchart showing an example of key generation processing in the embodiment of the present invention.

FIG. 5 is a flowchart showing an example of signature generation processing in the embodiment of the present invention.

FIG. 6 is a flowchart showing an example of anonymization processing in the embodiment of the present invention.

FIG. 7 is a flowchart showing an example of verification processing in the embodiment of the present invention.

FIG. 8 shows an example of a hardware configuration of a signature generation apparatus, an anonymous signature generation apparatus, a signature verification apparatus, and a system parameter generation apparatus in the embodiment of the present invention.

DESCRIPTION OF EMBODIMENTS

Hereinafter, an embodiment of the present invention will be described. In the embodiment of the present invention, an anonymous signature system 1 will be described in which regeneration of a key (a public key of a signer) following a change of specified agent is not needed in agent-specified anonymizable signature.

<Notation>

In the embodiment of the present invention, the following notations are introduced.

• • Assigning an element selected uniformly at random from a set X to x is denoted as follows.

$\begin{array}{cc}x\stackrel{\$}{\leftarrow }X\mathrm{or}X\stackrel{\$}{\to }x& \left[\mathrm{Math}.1\right]\end{array}$

This is also denoted as “x←^sX” or “X→^sx” hereinafter.

• • Assigning an output of a probabilistic polynomial time algorithm Alg( ) to x is denoted as follows.

$\begin{array}{cc}x\stackrel{\$}{\leftarrow }\mathrm{Alg}\left(\right)\mathrm{or}x\stackrel{\$}{\to }\mathrm{Alg}\left(\right)& \left[\mathrm{Math}.1\right]\end{array}$

This is also denoted as “x←^sAlg( )” or “Alg( )→^sx”.

• • Defining y by x or substituting x into y is denoted as “y←x” or “x→y”. However, “→” or “←” may represent a mapping (or a function) depending on the context.

When “→” or “←” represents a mapping, it will be explicitly noted that the symbol represents a mapping (or a function).

<Anonymizable Signature>

First, anonymizable signature, which is a conventional technology, will be described. It is assumed that k∈N (N is a set of all natural numbers) is a safe parameter, and that M={0, 1, . . . } is a set of signers. A subset L⊂M of the set of signers is referred to as a ring. Moreover, it is assumed that an identifier (for example, a signer ID or the like) of a signer is i, and that a private key and a public key of a signer with an identifier i is x_i and y_i, respectively. However, when the identifier i of a signer is not taken into consideration, a private key and a public key are simply denoted as x and y, respectively.

Further, for simplicity, it is defined, for any sign “a” and a ring L, that a_L=(a_i)_i∈L hereinafter. In other words, for example, when L={L0, L1, . . . }, then a_L=(a_L0, a_L1, . . . ).

At this time, an anonymizable signature scheme Σ is constituted with four probabilistic polynomial time algorithms (KeyGen, Sign, Anonymize, Verify) that satisfy a construction given below.

• • Key generation algorithm KeyGen(1^k)→^s(x, y): A probabilistic polynomial time algorithm that takes as input a safe parameter 1^k, and outputs a private key x and a public key y.
  • Signature algorithm Sign(x, m)→^sr: A probabilistic polynomial time algorithm that takes as input a private key x and a message m, and outputs a signature r. The message m is an object onto which the signature r is to be put.
  • Anonymization algorithm Anonymize(i, r, L, y_L, m)→^sσ or ⊥: A probabilistic polynomial time algorithm that takes as input an identifier i of a signer, a ring L ⊂M, a list y_L of public keys of signers belonging to the ring L, and a message m, and outputs a ring signature σ or reject ⊥. The ring signature σ is also referred to as an anonymous signature σ. As for the public key list y_L, y_L=(y_k)_k∈L.
  • Verification algorithm Verify(L, y_L, m, σ)→^s0 or 1: A probabilistic polynomial time algorithm that takes as input a ring L, a list y_L of public keys of signers belonging to the ring L, a message m, and a ring signature σ, and outputs a single bit b∈{0, 1}. For example, “b=0” represents failure in verification, and “b=1” represents success in verification.
  • Construction: For a message m∈{0, 1}* with any polynomial length, a ring L⊂M with any polynomial length, and an identifier i∈L of any signer, a probability

$\begin{array}{cc}\mathrm{Pr}[\mathrm{Verify}(L,y_L,m,\mathrm{Anonymize}\left(\mathrm{Sign}\left(x_i,m\right),L,y_L,m\right))=0|{\forall }_j\in L,\left(x_j,y_j\right)\stackrel{\$}{\leftarrow }\mathrm{KeyGen}\left(1^k\right)]& \left[\mathrm{Math}.3\right]\end{array}$

is negligible with respect to k.

As described above, to ensure anonymity of a signer, a signature r has to be private between the signer and an agent. That is to say, if an attacker obtains the signature r due to leakage, the attacker, similarly to the agent, can find that the signer has put the signature r. Accordingly, agents need to securely manage signatures entrusted by signers as secrets. Generally, in many cases, an agent is entrusted with many signatures by many signers, and a quantity of secrets to be securely managed increases in proportion to the number of signatures entrusted. Here, an agent is, for example, a third party that keeps and manages signatures.

For a specific configuration of the above-described conventional anonymizable signature, for example, Non-Patent Literature 1 mentioned above can be referenced.

<Agent-Specified Anonymizable Signature>

Next, agent-specified anonymizable signature, which is a conventional technology, will be described. An agent-specified anonymizable signature scheme Σ is constituted with five probabilistic polynomial time algorithms (Setup, KeyGen, Sign, Anonymize, Verify) that satisfy a construction given below.

• • Agent key generation algorithm Setup(1^k)→^s(w, ρ): A probabilistic polynomial time algorithm that takes as input a safe parameter 1^k, and outputs an agent private key w and a system parameter ρ. The system parameter ρ is common reference information known to participants (signers) who participate in the agent-specified anonymization signature scheme Σ, and is generated and made public by each agent. The agent private key w is private information used by an agent to anonymize a signature r.
  • Key generation algorithm KeyGen(ρ)→^s(x, y): A probabilistic polynomial time algorithm that takes as input a system parameter ρ, and outputs a private key x and a public key y. In other words, the key generation algorithm KeyGen(ρ) takes as input a system parameter ρ made public by an agent specified by a signer, among one or more agents, and outputs a private key x and a public key y.
  • Signature algorithm Sign(x, m)→^sr: A probabilistic polynomial time algorithm that takes as input a private key x and a message m, and outputs a signature r.
  • Anonymization algorithm Anonymize(i, w, r, L, y_L, m)→^sσ or ⊥: A probabilistic polynomial time algorithm that takes as input an identifier i of a signer, a signature r of the signer, a ring L⊂M, a list y_L of public keys of signers belonging to the ring L, a message m corresponding to the signature r, and an agent private key w, and outputs a ring signature σ or reject ⊥. The ring signature σ is also referred to as an anonymous signature.
  • Verification algorithm Verify(L, y_L, m, σ)→^s0 or 1: A probabilistic polynomial time algorithm that takes as input a ring L, a list y_L of public keys of signers belonging to the ring L, a message m, and a ring signature σ, and outputs a single bit b∈{0, 1}. For example, “b=0” indicates that the message m is invalid, and “b=1” indicates that the message m is valid.
  • Construction: For a message m∈{0, 1}* with any polynomial length, a ring L⊂M with any polynomial length, and an identifier i∈L of any signer, a probability

$\begin{array}{cc}\mathrm{Pr}\left[\mathrm{Verify}\left(L,y_L,m,\sigma \right)=0|\begin{array}{c}\left(w,\rho \right)\stackrel{\$}{\leftarrow }\mathrm{Setup}\left(1^k\right),\\ \forall j\in L,\left(x_j,y_j\right)\stackrel{\$}{\leftarrow }\mathrm{KeyGen}\left(\rho \right),\\ r\stackrel{\$}{\leftarrow }\mathrm{Sign}\left(x_i,m\right),\\ \sigma \stackrel{\$}{\leftarrow }\mathrm{Anonymize}\left(i,w,r,L,y_L,m\right)\end{array}\right]& \left[\mathrm{Math}.4\right]\end{array}$

is negligible with respect to k.

In the above-described agent-specified anonymizable signature, even if a signature r is leaked to an attacker, it is computationally difficult to identify which signature the signature r is, in terms of which private key x_i is used to create the signature, unless an agent private key w is leaked. In other words, in the agent-specified anonymizable signature, since the agent private key w is required to anonymize the signature r, only an agent specified by a signer can perform signature verification and anonymization. Accordingly, in the agent-specified anonymizable signature, anonymity of the signature r can be ensured unless the agent private key w is leaked.

For a specific configuration of the above-described agent-specified anonymizable signature, for example, Non-Patent Literature 1 mentioned above can be referenced.

<Agent-Independent Agent-Specified Anonymizable Signature>

In the embodiment of the present invention, an agent-specified anonymizable signature (also referred to as “agent-independent agent-specified anonymizable signature”) will be described, as an improvement of the above-described agent-specified anonymizable signature, to eliminate regeneration of a key (a public key of a signer) following a change of specified agent.

Meanwhile, for example, in the specific configuration of the agent-specified anonymizable signature according to Non-Patent Literature 1 mentioned above, a system parameter ρ is configured by using a generator g generated by an agent, and a signer performs generation of a private key x and a public key y and generation of a signature r by using the system parameter ρ. Accordingly, when the specified agent is changed, the signer needs to regenerate a public key y.

The agent-independent agent-specified anonymizable signature is therefore configured such that a generator g whose discrete logarithm is unknown to anyone is generated by using a hash value of a common reference character string crs that does not depend on an agent, and a system parameter ρ is configured from the generator g. Thus, in the agent-independent agent-specified anonymizable signature, regeneration of a public key y can be eliminated even when the specified agent is changed.

An agent-independent agent-specified anonymizable signature scheme Σ is constituted with six probabilistic polynomial time algorithms (CrsGen, Setup, KeyGen, Sign, Anonymize, Verify) that satisfy a construction given below.

• • Common reference information generation algorithm CrsGen(1^k)→^sρ: A probabilistic polynomial time algorithm that takes as input a safe parameter 1^k, and outputs a system parameter ρ. The system parameter ρ is generated from a generator g that is generated based on a hash value of a common reference character string crs.
  • Agent key generation algorithm Setup(ρ)→^s(w, g_A): A probabilistic polynomial time algorithm that takes as input a system parameter ρ, and outputs an agent private key w and an agent public key g_A.
  • Key generation algorithm KeyGen(ρ)→^s(x, y): A probabilistic polynomial time algorithm that takes as input a system parameter ρ, and outputs a private key x and a public key y.
  • Signature algorithm Sign(x, m, g_A)→^sσ: A probabilistic polynomial time algorithm that takes as input a private key x, a message m, and an agent public key g_A, and outputs a signature σ.
  • Anonymization algorithm Anonymize (i, w, σ, L, y_L, m)→^sσ′ or ⊥: A probabilistic polynomial time algorithm that takes as input an identifier i of a signer, an agent private key w, a signature σ of the signer, a ring L⊂M, a list y_L of public keys of signers belonging to the ring L, and a message m corresponding to the signature σ, and outputs a ring signature σ′ or reject ⊥. The ring signature σ is also referred to as an anonymous signature.
  • Verification algorithm Verify(L, y_L, m, σ′)→^s0 or 1: A probabilistic polynomial time algorithm that takes as input a ring L, a list y_L of public keys of signers belonging to the ring L, a message m, and a ring signature σ′, and outputs a single bit b∈{0, 1}. For example, “b=0” indicates that the message m is invalid, and “b=1” indicates that the message m is valid.
  • Construction: For a message m∈{0, 1}* with any polynomial length, a ring L⊂M with any polynomial length, and an identifier i∈L of any signer, a probability

$\begin{array}{cc}\mathrm{Pr}\left[\mathrm{Verify}\left(L,y_L,m,{\sigma }^{\prime }\right)=0|\begin{array}{c}\rho \stackrel{\$}{\leftarrow }\mathrm{CrsGen}\left(1^k\right),\\ \left(w,g_A\right)\stackrel{\$}{\leftarrow }\mathrm{Setup}\left(\rho \right),\\ \forall j\in L,\left(x_j,y_j\right)\stackrel{\$}{\leftarrow }\mathrm{KeyGen}\left(\rho \right),\\ \sigma \stackrel{\$}{\leftarrow }\mathrm{Sign}\left(x_i,m,g_A\right),\\ {\sigma }^{\prime }\stackrel{\$}{\leftarrow }\mathrm{Anonymize}\left(i,w,\sigma ,L,y_L,m\right)\end{array}\right]& \left[\mathrm{Math}.5\right]\end{array}$

is negligible with respect to k.

In the above-described agent-independent agent-specified anonymizable signature, as in the conventional agent-specified anonymizable signature, even if a signature σ is leaked to an attacker, it is computationally difficult to identify which signature the signature σ is, in terms of which private key x_i is used to create the signature, unless an agent private key w is leaked. Accordingly, in the agent-independent agent-specified anonymizable signature, only an agent specified by a signer can perform signature verification and anonymization, and a public key y does not need to be regenerated even when the signer changes the specified agent.

Here, the above-described agent-independent agent-specified anonymizable signature can be configured specifically by using a Trapdoor DDH group, similarly to the agent-specified anonymizable signature according to Non-Patent Literature 1. Accordingly, to implement such a specific configuration, several notions will be described hereinafter.

<Trapdoor DDH>

For example, the following Reference Literature 1 describes a specific configuration of a special Trapdoor DDH group made by extending pairing.

[Reference Literature 1]

F. Hoshino, “A Variant of Diffie-Hellman Problem and How to Prove Independency.” SCIS 2014 The 31st Symposium on Cryptography and Information Security Kagoshima, Japan, Jan. 21-24, 2014.

This Trapdoor DDH group is used to give a specific configuration of the above-described agent-independent agent-specified anonymization signature. An outline of the Trapdoor DDH group is as follows.

• • p is assumed to be a sufficiently large prime number.
  • E is assumed to be a supersingular elliptic curve over a finite field F_p, and to be divisible by a prime number q whose order is sufficiently large. Note that F_p=Z/pZ (Z is a ring of integers).
  • α is assumed to be a generator of E(F_p)[q].

At this time, it is assumed that G:=GL(n, α)⊆α^n×, and R:=GL (n, F_q)⊆F_q^n×n. Thus, G is an abelian group based on a group operation that is element-wise elliptic addition, and such an abelian group can be regarded as the Trapdoor DDH group. Moreover, R is a noncommutative ring, and can be regarded as the discrete logarithm with respect to G. Further, a natural pairing mapping can be defined over G, which will be described later.

<Discrete Logarithm>

It is assumed that a cyclic group is α, and order is q (where q is a prime number). At this time, when

$\begin{array}{cc}\begin{array}{ccc}{\langle \alpha \rangle }^{n\times n}& ⟶& F_q^{n\times n}\\ & & \\ \left(\begin{array}{ccc}{\alpha }^{r_{11}}& \dots & {\alpha }^{r_{1n}}\\ ⋮& \ddots & ⋮\\ {\alpha }^{r_{n1}}& \dots & {\alpha }^{r_{\mathrm{nn}}}\end{array}\right)& \mapsto & \left(\begin{array}{ccc}{r}_{11}& \dots & r_{1n}\\ ⋮& \ddots & ⋮\\ r_{n1}& \dots & r_{n,n}\end{array}\right)\end{array},& \left[\mathrm{Math}.6\right]\end{array}$

then with respect to

h:=(α^rij),  [Math. 7]

r:=(r_ij)  [Math. 8]

is referred to as a discrete logarithm. At this time, h is also denoted as α^r. When r is an identity matrix of n×n, α^r is denoted as I_n. Note that as described above, G=GL(n, α) is a subgroup of α^n×n whose discrete logarithm is regular, and is an abelian group whose group operation is element-wise elliptic addition.

As an example, operations for following g, h∈G when n=2 will be illustrated.

$\begin{array}{cc}g:=\left(\begin{array}{cc}{g}_{11}& g_{12}\\ g_{21}& g_{21}\end{array}\right)\in G,h:=\left(\begin{array}{cc}{h}_{11}& h_{12}\\ h_{21}& h_{22}\end{array}\right)\in G& \left[\mathrm{Math}.9\right]\end{array}$

When both the group operation (elliptic addition) of α and addition of G are expressed in a form of addition, an expression is as follows.

$\begin{array}{cc}g+h=h+g=\left(\begin{array}{cc}{g}_{11}+h_{11}& g_{12}+h_{12}\\ g_{21}+h_{21}& g_{22}+h_{22}\end{array}\right)\in G& \left[\mathrm{Math}.10\right]\end{array}$

However, the embodiment of the present invention shows an analogy to the notion of ordinary discrete logarithm, both the group operation (elliptic addition) of α and the addition of G are expressed in a form of multiplication, namely, as follows.

$\begin{array}{cc}\mathrm{gh}=\mathrm{hg}=\left(\begin{array}{cc}{g}_{11}{h}_{11}& g_{12}{h}_{12}\\ g_{21}{h}_{21}& g_{22}{h}_{32}\end{array}\right)\in G& \left[\mathrm{Math}.11\right]\end{array}$

<Right Exponentiation, Left Exponentiation>

Assuming that g, g₁, g₂∈G, when matrices composed of exponent portions of respective elements of g, g₁, g₂ are x, x₁, x₂∈R, respectively, it is assumed that a left exponentiation and a right exponentiation are defined such that following relationships are satisfied.

$\begin{array}{cc}\begin{array}{c}x=x_1{x}_2=x_1{x}_2\in R\\ ↧↧↧\downarrow \\ g={ }^{x_1}{g}_2=g_1^{x_2}\in G\end{array}& \left[\mathrm{Math}.12\right]\end{array}$

At this time, when R is a noncommutative ring with respect to the right exponentiation and the left exponentiation, there exists a probabilistic polynomial time algorithm for calculating the right exponentiation and the left exponentiation, with respect to [G, R], as follows.

• • Non-degenerate bi-homomorphism rpow with respect to G, R: G×R→G
  • Non-degenerate bi-homomorphism lpow with respect to G, R: R×G→G

Note that rpow is a mapping for calculating the right exponentiation, and lpow is a mapping for calculating the left exponentiation. Both rpow and lpow satisfy the associative law.

As an example, operations for x, y∈R when n=2 will be illustrated as follows. The operations are considered as matrix multiplication (^x(α^y)=α^xy, (α^y)^x=α^yx) over discrete logarithms.

$$\begin{gathered} \begin{array}{cc}x:=\left(\begin{array}{cc}{x}_{11}& x_{12}\\ x_{21}& x_{22}\end{array}\right)\in R\subseteq F_q^{2\times 2}\text{ \\ g:=(g1⁢1g1⁢2g21g22)∈G⊆〈α〉2×2}& \left[\mathrm{Math}.13\right]\end{array} \end{gathered}$$

At this time, expressions for ^xg, g^x in a form of multiplication are as follows. An expression for ^xI_n, I_n^x is also given below.

$\begin{array}{cc}{ }^{x}g:=\left(\begin{array}{cc}{g}_{11}^{x_{11}}{g}_{21}^{x_{12}}& g_{12}^{x_{11}}{g}_{22}^{x_{12}}\\ g_{11}^{x_{21}}{g}_{21}^{x_{22}}& g_{12}^{x_{21}}{g}_{22}^{x_{22}}\end{array}\right)\in G{g}^x:=\left(\begin{array}{cc}{g}_{11}^{x_{11}}{g}_{12}^{x_{21}}& g_{11}^{x_{12}}{g}_{12}^{x_{22}}\\ g_{21}^{x_{11}}{g}_{22}^{x_{21}}& g_{21}^{x_{12}}{g}_{22}^{x_{22}}\end{array}\right)\in G{ }^x{I}_n=I_n^x={\alpha }^x& \left[\mathrm{Math}.14\right]\end{array}$

<Key Exchange>

Although not directly related to the agent-independent agent-specified anonymizable signature, key exchange can be also implemented because “^x(g^y)=(^xg)^y” holds for x, y∈R, g∈G, as mentioned above. In other words, key exchange can be performed through (1) to (4) described below.

(1) Alice generates x∈R, and transmits ^xg to Bob.

(2) Bob generates y∈R, and transmits g^y to Alice.

(3) Bob calculates K_A=^x(g^y).

(4) Alice calculates K_B=(^xg)^y.

As mentioned above, as “^x(g^y)=(^xg)^y” holds for x, y∈R, g∈G, K_A=K_B holds, and accordingly, key exchange can be performed.

<Pairing>

A natural pairing mapping can be defined over G as follows.

e: α ^n×n×α^n×n→μ_q^n×n

This pairing mapping is considered as matrix multiplication (e (α^x, α^y)=ξ^xy) over discrete logarithms.

As an example, when n=2, g, h∈G are assumed to be as follows.

$\begin{array}{cc}g:=\left(\begin{array}{cc}{g}_{11}& g_{12}\\ g_{21}& g_{22}\end{array}\right)\in G,h:=\left(\begin{array}{cc}{h}_{11}& h_{12}\\ h_{21}& h_{22}\end{array}\right)\in G& \left[\mathrm{Math}.16\right]\end{array}$

At this time, a pairing mapping e(g, h) can be defined by the following expression.

$\begin{array}{cc}e\left(g,h\right):=\left(\begin{array}{cc}e\left(g_{11},h_{11}\right)e\left(g_{12},h_{21}\right)& e\left(g_{11},h_{12}\right)e\left(g_{12},h_{22}\right)\\ e\left(g_{21},h_{11}\right)e\left(g_{22},h_{21}\right)& e\left(g_{21},h_{12}\right)e\left(g_{22},h_{22}\right)\end{array}\right)\in {\mu }_q^{2\times 2}& \left[\mathrm{Math}.17\right]\end{array}$

<Overall Configuration of Anonymous Signature System 1>

Hereinafter, an anonymous signature system 1 that implements the above-described agent-independent agent-specified anonymizable signature scheme Σ will be described with reference to FIG. 1. FIG. 1 shows an example of an overall configuration of the anonymous signature system 1 in the embodiment of the present invention.

As shown in FIG. 1, the anonymous signature system 1 in the embodiment of the present invention includes a plurality of signature generation apparatuses 10, one or more anonymous signature generation apparatuses 20, one or more signature verification apparatuses 30, and one or more system parameter generation apparatuses 40. The signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 are communicably connected to one another, for example, through a communication network 50 such as the Internet.

Each signature generation apparatus 10 is a computer or a computer system used by a signer, and performs generation of a private key x and a public key y and generation (creation) of a signature σ. Each signature generation apparatus 10 includes a key generation unit 110 and a signature generation unit 120.

The key generation unit 110 executes the key generation algorithm KeyGen(ρ) in the agent-independent agent-specified anonymizable signature scheme Σ. Specifically, the key generation unit 110 takes as input a system parameter ρ that does not depend on an agent (that is, an agent-independent system parameter ρ, in other words, a system parameter ρ commonly used by each agent), and outputs a private key x and a public key y. The outputted private key x is stored, for example, in an auxiliary storage device or the like of the signature generation apparatus 10. On the other hand, the outputted public key y is made public by using any method.

The signature generation unit 120 executes the signature algorithm Sign(x, m, g_A) in the agent-independent agent-specified anonymizable signature scheme Σ. Specifically, the signature generation unit 120 takes as input a private key x, a message m, and an agent public key g_A, and outputs a signature σ. Here, for the agent public key g_A, an agent public key g_A of an agent specified by a signer is used. The outputted signature σ is transmitted, along with the message m, to an anonymous signature generation apparatus 20 of the agent specified by the signer.

Note that the key generation unit 110 and the signature generation unit 120 are implemented, for example, through processing that one or more programs installed in the signature generation apparatus 10 cause a processor or the like to perform.

The anonymous signature generation apparatus 20 is a computer or a computer system used by an agent, and performs generation of an agent private key w and an agent public key g_A and anonymization of a signature σ. The anonymous signature generation apparatus 20 includes a setup unit 210 and an anonymization unit 220.

The setup unit 210 executes the agent key generation algorithm Setup(ρ). Specifically, the setup unit 210 takes as input a system parameter ρ that does not depend on an agent, and outputs an agent private key w and an agent public key g_A. The outputted agent private key w is stored, for example, in an auxiliary storage device or the like of the anonymous signature generation apparatus 20. On the other hand, the outputted agent public key g_A is made public by using any method.

The anonymization unit 220 executes the anonymization algorithm Anonymize(i, w, σ, L, y_L, m). Specifically, the anonymization unit 220 takes as input an identifier i of a signer, an agent private key w, a signature σ of the signer, a ring L, a list y_L of public keys of signers belonging to the ring L, and a message m corresponding to the signature σ, and outputs a ring signature σ′ or reject ⊥.

Note that the setup unit 210 and the anonymization unit 220 are implemented, for example, through processing that one or more programs installed in the anonymous signature generation apparatus 20 cause a processor or the like to perform.

The signature verification apparatus 30 is a computer or a computer system used by an agent or a third party different from the agent, and performs verification of a ring signature σ′. The signature verification apparatus 30 includes a verification unit 310.

The verification unit 310 executes the verification algorithm Verify(L, y_L, m, σ′). Specifically, the verification unit 310 takes as input a ring L, a list y_L of public keys of signers belonging to the ring L, a message m, and a ring signature σ′, and outputs a single bit b∈{0, 1}.

Note that the verification unit 310 is implemented through processing that one or more programs installed in the signature verification apparatus 30 cause a processor or the like to perform.

The system parameter generation apparatus 40 is a computer or a computer system used by a manager of a system parameter ρ that does not depend on an agent (for example, a third party different from every agent, an agent that represents all agents, or the like), and performs generation of a system parameter ρ. The system parameter generation apparatus 40 includes a system parameter generation unit 410.

The system parameter generation unit 410 executes the common reference information generation algorithm CrsGen. Specifically, the system parameter generation unit 410 takes as input a safe parameter 1^k, and outputs a system parameter ρ. The system parameter ρ is information commonly referenced by each signer and each agent, and is made public by using any method.

Note that the system parameter generation unit 410 is implemented, for example, through processing that one or more programs installed in the system parameter generation apparatus 40 cause a processor or the like to perform.

With the foregoing, the anonymous signature system 1 in the embodiment of the present invention can implement the agent-independent agent-specified anonymizable signature scheme Σ. The agent-independent agent-specified anonymizable signature scheme Σ is assumed to satisfy the construction represented by Math. 5 mentioned above.

Note that the configuration of the anonymous signature system 1 shown in FIG. 1 is an example, and other configurations may be adopted. For example, the anonymous signature generation apparatus 20 and the signature verification apparatus 30 may be integrally configured as a single apparatus.

<Details of Processing by Anonymous Signature System 1>

It is assumed that G is the above-described Trapdoor DDH group, that R is the discrete logarithm with respect to G, and that G_T=GL(n, e(α, α)). Moreover, it is assumed that e: G×G→G_T is a pairing mapping of the above-described Trapdoor DDH group, and that a mapping H: {0, 1}*→G and a mapping H′: {0, 1}*→R are mutually independent random oracles. Further, a system parameter ρ is assumed to have a form of ρ=(R, G, G_T, e, g, H, H′).

(System Parameter Generation Processing)

First, system parameter generation processing performed by the system parameter generation unit 410 will be described with reference to FIG. 2. FIG. 2 is a flowchart showing an example of the system parameter generation processing in the embodiment of the present invention.

Step S101: First, the system parameter generation unit 410 takes as input a safe parameter 1^k.

Step S102: Subsequently, the system parameter generation unit 410 generates a system parameter ρ as follow.

crs←{0, 1}^k

g←H(crs)

ρ←(R, G, G_T, e, g, H, H′)

Step S103: Lastly, the system parameter generation unit 410 outputs the system parameter ρ.

Thus, the system parameter ρ that does not depend on an agent is generated. As described above, a generator g whose discrete logarithm is unknown to anyone is generated by using a hash value of a common reference character string crs that is generated based on the safe parameter 1^k, and the system parameter ρ is then configured by using the generator g. The system parameter ρ is made public to a signer and an agent.

(Setup Processing)

Next, setup processing performed by the setup unit 210 will be described with reference to FIG. 3. FIG. 3 is a flowchart showing an example of the setup processing in the embodiment of the present invention. In the setup processing shown in FIG. 3, a case will be described in which the anonymous signature generation apparatus 20 of an agent, among agents, generates an agent private key w and an agent public key g_A.

Step S201: First, the setup unit 210 takes as input a system parameter ρ.

Step S202: Subsequently, the setup unit 210 generates an agent private key w and an agent public key g_A as follows.

$\begin{array}{cc}w\stackrel{\$}{\leftarrow }R{g}_A\leftarrow I_n^w& \left[\mathrm{Math}.18\right]\end{array}$

Step S203: Lastly, the setup unit 210 outputs the agent private key w and the agent public key g_A.

Thus, the agent private key w and the agent public key g_A are generated. The agent private key w is stored, for example, in the auxiliary storage device or the like of the anonymous signature generation apparatus 20. On the other hand, the system parameter ρ is made public to a signer.

(Key Generation Processing)

Next, key generation processing performed by the key generation unit 110 will be described with reference to FIG. 4. FIG. 4 is a flowchart showing an example of the key generation processing in the embodiment of the present invention. In the key generation processing shown in FIG. 4, a case will be described in which the signature generation apparatus 10 of a certain signer belonging to a ring L generates a private key x and a public key y.

Step S301: First, the key generation unit 110 takes as input a system parameter ρ. At this time, the key generation unit 110 takes as input the system parameter ρ that is generated and made public by the system parameter generation apparatus 40.

Step S302: Subsequently, the key generation unit 110 parses the system parameter ρ such that (R, G, G_T, e, g, H, H′)←ρ. In other words, the key generation unit 110 sets the system parameter ρ as (R, G, G_T, e, g, H, H′).

Step S303: Subsequently, the key generation unit 110 generates a private key x and a public key y, by setting “x←^sR”, and then, “y←^xg”.

Step S304: Lastly, the key generation unit 110 outputs the private key x and the public key y.

Thus, the private key x and the public key y of the certain signer belonging to the ring L are generated. At this time, as described above, the private key x and the public key y are generated by using the system parameter ρ that does not depend on an agent. Accordingly, even when the specified agent is changed, the signer does not need to regenerate a private key x and a public key y. The private key x is stored, for example, in the auxiliary storage device or the like of the signature generation apparatus 10. On the other hand, the public key y is made public to an agent.

(Signature Processing)

Next, signature processing performed by the signature generation unit 120 will be described with reference to FIG. 5. FIG. 5 is a flowchart showing an example of the signature generation processing in the embodiment of the present invention. In the signature processing shown in FIG. 5, a case will be described in which the signature generation apparatus 10 of the certain signer belonging to the ring L generates (creates) a signature.

Step S401: First, the signature generation unit 120 takes as input the private key x, a message m, and an agent public key g_A. At this time, the signature generation unit 120 takes as input an agent public key g_A that is made public by an agent specified by the signer.

Step S402: Subsequently, the signature generation unit 120 generates a signature σ such that σ→(^xH (ρ, m), ^xg_A). ρ used here is the system parameter ρ that is generated and made public by the system parameter generation apparatus 40.

Step S403: Lastly, the signature generation unit 120 outputs the signature σ.

Thus, the signature σ is generated. The signature σ is transmitted, along with the message m, to the anonymous signature generation apparatus 20 of the agent specified by the signer.

(Anonymization Processing)

Next, anonymization processing performed by the anonymization unit 220 will be described with reference to FIG. 6. FIG. 6 is a flowchart showing an example of the anonymization processing in the embodiment of the present invention. In the anonymization processing shown in FIG. 6, a case will be described in which a signature σ of a signer with an identifier i is anonymized.

Step S501: First, the anonymization unit 220 takes as input the identifier i of the signer, the signature σ of the signer, a ring L, a list y_L of public keys of signers belonging to the ring L, a message m corresponding to the signature σ, and an agent private key w.

Step S502: Subsequently, the anonymization unit 220 generates output values h of a random oracle H such that h→H(ρ, m). For the system parameter ρ, a system parameter ρ that is generated and made public by the system parameter generation apparatus 40 is used.

Step S503: Subsequently, the anonymization unit 220 parses the signature σ such that (r, Y)←σ. At this time, the anonymization unit 220 parses, for example, σ that is coded as ordered pairs of elements over G by the signature generation unit 120, into ordered pairs (r, Y) of elements over G.

Step S504: Subsequently, the anonymization unit 220 executes

X←Y ^{w −1} .  [Math. 19]

Step S505: Subsequently, the anonymization unit 220 determines whether or not “e(X, g)≠e(I_n, y_i)” is satisfied.

Step S506: When it is determined in step S505 that “e(X, g)≠e(I_n, y_i)” is not satisfied, the anonymization unit 220 determines whether or not “e(I_n, r)≠e(X, h)” is satisfied.

Step S507: When it is determined in step S505 that “e(X, g)≠e(I_n, y_i)” is satisfied, or when it is determined in step S506 that “e(I_n, r)≠e(X, h)” is satisfied, the anonymization unit 220 outputs reject ⊥. In such a case, the signature σ cannot be anonymized.

Step S508: When it is determined in step S506 that “e(I_n, r)≠e(X, h)” is not satisfied, the anonymization unit 220 generates zero-knowledge proofs for r and X such that (∃j∈R, e(I_n, r)=e(X, h)), through following steps S508-1 to S508-4.

Step S508-1: The anonymization unit 220 executes

$$\begin{gathered} \begin{array}{cc}{t}_1,t_2,t_3,\beta \stackrel{\$}{\leftarrow }R\text{ \\ V←\hspace{0.05em}βe⁢(In,yi),U←\hspace{0.05em}βe⁢(In,r)⁢ \\ T1,i←\hspace{0.05em}t1e⁢(In,yi).}& \left[\mathrm{Math}.20\right]\end{array} \end{gathered}$$

Step S508-2: Subsequently, with respect to any j∈L\{i}, the anonymization unit 220 executes

$$\begin{gathered} \begin{array}{cc}{c}_{1,j},z_{1,j}\stackrel{\$}{\leftarrow }R\text{ \\ T1,j←e⁡(In,\hspace{0.05em}z1,jyj)⁢\hspace{0.05em}c1,jV.}& \left[\mathrm{Math}.21\right]\end{array} \end{gathered}$$

Step S508-3: The anonymization unit 220 executes

T ₂←^t2e(I_n,g),T₂′←^t2e(I_n,h)

T ₃←^t3e(I_n,I_n)  [Math. 22]

Thus, c_1,j, z_1,j, T_1,j, T₂, T₂′, and T₃ are obtained.

Step S508-4: The anonymization unit 220 executes

(c_1,i,c₂,c₃)←H′(ρ,L,m,y_L,U,V,T_1,L,T₂,T₂′,T₃)−Σ_j≠i(c_1,j,0,0)

z _1,i ←t ₁ −c _1,iβ

z ₂←^t2I_n/^c2βX

z ₃←^t3I_n/^c3βr  [Math. 23]

Thus, c_1,i, c₂, c₃, z_1,i, z₂, and z₃ are obtained.

Step S509: Subsequently, the anonymization unit 220 generates a ring signature σ′ such that σ′←(U, V, c_1,L, c₂, c₃, z_1,L, z₂, z₃).

Step S510: Lastly, the anonymization unit 220 outputs the ring signature σ′. Thus, the ring signature σ′ is generated.

As described above, in the agent-independent agent-specified anonymizable signature scheme Σ, as in the conventional agent-specified anonymizable signature, an agent private key w is used to anonymize a signature σ. Accordingly, only an agent specified by a signer can perform anonymization of a signature σ. Accordingly, also in the agent-independent agent-specified anonymizable signature scheme Σ, even if a signature σ is leaked, anonymity of the signature σ can be ensured unless an agent private key w is leaked.

(Verification Processing)

Next, verification processing performed by the verification unit 310 will be described with reference to FIG. 7. FIG. 7 is a flowchart showing an example of the verification processing in the embodiment of the present invention.

Step S601: First, the verification unit 310 takes as input a ring L, a list y_L of public keys of signers belonging to the ring L, a message m, and a ring signature σ′.

Step S602: Subsequently, the verification unit 310 parses the ring signature σ′ such that (U, V, c_1,L, c₂, c₃, z_1,L, z₂, z₃)←σ′. In other words, the verification unit 310 analyzes the ring signature σ′ into (U, V, c_1,L, c₂, c₃, z_1,L, z₂, z₃).

Step S603: Subsequently, the verification unit 310 generates output values h of a random oracle H such that h←H(ρ, m). Note that for the system parameter ρ, a system parameter ρ that is generated and made public by the system parameter generation apparatus 40 is used.

Step S604: Subsequently, with respect to any j∈L, the verification unit 310 executes

T _1,j ←e(I_n,^z1,jy_j)^c1,jV

T ₂ →e(z₂,g)^c2V,T₂′←e(z₂,h)^c2U

T ₃ ←e(I_n,z₃)^c3U

c ₁=Σ_j∈Lc_1,j  [Math. 24]

to generate T_1,j, T₂, T₂′, T₃, and c₁.

Step S605: Subsequently, the verification unit 310 determines whether or not “H′(ρ, L, m, y_L, U, V, T_1,L, T₂, T₂′, T₃)=(c₁, c₂, c₃)” is satisfied.

Step S606: When it is determined in step S605 that “H′(ρ, L, m, y_L, U, V, T_1,L, T₂, T₂′, T₃)=(c₁, c₂, c₃)” is satisfied, the verification unit 310 outputs “1” as a verification result. In such a case, it is indicated that the message m is valid.

Step S607: When it is determined in step S605 that “H′(ρ, L, m, y_L, U, V, T_1,L, T₂, T₂′, T₃)=(c₁, c₂, c₃)” is not satisfied, the verification unit 310 outputs “0” as a verification result. In such a case, it is indicated that the message m is invalid.

<Hardware Configuration>

Finally, a hardware configuration of the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 in the embodiment of the present invention will be described with reference to FIG. 8. FIG. 8 shows an example of the hardware configuration of the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 in the embodiment of the present invention. Note that since the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 can be implemented by using almost the same hardware configuration, the hardware configuration of the signature generation apparatuses 10 will be mainly described hereinafter.

As shown in FIG. 8, each signature generation apparatus 10 in the embodiment of the present invention includes an input device 501, a display device 502, a RAM (Random Access Memory) 503, a ROM (Read Only Memory) 504, a processor 505, an external I/F 506, a communication I/F 507, and an auxiliary storage device 508. Each of the hardware pieces are communicably connected to one another through a bus 509.

The input device 501 is, for example, a keyboard, a mouse, a touch panel, or the like, and is used for a user to input various operations. The display device 502 is, for example, a display or the like, and is used to display a processing result or the like to the user. Note that the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 may omit including at least one of the input device 501 and the display device 502.

The RAM 503 is a volatile semiconductor memory that temporarily stores a program and data. The ROM 504 is a non-volatile semiconductor memory that can retain a program and data even when a power supply is turned off. The processor 505 is, for example, a CPU (Central Processing Unit) or the like, and is a computational device that reads a program and data from the ROM 504, the auxiliary storage device 408, or the like onto the RAM 503 and performs processing.

The external I/F 506 is an interface with an external device. External devices include a recording medium 506a and the like, Examples of the recording medium 506a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

The communication I/F 507 is an interface for connecting the signature generation apparatus 10 to the communication network 50. The signature generation apparatus 10 can perform data communication with another device via the communication I/F 507. The same applies to the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40.

The auxiliary storage device 508 is, for example, a non-volatile storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The auxiliary storage device 508 stores various data, programs (for example, one or more programs implementing the key generation unit 110 and the signature generation unit 120), and the like. Note that the auxiliary storage device 508 of the anonymous signature generation apparatus 20 stores, for example, one or more programs implementing the setup unit 210 and the anonymization unit 220, and the like. Similarly, the auxiliary storage device 508 of the signature verification apparatus 30 stores, for example, one or more programs implementing the verification unit 310, and the like. Similarly, the auxiliary storage device 508 of the system parameter generation apparatus 40 stores, for example, one or more programs implementing the system parameter generation unit 410, and the like.

The signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 in the embodiment of the present invention can implement the above-described various processing by having the hardware configuration shown in FIG. 8. Note that in FIG. 8 although the case is described in which each of the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 is implemented by using a single apparatus (computer), not limited to such a configuration, at least one of the signature generation apparatuses 10, the anonymous signature generation apparatus 20, the signature verification apparatus 30, and the system parameter generation apparatus 40 may be implemented by using a plurality of apparatuses (computers). One apparatus (computer) may include a plurality of processors 505 or a plurality of memories (for example, RAMs 503, ROMs 504, auxiliary storage devices 508, or the like).

The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations, and the like can be made without departing from the scope of claims.

REFERENCE SIGNS LIST

• • 1 Anonymous signature system
  • 10 Signature generation apparatus
  • 20 Anonymous signature generation apparatus
  • 30 Signature verification apparatus
  • 40 System parameter generation apparatus
  • 110 Key generation unit
  • 120 Signature generation unit
  • 210 Setup unit
  • 220 Anonymization unit
  • 310 Verification unit
  • 410 System parameter generation unit

Claims

1. An anonymous signature system in which a signature σ is anonymized by an agent specified by a signer, the system comprising: one or more computers each including a memory and a processor configured to take as input a security parameter, to generate a system parameter ρ that does not depend on the agent;take as input the system parameter ρ, to generate an agent secret key w and an agent public key gA;take as input the system parameter ρ, to generate a secret key x and a public key y of the signer;take as input the secret key x, a message m on which the signature σ is to be put, and the agent public key gA of the agent specified by the signer, to generate the signature σ to be put on the message m;take as input an identifier i of the signer, the agent secret key w, the signature σ, a ring L representing a group to which the signer belongs, a list yL of public keys y of signers belonging to the ring L, and the message m, to generate a ring signature σ′ by anonymizing the signature σ; andtake as input the ring L, the list yL, the message m, and the ring signature σ′, to output a verification result b for the message m.

2. The anonymous signature system according to claim 1, wherein the processor is further configured to generate a generator g of a Trapdoor DDH group by inputting a common reference character string crs generated based on the security parameter into a predetermined hash function, and to generate the system parameter ρ based on the generator g.

3. A signature generation apparatus connected to a system parameter generation apparatus through a network, the system parameter generation apparatus generating a system parameter ρ that does not depend on an agent that anonymizes a signature σ though anonymizable signature, the signature generation apparatus comprising: a memory and a processor configured to take as input the system parameter ρ generated by the system parameter generation apparatus, to generate a secret key x and a public key y of a signer;take as input the secret key x, a message m on which the signature σ is to be put, and an agent public key gA of an agent specified by the signer, to generate the signature σ to be put on the message m; andtransmit the message m and the signature σ to an anonymous signature generation apparatus with which the agent anonymizes the signature σ.

4. An anonymous signature generation apparatus connected to a system parameter generation apparatus through a network, the system parameter generation apparatus generating a system parameter ρ that does not depend on an agent that anonymizes a signature σ through anonymizable signature, the anonymous signature generation apparatus comprising: a memory and a processor configured to take as input the system parameter ρ generated by the system parameter generation apparatus, to generate an agent secret key w and an agent public key gA; andtake as input the signature σ, a message m corresponding to the signature σ, an identifier i of a signer of the signature σ, the agent secret key w, a ring L representing a group to which the signer belongs, and a list yL of public keys y of signers belonging to the ring L, to generate a ring signature σ′ by anonymizing the signature σ.

5. (canceled)

6. (canceled)

7. A non-transitory computer-readable recording medium having computer-readable instructions stored thereon, which when executed, cause a computer including a memory and a processor to execute respective operations in the signature generation apparatus according to claim 3, or respective operations in the anonymous signature generation apparatus according to claim 4.