Member certificate acquiring device, member certificate issuing device, group signing device, and group signature verifying device

• US 8,074,067 B2
• Filed: 01/16/2006
• Issued: 12/06/2011
• Est. Priority Date: 02/10/2005
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Furukawa, Jun
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Rahman, Mahfuzur
• Application Number:
  US11/815,848
• Publication Number:
  US 20090074188A1
• Time in Patent Office: 2,150 Days
• Field of Search: 713/156
• US Class Current: 713/156
• CPC Class Codes: G06Q 20/3678 e-cash details, e.g. blinded, divisible or detecting double spending
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures

Abstract

It is an object of the present invention to enhance the security and reduce the data amount of data to be handled in a group signing system, in which when the group public key which includes: a description for four groups: group 1, group 2, group T, and group E of the same order number; a description of bilinear mapping from group 1 and group 2 to group T; each generator of group 1, group 2, group T, and group E; and a signature public key of a signature scheme using group 1, group 2, and group T, is input, the member secret key including an integer not larger than the order number, member evidence which is a value given by multiplying the generator of group E by the member secret key, and an element of group 1 or group 2 which is a value given by multiplying the generator of the group 1 or the group 2 by the member secret key are sent to the member-certificate issuing device, and thereafter upon receipt of a signature for the member secret key, which is verifiable by the signature public key, from the member-certificate issuing device, the signature is used as the member certificate.

Claims

1. A group signing device, which is input with a group public key, a tracking public key, a member certificate, a member secret key, and a message and which outputs a group signature for said message, said group signing device comprising:

an encryption device for creating an encrypted text in which part of member evidence generated from said member secret key is encrypted by said tracking public key from;

a) said group public key including a description for four groups;

(1) group 1, group 2, group T, and group E, of a same order number,

(2) a description of bilinear mapping from said group 1 and said group 2 to said group T,

(3) respective generators of said group 1, said group 2, said group T, and said group E, and

(4) a signature public key of a signature scheme utilizing said group 1, said group 2, and said group T;

b) said tracking public key comprising an element of said group E; and

c) said member secret key; and

a knowledge-proof-statement generating device comprising a processor which generates a knowledge proof statement which is data for proving that a secret key encrypted into said encrypted text and a signature for said secret key can be calculated from input data, wherein said group signature to be output includes said knowledge proof statement generated by said knowledge-proof-statement generating device, and

wherein said group E is a group different from said group 1, said group 2, and said group T for solving a Diffie-Hellman discrimination problem.

2. The group signing device according to claim 1, characterized in that said knowledge-proof-statement generating device comprises:

a commitment generating device which is input with said group public key, said tracking public key, said member secret key, said member certificate, and said random number and generates a commitment to encryption which is data for proving knowledge of a random number for encryption, and a commitment to a member certificate which is data for proving knowledge of a signature and member secret key, to output said commitment to encryption and said commitment to a member certificate as a commitment;

a challenge-value generating device which is input with said group public key, said tracking public key, said encrypted text, and said commitment and outputs a hash value of the foregoing values as a challenge value; and

a response generating device which is input with said group public key, said member secret key, said member certificate, said random number, and said challenge value, and outputs a response of encryption and a response of member certification as a response.

3. The group signing device according to claim 2, characterized in that said group signature comprises said encrypted text, said commitment, and said response.

4. The group signing device according to claim 2, characterized in that said group signature comprises said encrypted text, said challenge value, and said response.

5. A group signing system, comprising the group signing device according to claim 1, characterized in that said member-certificate acquiring device communicates with said member-certificate issuing device to acquire a member certificate and a member secret key;

inputs the acquired said member certificate, the acquired said member secret key, a message, a group public key, and a tracking public key into said group signing device to acquire a group signature for said message; and

inputs said message and the acquired group signature into said group-signature verifying device to verify that the acquired group signature is a valid group signature for said message and to input said group signature into said tracking device thereby outputting a member evidence representing the member which has generated the group signature.

6. A group-signature verifying device, which is input with a group public key, a tracking public key, a message, and a group signature, and judges whether said group signature is a valid group signature for said message to output a valid indicator or an invalid indicator, characterized in that when input with:

a) said group public key which includes a description for four groups;

(1) group 1, group 2, group T, and group E, of a same order number;

(2) a description of bilinear mapping from said group 1 and said group 2 to said group T;

(3) respective generators of said group 1, said group 2, said group T, and said group E; and

(4) a signature public key of a signature scheme using said group 1, said group 2, and said group T;

b) said tracking public key comprising an element of said group E; and

c) said group signature including an encrypted text in which part of member evidence generated by a member secret key is encrypted by said tracking public key,

said group-signature verifying device judges whether said group signature is a valid group signature for said message to output said valid indicator or said invalid indicator; and

a knowledge-proof-statement verifying device comprising a processor which verifies that a knowledge proof statement is data to prove that a secret key which is used to generate said part of said member evidence encrypted into said encrypted text, and a signature for said secret key can be calculated from data input into said group-signature verifying device and from data included in said group-signature verifying device,

said group signature includes said knowledge proof statement which has been verified by said knowledge-proof-statement verifying device, and

said group E is a group different from said group 1, said group 2, and said group T for solving a Diffie-Hellman discrimination problem.

7. The group signing device according to claim 6, characterized in that said group signature comprises said encrypted text, said commitment, and said response, and said knowledge-proof-statement verifying device comprises:

a challenge-value generating device which is input with said group public key, said tracking public key, said encrypted text, and said commitment, and outputs a hash value of the foregoing values as a challenge value; and

a response verifying device which is input with said group public key, said tracking public key, said encrypted text, said commitment, said challenge value and said response, and outputs the valid indicator or the invalid indicator depending on whether or not these inputs satisfy a given equation, wherein

the output of said response verifying device is output as the output of said group-signature verifying device.

8. The group-signature verifying device according to claim 6, characterized in that:

said group signature comprises said encrypted text, said challenge value, and said response; and

said knowledge-proof-statement verifying device comprises;

a commitment generating device which is input with said group public key, said tracking public key, said response, and said challenge value, and outputs a commitment to encryption and a commitment to member certificate as a commitment; and

a response verifying device which is input with said public key, said tracking public key, said encrypted text, and said commitment, and outputs the valid indicator or the invalid indicator depending on whether or not a hash value of the foregoing values corresponds to said challenge value, wherein

the output of said response verifying device is output as the output of the group-signature verifying device.

9. A group signing system, comprising the group-signature verifying device according to claim 6, characterized in that said member-certificate acquiring device communicates with said member-certificate issuing device to acquire a member certificate and a member secret key;

inputs the acquired said member certificate, the acquired said member secret key, a message, a group public key, and a tracking public key into said group signing device to acquire a group signature for said message; and

inputs said message and the acquired group signature into said group-signature verifying device to verify that the acquired group signature is a valid group signature for said message and to input said group signature into said tracking device thereby outputting a member evidence representing the member which has generated the group signature.