Digital signature method and information communication system and apparatus using such method

[0002] 1. Field of the Invention

[0003] The present invention relates to a digital signature method using a public key cryptogram, and an information communication system and apparatus using such a method.

[0004] 2. Related Background Art

[0005] With developments and wide spreads of computers and communication networks, various functions such as social activities heretofore impossible on communication networks can be realized.

[0006] In some cases, however, it is easy for a third party to know a person, time, place, and contents during communications.

[0007] In order to prevent this, methods have been proposed which perform anonymous communications to protect privacy and realize various functions on communication networks.

[0008] For example, there is a method using a public key cryptogram. With this method, a sender can transmit communication contents only to a receiver the sender wishes to communicate, and the receiver can reliably confirm who is the sender of the received communication contents.

[0009] This method is applied to the digital signature method and an information communication system using this method disclosed in Japanese Patent Application Laid-open No. 9-108225.

[0010] “Cryptograph” and “Anonymous public key certificate” will be specifically described.

[0011] “Cryptograph” pertains information conversion in order for a third party not to recognize the meaning of information. In this cryptograph, an original text (still not converted) is called a “plain text”, converting a plain text into a text (enciphered text) the third party cannot know the meaning thereof is called “encipher”, and the conversion procedure is called a “cryptogram algorithm”.

[0012] The plain text and enciphered text are not limited only to text data, but they may be any type of data such as voices and images.

[0013] Enciphering is a conversion dependent upon parameters called “enciphering keys”. To restore the original plain text from the enciphered text is called “decipher”. In deciphering an enciphered text, a parameter called a “deciphering key” corresponding to the enciphering key is used. To restore the original plain text from the enciphered text by a third party or to find a deciphering key is called “interpret”.

[0014] Security of ciphers in such cryptograph depends on enciphering keys used for enciphering or deciphering keys used for deciphering. If it is impossible to know such a key, the plain text cannot be restored even if the cryptogram algorithm is known.

[0015] Therefore, cryptograph impossible to interpret even by a manufacture of an apparatus (cryptographic apparatus) for executing a predetermined cryptograph can be realized.

[0016] There are many cryptogram algorithms for a cryptosystem. For example, from the viewpoint of whether the enciphering key can be made public or not, the cryptography will be described by classifying it into an asymmetric cryptogram (public key cryptogram) and a symmetric cryptogram (common key cryptogram).

[0017] (1-1) “Asymmetric cryptogram (public key cryptogram)”

[0018] The “asymmetric cryptogram” is also called a “public key cryptogram”. An enciphering key is different from a deciphering key, and the deciphering key is not easy to calculate from the enciphering key. The enciphering key is made public, and the deciphering key is kept in secret.

[0019] Such an asymmetric cryptogram has the following features:

[0020] Feature 1: Since the enciphering key is different from the deciphering key and the enciphering key is made public, it is not necessary to send the enciphering key in secret.

[0021] Feature 2: Since the enciphering key of each user is made public, each user is required only to have its deciphering key in secret.

[0022] Feature 3: A certification (digital signature) function can be realized in order for a receiver to confirm that the sender of a communication text is not a pretender and that the communication text was not altered.

[0023] As the asymmetric cryptogram capable of realizing a cryptograph function and the certification function, an RST cryptosystem and an ElGamal cryptosystem are known.

[0024] As the asymmetric cryptogram capable of realizing the certification function, a Fiat-Shamir cryptosystem and a Schnorr cryptosystem are known.

[0025] Enciphering, deciphering, generation of a certificate (digital signature), and verification of the certificate regarding, for example, to the ElGamal cryptosystem will be described specifically.

[0026] It is assumed that “Z” is a set of all integers, “Z_p” is a set of integers of 0 or larger and smaller than p, “Z_p\{0}” is a set Z_pwithout 0, and “Z_p*” is a set of integers prime to an element of Z_pand p.

[0027] If integers A, B, and C satisfy the following relation

[0028] A=B mod C,

[0029] then it means that the remainder of B divided by C is A (that a relation of “B=k·C+A” is satisfied where k is an arbitrary integer).

[0030] If the integers A, B, and C satisfy the following relation

[0031] A≡B (mod C),

[0032] then it means that the remainder of A divided by C is equal to the remainder of B divided by C.

[0033] Used as the public parameters shared by each communication partner are a prime p, α which is an element of Z_p* and an order p−1, and a one way hash function H₀:Z→Z_p\{0}. A deciphering key (secret key) of an arbitrary user i is represented by “s_iε Z_p−1” and an enciphering key (public key) is represented by “v_i=α^simod p”.

[0034] The “one way hash function” is a compression function hard to generate collision. Namely, the “one way hash function” is a function of outputting a bit train having a desired length and is difficult to calculate an input which obtains the same output.

[0035] (a) Enciphering

[0036] When a user j enciphers a plain text (message) m (ε Z_p) and transmits it to a user i, a user j terminal device executes the sequence from the following Step 1 to Step 4.

[0037] If the message m is not made of elements of Z_p, i.e., if the message is made of elements larger than p, the message m is divided into blocks each being made of elements of Z_p. Each block is enciphered by the following sequence.

[0038] Step 1: The user j terminal device generates a random number k.

[0039] Step 2: The user j terminal device calculates C₁=α^kmod p.

[0040] Step 3: The user j terminal device calculates C₂=m·v_i^kmod p.

[0041] Step 4: The user j terminal device transmits the calculation results C₁and C₂at Steps 2 and 3 to the user i terminal device.

[0042] (b) Deciphering

[0043] With the above enciphering (a), the user j terminal device transmits C₁and C₂to the user i terminal device. By using C₁and C₂transmitted from the user j terminal device, the user j terminal device recovers the message m by calculating m=C₂/C₁^simod p.

[0044] (c) Generation of Digital Signature

[0045] In generating a digital signature of the message m (ε Z), the user i terminal device executes the sequence from the following Step 1 to Step 4.

[0046] Although the message m is divided into blocks in some case as described in the enciphering (a), in the following example, the one way hash function is used.

[0047] Step 1: The user i terminal device generates a random number k (ε Z_p−1*).

[0048] Step 2: The user i terminal device calculates

[0049] r=α^kmod p.

[0050] Step 3: The user i terminal device calculates

[0051] s=(H₀(m)−s_i·r)·k⁻¹mod (p−1).

[0052] Step 4: The user i terminal device transmits the calculation results r and s at Steps 2 and 3 to a verifier.

[0053] (d) Verification of Digital Signature

[0054] In verifying the digital signature generated by the generation of digital signature (c), the user i terminal device checks whether the following relation is satisfied:

[0055] α^H0(m)≡v_i^r·r^s(mod p).

[0056] (1-2) “Symmetric cryptogram (common key cryptogram)”

[0057] The “symmetric cryptogram” is also called a “common key cryptogram”. An enciphering key is the same as a deciphering key. After the advent of the above-described asymmetric cryptogram (public key cryptogram) during the last half of 1970's, the symmetric cryptogram was also called a “conventional cryptogram”.

[0058] Such a symmetric cryptogram is classified into a block cryptogram in which each character string (block) having an appropriate length is enciphered by using the same enciphering key and a stream cryptogram in which each character string or each bit is enciphered by a different enciphering key.

[0059] The block cryptogram includes a transposition cryptogram in which the order of characters is transposed for enciphering, a character change cryptogram in which a character is changed to a different character, and the like. The block cryptogram is widely used and there are commercially available cryptosystems such as DES (Data Encryption Standard) and FEAL (Fast data Encipherment Algorithm).

[0060] In the stream cryptogram, the contents of a message are disturbed through XOR (exclusive sum) of the message and random numbers. As the stream cryptogram, a Vernam cryptosystem is known in which a random number train of an infinite period is used once as an enciphering key and thereafter it is discarded.

[0061] The “anonymous public key certificate” certifies a correspondence between an arbitrary user and its public key (enciphering key) of the above-described asymmetric cryptogram (public key cryptogram) (1-1) or the like.

[0062] Specifically, a trusted and specific user called “Certificate Authority” (hereinafter called CA) confirms an identity of another user (hereinafter a user j) from a passport, for example, and generates a digital signature of a message whose contents are identification information ID (personal identification information such as name, gender, year, month, and date of birth) of the user j, a public key, an effective period, and the like. This digital signature is the “anonymous public key certificate”.

[0063] The public key of CA can be accessed reliably by any one so that it is easy to verify the digital signature generated by CA. It is therefore possible to easily and reliably confirm the public key of a user j communicating with a user k and to prevent another user from becoming the illegal user j during communications in the public key cryptogram.

[0064] The user of the “anonymous public key certificate” cannot be identified from another user. Therefore, this anonymous public key certificate can be used when privacy should be protected, for example, when a user having a privilege of receiving special services does not want to publicize its identity.

[0065] For example, a communication system disclosed in Japanese Patent Laid-open Publication No. HEI-8-108225 adopts such an anonymous public key certificate.

[0066] This communication system executes the sequence from Steps S500 to S504 shown in FIG. 1.

[0067] Steps S500 to S504 will be described specifically.

[0068] Each symbol (“Z”, “Z_p”, . . . ) in the following description is assumed to be defined in the similar manner to those symbols described earlier with the ElGamal cryptosystem.

[0069] Step S500: Commonly used as public parameters PV (Public Values) of a system are a prime p, an order q (where, q|p−1), α which is an element of Z_p* and an order q, and a one way hash function H₁:Z_q×Z→{0, . . . ,2^t−1}.

[0070] The order q can divide p−1 without any remainder. α^x≡1 (mod p) is not satisfied if x ε Z_q\{0} and α^x≡−1 (mod p) is satisfied if x=q. H₁is input with elements of Z_qand Z and outputs integers of 2^t−1 or smaller which are not negative.

[0071] It is assumed that these parameters can be accessed by all users participating in this communication system and are registered in a public database PD properly managed so as not to be illegally altered or the like.

[0072] A certificate publisher (authority) Q terminal device 70 generates a deciphering key (secret key) s_Qand an enciphering key (public key) v_Q(v_Q=α^−sQmod p) and registers the public key v_Qin the public database PD.

[0073] A user j terminal device 80 generates a deciphering key (secret key) s_jand an enciphering key (public key) v_j(v_j=α^−sjmod p) and registers the public key v_jin the public database PD.

[0074] Step S501: Generation of Anonymous Public Key Certificate

[0075] Next, the certificate publisher (authority) Q terminal device 70 obtains z which is converted from the public key v_jof the user j by using a random number r, and generates a signature (digital signature of the Schnorr cryptosystem) of z.

[0076] More specifically, the certificate publisher (authority) Q terminal device 70 selects the random number (secret random number) r (r ε Z_q\{0}) and calculates:

[0077] x=α^rmod p

[0078] z=v_j^rmod p

[0079] e=H₁(x, z_j)

[0080] y=r+e·s_Qmod q.

[0081] The digital signature (y, e, z) of the Schnorr cryptosystem is the anonymous public key certificate.

[0082] Step S502: Delivery of Anonymous Public Key Certificate

[0083] Next, the certificate publisher (authority) Q terminal device 70 transmits the anonymous public key certificate (y, e, z) generated at Step S501 to the user j terminal device 80.

[0084] Upon reception of the certificate, the user j terminal device 80 confirms whether the following equations are satisfied:

[0085] e=H₁(α^y·v_Q^emod p, z)

[0086] z=(α^y·v_Q^emod p)^−sjmod p.

[0087] In this example, since x=α^y·v_Q^emod p is satisfied, x is used for the simplicity of notation.

[0088] Step S503: Use of Public Key Cryptogram

[0089] Next, the user j terminal device 80 uses the public key cryptogram basing upon a discrete logarithm problem, by using x and z in place of α and v_j.

[0090] For example, if a digital signature of the Schnorr cryptosystem is used, a digital signature of a message m is generated in the following manner.

[0091] The user j terminal device 80 selects a secret random number r_j(r_jε Z_q*) and calculates:

[0092] x_j=x^rjmod p

[0093] e_j=h(x_j, m)

[0094] y_j=r_j+e_j·s_jmod q.

[0095] The user j terminal device 80 transmits the message m and the digital signature ((y, e, z), y_j, e_j, m) to a desired communication partner.

[0096] Step S504: Verification of Signature

[0097] A receiver (communication partner (verifier)) i terminal device 90 received the digital signature ((y, e, z), y_j, e_j, m) transmitted at Step S503 verifies the equations at Step S502, first

[0098] e_j=H₁(α^y·v_Q^emod p, z), and then

[0099] e_j=H₁(x^yj·z^ejmod p, m).

[0100] After this verification, the receiver i terminal device 90 can recognize that the digital signature of the message m was generated by the user identified by the certificate publisher Q.

[0101] The “group signatures” are digital signatures proposed by D. Chaum. E. van Heyst, “Group Signatures, ‘Advances in Cryptology-EUROCRYPT’ 91, PP. 257-265, Springer-Verlag, 1991”, and have the following features.

[0102] Feature 1: Only the member of the group can make signature.

[0103] Feature 2: Although a member received a signature can confirm whether or not it is a right signature, the member who made signature cannot be identified.

[0104] Feature 3: The signature may be disclosed thereafter, when necessary, with or without a help of a group member in order to identify the signed member.

[0105] The application field of the group signatures is, for example, a tender system. In this tender system, tenderers participating a desired tender constitute members of the tender system. Each tenderer makes a group signature for its price and conditions. In this manner, if no tenderer is accepted, it cannot know the price and conditions put by each tenderer, whereas if some tenderer is accepted, the accepted tenderer or signed member can be made public.

[0106] The group signatures are disclosed, for example, in Japanese Patent Laid-open Publication HEI-8-108226. The group signatures disclosed in this Publication use an anonymous public key certificate.

[0107] The “anonymous public key certificate” certifies a correspondence between an arbitrary user and its public key (enciphering key) of the above-described asymmetric cryptogram (public key cryptogram) or the like, and functions like a certificate of a seal impression.

[0108] More specifically, the “anonymous public key certificate” is a digital signature of a message constituted of a public key, identification information of a user having the public key, and the like, and is generated by a trusted and specific user. The “anonymous public key certificate” hides the identity of a user (entity) having the public key. Such an “anonymous public key certificate” is disclosed, for example, in Japanese Patent Application Laid-Open No. 8-108225.

[0109] In the case of the group signatures disclosed in the above-cited Japanese Patent Application Laid-open No. 8-108226, an arbitrary and trusted authority (hereinafter called ZA) issues an anonymous public key certificate to each member of the group. Upon reception of this certificate, the member generates a digital signature by using the certificate and a secret key of the member. A combination of the anonymous public key certificate and the generated digital signature constitutes a group signature.

[0110] The member received the group signature can know that another member admitted by ZA, i.e., a member in the group made signature. However, the signed member cannot be identified because of anonymity of the anonymous public certificate. When it becomes necessary to identify the signed member, the singed member can be made public.

[0111] The conventional anonymous public key certificate used in the above-described communication system satisfies anonymity only under the following conditions. Namely, the identity of a member having an anonymous public key certificate cannot be known. Such anonymity is based upon the following two assumptions.

[0112] Assumption 1: Discrete Logarithm Problem It is assumed that “G” is a finite group, “α” is a generator of the finite group, “v” is an element of G, and a “log [α] v” is a discrete logarithm of v relative to a base A. In this case, if the order (number of elements) of G is sufficiently large, it is difficult to calculate the discrete logarithm log [α] v.

[0113] Assumption 2: Comparison Problem of Discrete Logarithms

[0114] It is assumed that “r” and “s” are random elements of G.

[0115] If α, v=α^s, x=α^r, and z=α^rsare given, the order of G is sufficiently large, and r and s are unknown, then it is impossible to judge whether or not log [α] v is equal to log [x] z.

[0116] Anonymity of the anonymous public key certificate can be satisfied if the above assumptions 1 and 2 are satisfied.

[0117] However, an algorithm for solving the assumption 2 only has been found, and anonymity of the anonymous public key certificate is lost in some case because the assumption 2 is not satisfied although the assumption 1 is satisfied.

[0118] More specifically, it is believed from studies made to date that solving the discrete logarithm problem of the assumption 1 is very difficult. It is therefore proper to consider that security can be maintained. If the discrete logarithm problem can be solved, the comparison problem of the discrete logarithms of the assumption 2 can be solved. It can be understood therefore that solving the assumption 2 is as easy as, or easier than, solving the assumption 1.

[0119] It is not certain at the present as to how easier to solve the assumption 2 than to solve the assumption 1. However, with an algorithm for solving the assumption 2 only, there may be a case that the assumption 2 is not satisfied although the assumption 1 is satisfied. In such a case, anonymity of the anonymous public key certificate is lost.

[0120] It is an object of the present invention to eliminate the above-described disadvantages and provide a digital signature method capable of reliably ensuring anonymity under any circumstance, and an information system and apparatus using such a method.

[0121] According to one embodiment of the invention, there are at least means for generating a digital signature such as a signature in the ElGamal cryptosystem, means for converting the generated digital signature by using secret information of each user, and means for using a public key cryptogram whose basis of security relies upon a discrete logarithm problem.

[0122] With this configuration, the digital signature generating means generates a digital signature of digital information such as an arbitrary plain text and predetermined fixed values, by using public information of each user in place of a commonly used public parameter. The digital signature converting means generates another value by converting the digital signature by using the secret information of each user. The public key cryptogram using means uses the public key cryptogram whose basis of security relies upon the discrete logarithm problem, by using as the public information the digital information, digital signature, public parameter, and a value obtained from a public key of the user made signature and by using as the user secret information the other value obtained through conversion of the digital signature. Each user uses the public key cryptogram by using the public key cryptogram using means.

[0123] It is therefore possible from a standpoint of information amount to identify the user in accordance with the information (public information) used by the user as the public key. Therefore, anonymity does not depend upon the assumption 2 (comparison problem of discrete logarithms). Namely, even if there occurs the case wherein the assumption 2 is not satisfied, anonymity can be retained.

[0124] More specifically, according to an embodiment, a digital signature method including a public information generating step of generating public information specific to each user in accordance with a public parameter common to each user and secret information specific to each user, a signature generating step of generating a signature of digital information by converting the digital information by using the secret information and the public parameter, and a signature discrimination step of verifying whether a relation between the digital information and the signature is correct, by using the public parameter and the public information, comprises: a user information generating step of generating new secret information specific to the user, a new parameter, and new public information by using the public information; a confirmation step of confirming whether or not the new secret information, new parameter, and new public information generated by the user information generating step satisfy a predetermined relation; and an enciphering step of enciphering digital information by using the new parameter and the new public information confirmed by the confirmation step.

[0125] According to another embodiment, a digital signature method including a public information generating step of generating public information specific to each user in accordance with a public parameter common to each user and secret information specific to each user, a first signature generating step of generating a signature of digital information by converting the digital information by using the secret information and the public parameter, and a first signature discrimination step of verifying whether a relation between the digital information and the signature is correct, by using the public parameter and the public information, comprises: a user information generating step of generating new secret information specific to the user, a new parameter, and new public information by using the public information; a confirmation step of confirming whether or not the new secret information, the new parameter, and the new public information generated by the user information generating step satisfy a predetermined relation; and a second signature generating step of generating a signature of digital information by using the new parameter and the new public information confirmed by the confirmation step.

[0126] According to another embodiment, a digital signature method including a public information generating step of generating public information of each user, the public information being a result of an exponent calculation using a base value common to a plurality of users and secret information of each user as an exponent value, comprises: a secret information generating step of generating new secret information of a user in accordance with a signature of a plain text generated by using the public information of the user as the common base value and the secret information of the user; a parameter generating step of generating a new parameter corresponding to the new secret information generated by the secret information generating step; a public information generating step of generating new public information of the user in accordance with the signature, the public information of the user, the common base value, and the plain text; and a cryptogram execution step of executing a public key cryptogram by using the new secret information generated at the secret information generating step, the new parameter generated at the parameter generating step, and the new public information generated by the public information generating step.

[0127] According to another embodiment, a communication apparatus for executing a digital signature method, comprises: public information generating means for generating public information specific to each user in accordance with a public parameter common to each user and secret information specific to each user; signature discriminating means for verifying whether a relation between received digital information and a signature of the received digital information is correct, by using the public parameter and the public information; user information generating means for generating new secret information specific to the user, a new parameter, and new public information by using the public information; confirming means for confirming whether or not the new secret information, the new parameter, and the new public information generated by the user information generating means satisfy a predetermined relation; and enciphering means for enciphering digital information by using the new parameter and the new public information confirmed by the confirming means.

[0128] According to another embodiment, a communication apparatus for executing a digital signature method, comprises: public information generating means for generating public information of each user, the public information being a result of an exponent calculation using a base value common to a plurality of users and secret information of each user as an exponent value; secret information generating means for generating new secret information of a user in accordance with a signature of digital information generated by using the public information of the user as the common base value and the secret information of the user; parameter generating means for generating a new parameter corresponding to the new secret information generated by the secret information generating means; public information generating means for generating new public information in accordance with the signature, the public information, the common base value, and the digital information; and cryptogram executing means for executing a public key cryptogram by using the new secret information generated by the secret information generating means, the new parameter generated by the parameter generating means, and the new public information generated by the public information generating means.

[0129] According to one embodiment of the invention, there are at least means for generating a digital signature such as a signature in the ElGamal cryptosystem, means for transmitting in secret the generated digital signature to each user, means for converting the generated digital signature by using secret information of each user, means for using a public key cryptosystem whose basis of security relies upon a discrete logarithm problem, and means for storing a random number corresponding to the digital signature such as a signature in the ElGamal cryptogram.

[0130] With this configuration, the digital signature generating means generates a digital signature of digital information such as an arbitrary plain text and predetermined fixed values, by using public information of each user in place of a commonly used public parameter. The means for transmitting in secret the digital signature to each user, transmits in secret the generated digital signature to each user. The means for converting the digital signature by using the secret information of each user, obtains another value by converting the digital signature transmitted in secret by the transmitting means by using the secret information of the user. The means for using the public key cryptosystem whose basis of security relies upon the discrete logarithm problem, generates a digital information by using as the public information the digital information, digital signature, and a value obtained from public information of the user made signature and by using as the user secret information a value converted from the digital signature. When an arbitrary digital signature is given, a user made the digital signature is identified and made public by searching information, i.e., a random number corresponding to the digital signature, stored in the means for storing each random number corresponding to the digital signature.

[0131] Since it is impossible from a standpoint of information amount to identify the user in accordance with the information (public information) used by the user as the public key, anonymity depends upon the assumption 2 (comparison problem of discrete logarithms). Namely, even if there occurs the case wherein the assumption 2 is not satisfied, anonymity can be retained.

[0132] When a new group is formed or a new member is added to the existing group, the authority generates a digital signature such as a signature in the ElGamal cryptosystem in accordance with the public information of a member, and transmits in secret the digital signature to the member. Since the member can generate a group signature by using its secret information and the received digital signature, only one-way communication is performed from the authority to the member. Namely, it is not necessary to perform conventional two-way communication between the member and authority.

[0133] More specifically, according to an embodiment, a digital signature method comprises: a public information generating step of generating public information specific to each user in accordance with a public parameter common to each user and secret information specific to each user; a member information generating step of generating member information by an authority of a group in accordance with the public information specific to each user belonging to the group, the member information including new secret information, a new parameter, and new public information; a secrecy communication step of transmitting in secret the member information generated at the member information generating step to a user belonging to the group; a member information confirmation step of confirming whether or not the member information generated at the member information generating step satisfies a predetermined relation; a signature generating step of generating a signature corresponding to digital information by using the member information confirmed by the member information confirmation step; a signature confirmation step of confirming whether or not the member information confirmed at the member information confirmation step and the signature generated at the signature generating step are valid, by using the public information generated by the authority; and a signed user identifying step of identifying a user made the signature in accordance with a random number used when the signature is generated at the signature generating step.

[0134] According to another embodiment, a communication apparatus for communications between authority communication means of an arbitrary group and communication means of another user by using a digital signature method, comprises: public information generating means for generating specific public information in accordance with a common public parameter and specific secret information; member information confirming means for confirming whether or not member information satisfies a predetermined relation, the member information being generated by the authority communication means in accordance with the public information, transmitted therefrom in secret, and including new secret information, a new parameter, and new public information; signature generating means for generating a signature corresponding to digital information by using the member information confirmed by the member information confirming means; transmitting means for transmitting the signature generated by the signature generating means to another user; and signature verifying means for verifying a signature of the other user by using the public information of the authority.

[0135] According to another embodiment, a communication apparatus for an authority of an arbitrary group for communicating with user communication means of a user at least belonging to the group by using a digital signature method, comprises: public information generating means for generating specific public information in accordance with a common public parameter and specific secret information; member information generating means for generating new secret information, a new parameter, and new public information in accordance with the public information specific to a user belonging to the group; secrecy communication means for transmitting in secret the member information generated by the member information generating means to the user communication means of a user belonging to the group; and singed user identifying means for identifying a user made a signature corresponding to digital information in accordance with a random number used for the signature generated by using the member information, if the user communication means of the user belonging to the group confirms that the member information generated by the member information generating means satisfies a predetermined relation.

[0136] FIG. 1 is a diagram illustrating a conventional digital signature method.

[0137] FIG. 2 is a block diagram showing a communication system utilizing an information communication system according to a first embodiment of the invention.

[0138] FIG. 3 is a diagram illustrating a digital signature method to be executed by the information system shown in FIG. 2.

[0139] FIG. 4 is a diagram illustrating a digital signature method to be executed by the information system shown in FIG. 2, according to a second embodiment of the invention.

[0140] FIG. 5 is a diagram illustrating a digital signature method to be executed by the information system shown in FIG. 2, according to a third embodiment of the invention.

[0141] FIG. 6 is a block diagram showing a communication system utilizing an information communication system according to a fourth embodiment of the invention.

[0142] FIG. 7 is a block diagram showing the detailed configuration of the communication system shown in FIG. 6.

[0143] FIG. 8 is a diagram illustrating a group signature of the communication system shown in FIG. 6.

[0144] FIG. 9 is a diagram illustrating a group signature of the communication system shown in FIG. 6, according to a fifth embodiment of the invention.

[0145] Embodiments of the invention will be described with reference to the accompanying drawings.

[0146] The first embodiment will be described.

[0147] The digital signature method of this invention is executed by a communication system 100 such as shown in FIG. 2. The communication system 100 utilizes an information communication system of the invention.

[0148] In the communication system 100, a certificate publisher Q terminal device 20 and a plurality of user terminal devices 30, 40, 50, . . . of users j, i, k, . . . are connected to a network 10. Each terminal device communicates with another terminal device via the network 10. The communication system 100 is provided with a public database PD which manages public parameters PV (Public Values) shared by users.

[0149] The certificate publisher Q terminal device 20 has a public key generating unit 21 and a signature generating unit 22, the former generating a secret key s_Q(secret information) specific to the certificate publisher Q and a public key v_Q(public information) and the latter generating a signature (anonymous public key certificate) of a plain text by using the secret key s_Qand a public parameter PV.

[0150] The user terminal devices 30, 40, 50, . . . each have the same structure.

[0151] For example, the user j terminal device 30 has a public key generating unit 31 for generating a secret key s_jspecific to the user and a public key v_j, a discrimination unit 32 for judging whether a correspondence between the plain text m and the signature is correct, and a signature generating unit 33 for generating a new signature.

[0152] The user j terminal device 30 also has a verification unit 35 for verifying the new signature, an encipher unit 36 for enciphering the plain text by using the new signature verified by the verification unit 35, and a decoding (decipher) unit 34 for deciphering the enciphered text by using the new signature verified by the verification unit 35.

[0153] The operation of the communication system 100 constructed as above will be described with reference to FIGS. 2 and 3.

[0154] Symbols shown in FIG. 3 conform with the notation rules similar to FIG. 1.

[0155] Step S200: Used as common data of the communication system 100 are a large prime p, α which is an element of Z_p* and an order p−1, and a one way hash function H₀:Z→Z_p\{0}.

[0156] It is assumed herein that p is “p>2⁵¹²”.

[0157] These parameters can be accessed by all users participating in the communication system 100 and are registered in the public database PD properly managed so as not to be illegally altered or the like.

[0158] In the certificate publisher (authority) Q terminal device 20, the public key generating unit 21 generates a secret key s_Q(ε Z_p−1*) and a public key v_Q(v_Q=α^sQmod p) and registers the public key v_Qin the public database PD.

[0159] In a user terminal device (in this example, the user j terminal device 30), the public key generating unit 31 generates a deciphering key (secret key) s_j(ε Z_p−1*) and an enciphering key (public key) v_j(v_j=α^sjmod p) and registers the public key v_jin the public database PD.

[0160] Step S201: Generation of Anonymous Public Key Certificate

[0161] In the certificate publisher Q terminal device 20, the signature generating unit 22 obtains r which is converted from the public key v_jof the user j by using a random number k, and generates a signature (e.g., a digital signature of the ElGamal cryptosystem) of the plain text m.

[0162] More specifically, the signature generating unit 22 selects the random number (secret random number) k (k ε Z_p−1*) and calculates:

[0163] r=V_j^kmod p

[0164] s=(H₀(m)−s_Q·r)·k⁻¹mod (p−1).

[0165] The digital signature (r, s) of the ElGamal cryptosystem of the plain text m is the anonymous public key certificate. The plain text m may be used as a parameter representative of the type of the anonymous public key certificate.

[0166] As the parameter representative of the type of the anonymous public key certificate, a predetermined fixed value may be used instead of the plain text m or H₀(m).

[0167] Step S202: Delivery of Anonymous Public Key Certificate

[0168] Next, the certificate publisher Q terminal device 20 transmits as the anonymous public key certificate (m, r, s) the digital signature r and s generated by the signature generating unit 22 and the parameter m representative of the type of the anonymous public key certificate to the user j terminal device 30.

[0169] Step S203: Upon reception of the certificate, in the user j terminal device 80, the discrimination unit 32 obtains

[0170] s_j′=s·s_j⁻¹mod (p−1),

[0171] and confirms whether the following is satisfied:

[0172] α^H0(m)≡v_Q^r·r^sj′ (mod p)

[0173] Step S204: Use of Public Key Cryptogram

[0174] The user j terminal device 30 uses the public key cryptogram basing upon the discrete logarithm problem, in accordance with

[0175] α^H0(m)·v_Q^−r≡r^sj′ (mod p)

[0176] where “r” is a base, “α^H0(m)·v_Q^−rmod p” is a public key, and “s_j′” is a secret key.

[0177] It is assumed herein that a digital signature of the ElGamal cryptosystem is used.

[0178] Step S204 (1): Generation of Digital Signature

[0179] In the user j terminal device 30, the signature generating unit 33 generates a signature of a plain text m′ as in the following.

[0180] (1) The signature generating unit 33 generates a random number k′ (ε Z_p−1*).

[0181] (2) The signature generating unit 33 calculates:

[0182] r′=α^k′ mod p.

[0183] (3) The signature generating unit 33 calculates:

[0184] s′=(H₀(m′)−s_j′·r)·(k′)⁻¹mod (p−1).

[0185] (4) The user j terminal device 30 transmits m′ and the r′ and s′ obtained by the signature generating unit 33 together with the anonymous public key certificate (m, r) supplied from the certificate publisher Q terminal device 20, to the communication partner (in this example, user i terminal device 40).

[0186] Step S204 (2): Verification of Signature

[0187] When the user i terminal device 40 receives the anonymous public key certificate, the verification unit 45 confirms if the following equation is satisfied:

[0188] r^H0(m′)≡(α^H0(m)·v_Q^−r)^r′·(r′)^s′ (mod p).

[0189] If it is confirmed that the equation is satisfied, the user i terminal device 40 can recognize that the signature of m′ was generated by a user selected by the certificate publisher Q.

[0190] Step S204: for use of a public key cryptogram can be used for enciphering.

[0191] It is assumed herein that the user k terminal device 50 enciphers in the ElGamal cryptosystem.

[0192] Enciphering:

[0193] In the user k terminal device 50, the encipher unit 56 enciphers the plain text m″ as in the following.

[0194] (1) The encipher unit 56 generates a random number k″.

[0195] (2) The encipher unit 56 calculates:

[0196] C₁=r^k″ mod p.

[0197] (3) The encipher unit 56 calculates:

[0198] C₂=m″·(α^H0(m)·v_Q^−rmod p)^k″ mod p.

[0199] (4) The user k terminal device 50 transmits C₁and C₂calculated by the encipher unit 56 to the user j terminal device 30.

[0200] Deciphering:

[0201] When the user j terminal device 30 receives C₁and C₂, the decoding unit 34 calculates:

[0202] m″=C₂/C₁^sj′ mod p

[0203] to thereby recover the plain text m″.

[0204] In the above embodiment, Step S204 for use of the public key cryptogram uses the ElGamal cryptosystem. The embodiment is not limited only to the ElGamal cryptosystem, but public key cryptograms basing upon the discrete logarithm problem may also be used.

[0205] Next, the second embodiment will be described.

[0206] In the second embodiment, a modification of the digital signature method of the ElGamal cryptosystem is applied to the communication system of the first embodiment.

[0207] Therefore, the modulo arithmetic is performed by using p−1 in the ElGamal cryptosystem in the first embodiment, whereas the modulo arithmetic is performed by using a prime q (q divides p−1 without any remainder) in the second embodiment.

[0208] The structure of the communication system 100 used in the second embodiment is the same as the first embodiment, and so the detailed description thereof is omitted.

[0209] Only different points from the first embodiment will be specifically described with reference to FIG. 4.

[0210] Step S300:

[0211] Used as common data of the communication system 100 are large primes p and q (q divides p−1 without any remainder), α which is an element of Z_p* and an order q, and one way hash functions H₀:Z→Z_q\{0} and H₁:Z_q×Z→{0, . . . , 2^t−1}.

[0212] It is assumed herein that “p>2⁵¹²”, “q>2¹⁶⁰”, and “t>72”.

[0213] These parameters (public parameters PV) can be accessed by all users participating in the communication system 100 and are registered in the public database PD properly managed so as not to be illegally altered or the like.

[0214] In the certificate publisher Q terminal device 20, the public key generating unit 21 generates a secret key s_Q(ε Z_q\{0}) and a public key v_Q(v_Q=α^sQmod p) and registers the public key v_Qin the public database PD.

[0215] In a user terminal device (in this example, the user j terminal device 30), the public key generating unit 31 generates a deciphering key (secret key) s_j(ε Z_q\{0}) and an enciphering key (public key) v_j(v_j=α^sjmod p) and registers the public key v_jin the public database PD.

[0216] Step S301: Generation of Anonymous Public Key Certificate

[0217] In the certificate publisher Q terminal device 20, the signature generating unit 22 obtains r which is converted from the public key v_jof the user j by using a random number k, and generates a signature (e.g., a digital signature of the ElGamal cryptosystem) of the plain text m.

[0218] More specifically, the signature generating unit 22 selects the random number (secret random number) k (k ε Z_q\{0}) and calculates:

[0219] r=v_j^kmod p

[0220] s=(H₀(m)−s_Q·r)·k⁻¹mod q.

[0221] The digital signature (r, s) of the ElGamal cryptosystem of the plain text m is the anonymous public key certificate. The plain text m may be used as a parameter representative of the type of the anonymous public key certificate.

[0222] As the parameter representative of the type of the anonymous public key certificate, a predetermined fixed value may be used instead of the plain text m or H₀(m).

[0223] Step S302: Delivery of Anonymous Public Key Certificate

[0224] Next, the certificate publisher Q terminal device 20 transmits as the anonymous public key certificate (m, r, s) the digital signature r and s generated by the signature generating unit 22 and the parameter m representative of the type of the anonymous public key certificate to the user j terminal device 30.

[0225] Step S303: Upon reception of the certificate, in the user j terminal device 80, the discrimination unit 32 obtains

[0226] s_j′=s·s_j⁻¹mod q,

[0227] and confirms whether the following is satisfied:

[0228] α^H0(m)≡v_Q^r·r^sj′ (mod p)

[0229] Step S304: Use of Public Key Cryptogram

[0230] The user j terminal device 30 uses the public key cryptogram basing upon the discrete logarithm problem, in accordance with

[0231] α^H0(m)·v_Q^−r≡r^sj′ (mod p)

[0232] where “r” is a base, “α^H0(m)·v_Q^−rmod p” is a public key, and “s_j′” is a secret key.

[0233] It is assumed herein that a digital signature of the Schnorr cryptosystem is used.

[0234] Step S304 (1): Generation of Digital Signature In the user j terminal device 30, the signature generating unit 33 generates a signature of a plain text m′ as in the following.

[0235] (1) The signature generating unit 33 generates a random number k′ (ε Z_q\{0}).

[0236] (2) The signature generating unit 33 calculates:

[0237] x=r^k′ mod p.

[0238] (3) The signature generating unit 33 calculates:

[0239] e=H₁(x, m′).

[0240] (4) The signature generating unit 33 calculates:

[0241] y=k′−e·s_j′ mod q

[0242] (5) The user j terminal device 30 transmits m′ and the e and y obtained by the signature generating unit 33 together with the anonymous public key certificate (m, r) supplied from the certificate publisher Q terminal device 20, to the communication partner (in this example, user i terminal device 40).

[0243] Step S304 (2): Verification of Signature When the user i terminal device 40 receives the anonymous public key certificate, the verification unit 45 confirms if the following equation is satisfied:

[0244] e=H₁(r^y·(α^H0(m′)·v_Q^−r)^emod p, m′).

[0245] If it is confirmed that the equation is satisfied, the user i terminal device 40 can recognize that the signature of m′ was generated by a user selected by the certificate publisher Q.

[0246] Step S304 for use of a public key cryptogram can be used for enciphering.

[0247] It is assumed herein that the user k terminal device 50 enciphers in the ElGamal cryptosystem.

[0248] Enciphering:

[0249] In the user k terminal device 50, the encipher unit 56 enciphers the plain text m″ as in the following.

[0250] (1) The encipher unit 56 generates a random number k″.

[0251] (2) The encipher unit 56 calculates:

[0252] C₁=r^k″ mod p.

[0253] (3) The encipher unit 56 calculates:

[0254] C₂=m″·(α^H0(m)·v_Q^−rmod p)^k″ mod p.

[0255] (4) The user k terminal device 50 transmits C₁and C₂calculated by the encipher unit 56 to the user j terminal device 30.

[0256] Deciphering:

[0257] When the user j terminal device 30 receives C₁and C₂, the decoding unit 34 calculates:

[0258] m″=C₂/C₁^sj′ mod p

[0259] to thereby recover the plain text m″.

[0260] In the above embodiment, Step S304 for use of the public key cryptogram uses the ElGamal cryptosystem and Schnorr cryptosystem. The embodiment is not limited only to the ElGamal and Schnorr cryptosystems, but public key cryptograms basing upon the discrete logarithm problem may also be used.

[0261] Next, the third embodiment will be described.

[0262] In the third embodiment, a modification of the digital signature method of the ElGamal cryptosystem is applied to the communication system of the first embodiment.

[0263] Therefore, similar to the first embodiment, H₀(m)=0 when the plain text m (H₀(m) calculated from the plain text m) is used for the anonymous public key certificate in the third embodiment.

[0264] The structure of the communication system 100 used in the third embodiment is the same as the first embodiment, and so the detailed description thereof is omitted.

[0265] Only different points from the first embodiment will be specifically described with reference to FIG. 5.

[0266] Step S400: Used as common data of the communication system 100 are a prime p, α which is an element of Z_p* and an order p−1, and a one way hash function H₀:Z→Z_p\{0}.

[0267] It is assumed herein that p=“p>2⁵¹²”.

[0268] These parameters (public parameters PV) can be accessed by all users participating in the communication system 100 and are registered in the public database PD properly managed so as not to be illegally altered or the like.

[0269] In the certificate publisher Q terminal device 20, the public key generating unit 21 generates a secret key s_Q(ε Z_p−1*) and a public key v_Q(v_Q=α^sQmod p) and registers the public key v_Qin the public database PD.

[0270] In a user terminal device (in this example, the user j terminal device 30), the public key generating unit 31 generates a deciphering key (secret key) s_j(ε Z_p−1*) and an enciphering key (public key) v_j(v_j=α^sjmod p) and registers the public key v_jin the public database PD.

[0271] Step S401: Generation of Anonymous Public Key Certificate

[0272] In the certificate publisher Q terminal device 20, the signature generating unit 22 obtains r which is converted from the public key v_jof the user j by using a random number k, and generates a modified digital signature of the ElGamal cryptosystem, e.g., a signature of the ElGamal cryptosystem in which an output “0” is obtained when the plain text m is input to the hash function.

[0273] More specifically, the signature generating unit 22 selects the random number (secret random number) k (k ε Z_p−1*) and calculates:

[0274] r=V_j^kmod p

[0275] s=S_Q·r·k⁻¹mod (p−1).

[0276] The digital signature (r, s) is the anonymous public key certificate.

[0277] Step S402: Delivery of Anonymous Public Key Certificate

[0278] Next, the certificate publisher Q terminal device 20 transmits as the anonymous public key certificate (r, s) the digital signature r and s generated by the signature generating unit 22 to the user j terminal device 30.

[0279] Step S403:

[0280] Upon reception of the certificate, in the user j terminal device 80, the discrimination unit 32 obtains

[0281] s_j′=s·s_j⁻¹mod (p−1),

[0282] and confirms whether the following is satisfied:

[0283] v_Q^r≡r^sj′ (mod p).

[0284] Step S404: Use of Public Key Cryptogram

[0285] The user j terminal device 30 uses the public key cryptogram basing upon the discrete logarithm problem, in accordance with

[0286] V_Q^r≡rsj′ (mod p)

[0287] where “r” is a base, “V_Q^rmod p” is a public key, and “s_j′” is a secret key.

[0288] It is assumed herein that a digital signature of the ElGamal cryptosystem is used.

[0289] Step S404 (1): Generation of Digital Signature

[0290] In the user j terminal device 30, the signature generating unit 33 generates a signature of a plain text m′ as in the following.

[0291] (1) The signature generating unit 33 generates a random number k′ (ε Z_p−1*).

[0292] (2) The signature generating unit 33 calculates:

[0293] r′=α^k′ mod p.

[0294] (3) The signature generating unit 33 calculates:

[0295] s′=(H(m′)−s_j′·r)·(k′)⁻¹mod (p−1).

[0296] (4) The user j terminal device 30 transmits m′ and the r″ and e′ obtained by the signature generating unit 33 together with the anonymous public key certificate (m, r) supplied from the certificate publisher Q terminal device 20, to the communication partner (in this example, user i terminal device 40).

[0297] Step S404 (2): Verification of Signature

[0298] When the user i terminal device 40 receives the anonymous public key certificate, the verification unit 45 confirms if the following equation is satisfied:

[0299] r^H0(m′)≡(v_Q^r)^r′·(r′)^s′ (mod p).

[0300] If it is confirmed that the equation is satisfied, the user i terminal device 40 can recognize that the signature of m′ was generated by a user selected by the certificate publisher Q.

[0301] Step S404 for use of a public key cryptogram can be used for enciphering.

[0302] It is assumed herein that the user k terminal device 50 enciphers in the ElGamal cryptosystem.

[0303] Enciphering:

[0304] In the user k terminal device 50, the encipher unit 56 enciphers the plain text m″ as in the following.

[0305] (1) The encipher unit 56 generates a random number k″.

[0306] (2) The encipher unit 56 calculates:

[0307] C₁=r^k″ mod p.

[0308] (3) The encipher unit 56 calculates:

[0309] C₂=m″·(v_Q^rmod p)^k″ mod p.

[0310] (4) The user k terminal device 50 transmits C₁and C₂calculated by the encipher unit 56 to the user j terminal device 30.

[0311] Deciphering:

[0312] When the user j terminal device 30 receives C₁and C₂, the decoding unit 34 calculates:

[0313] m″=C₂/C₁^sj′ mod p

[0314] to thereby recover the plain text m″.

[0315] In the above embodiment, Step S404 for use of the public key cryptogram uses the ElGamal cryptosystem. The embodiment is not limited only to the ElGamal cryptosystem, but public key cryptograms basing upon the discrete logarithm problem may also be used.

[0316] In the embodiments described above, p is a prime, the order of α is p−1, r≡v_j^k≡α^sjk(mod p), s_jε Z_p−1* and k ε Z_p−1*. Alternatively, p and q are primes, q divides p−1 without any remainder, the order of α is q, r≡v_j^k≡α^sjk(mod p), s_jε Z_q\{0}, and k ε Z_q\{0}.

[0317] Therefore, if an arbitrary r is given, the value of r can be calculated by using a public key of any user. It is quite impossible to identify the public key of a user used for the calculation of the value r, unless the value of actually used k is not known. In other words, the signature r of the anonymous public key certificate does not contain at all the information which can identify the user having the anonymous public key certificate. Anonymity can be ensured not from the standpoint of calculation amount like the assumption 2 but from the standpoint of information amount. Even if there occurs the case where the assumption 2 is not satisfied, anonymity can be reliably ensured. It is therefore possible to improve safety of privacy protection.

[0318] In any of the above embodiments, safety of privacy protection can be further improved by performing the following operations.

[0319] (1) The certificate publisher Q terminal device 20 transmits an anonymous public key certificate to an arbitrary user terminal device (e.g., user j terminal device 30), by using each time a different random number.

[0320] (2) Upon reception of the anonymous public key certificate, the user j terminal device 30 does not generate a digital signature but uses one anonymous public key certificate for each different plain text.

[0321] With such a way to use the anonymous public key certificate (one-time certificates, the certificate is used only once and thereafter it is discarded), judging whether or not the user generated an arbitrary digital signature is the same as the user generated a different digital signature, is very difficult or impossible from the standpoint of information amount for users other than the certificate publisher Q and the user generated the arbitrary digital signature. Since anonymity of a user can be retained from the standpoint of information amount, safety of privacy protection can be further improved.

[0322] As described above, according to the embodiments, the signature of the anonymous public key certificate does not contain at all the information identifying the user having the anonymous public key certificate. Accordingly, anonymity can be retained not from the standpoint of calculation amount like the assumption 2 but from the standpoint of information amount. Therefore, even if there occurs the case where the assumption 2 is not satisfied, anonymity can be reliably ensured. It is therefore possible to improve safety of privacy protection.

[0323] Next, the fourth embodiment of the invention will be described.

[0324] The digital signature method of this invention is executed by a communication system 100 such as shown in FIG. 6. The communication system 100 utilizes an information communication system of the invention.

[0325] In the communication system 100, a certificate publisher ZA terminal device 20 and a plurality of user terminal devices 30, 40, 50, . . . of users j, k, v, . . . are connected to a communication network (anonymous communication network) 10. Each user can anonymously communicates with another user via the communication network 10.

[0326] The communication system 100 is provided with a public database PD which can be accessed by the certificate publisher ZA and users j, k, v, . . . Public keys of users, common parameters, and the like are registered in the public database PB. The public database PD are properly managed so that the information registered therein is not illegally altered or the like.

[0327] The concept of the communication system 100 will be described. In the communication system 100, a public key “v_ZA” is used for an arbitrary group 60 which is constituted of members including users j and k.

[0328] The users j and k belonging to the same group 60 is supplied with an anonymous public key certificate (m, r, s) from the certificate publisher ZA. For example, the user j generates a signature portion (m′, r′, s′) specific to the user in accordance with the anonymous public key certificate (m, r, s), and transmits a group signature ((m, r), m′, r′, s′) to a user V via the anonymous communication network 10. The user V received the group signature verifies the group signature of a message m′ by using the public key v_ZA.

[0329] The structures of the certificate publisher ZA terminal device 20 and the user terminal devices 30, 40, 50, . . . of the users j, k, v, . . . are shown in FIG. 7.

[0330] Namely, the certificate publisher ZA terminal device 20 is an authority of the group 60 and has a public key generating unit 21 for generating a secret key s_ZA(secret information) and a public key v_ZA(public information), a signature generating unit 22 for generating an anonymous public key certificate (hereinafter called a signature of member information where applicable) of a plain text m in accordance with the public key specific to the user of the group 60, and a secrecy communication unit 23 for transmitting in secret a signature generated by the signature generating unit 22 to the user of the group 60.

[0331] The certificate publisher ZA terminal device 20 also has a memory unit 24 for storing each random number corresponding to each signature to be issued, and a signature discrimination unit 25 for identifying an arbitrary user in the group 60 generated a signature in accordance with the information stored in the memory unit 24 and a random number used for generating the signature by the user.

[0332] The user terminal devices 30, 40, 50, . . . each have the same structure.

[0333] For example, the user j terminal device 30 has a public key generating unit 31 for generating a secret key s_jspecific to the user j and a public key v_j, a verification unit 32 for confirming a signature from the certificate publisher ZA terminal device 20 satisfies a predetermined relation, and a signature generating unit 33 for generating a signature corresponding to digital information by using the signature verified by the verification unit 32.

[0334] The user j terminal device 30 also has a signature verification unit 35 for verifying a signature by using the public key of the certificate publisher ZA terminal device 20.

[0335] The group signature of the communication system will be described specifically with reference to FIGS. 7 and 8.

[0336] Step S200: Used as common data of the communication system 100 are a large prime p, a which is an element of Z_p* and an order p−1, and a one way hash function H₀:Z→Z_p\{0}.

[0337] It is assumed herein that p is “p>2^512”.

[0338] These parameters (public parameters PV (Public Values)) are registered in the public database PD.

[0339] In the certificate publisher ZA terminal device 20 which is a trusted authority of the group 60, the public key generating unit 21 generates a secret key (deciphering key) s_ZA(ε Z_p−1*) and a public key (enciphering key) v_ZA(v_ZA=α^SZAmod p) and registers the public key v_ZAin the public database PD.

[0340] In an arbitrary user terminal device of the group 60 (in this example, the user (member) j terminal device 30), the public key generating unit 31 generates a deciphering key (secret key) s_j(ε Z_p−1*) and an enciphering key (public key) v_j(v_j=α^sjmod p) and registers the public key v_jin the public database PD.

[0341] Step S201: Generation of Anonymous Public Key Certificate

[0342] In the certificate publisher ZA terminal device 20, the signature generating unit 22 obtains r which is converted from the public key v_jof the user j by using a random number k, and generates a signature (e.g., a digital signature of the ElGamal cryptosystem) of the plain text m.

[0343] More specifically, the signature generating unit 22 selects the random number (secret random number) k (k ε Z_p−1*) and calculates:

[0344] r=V_j^kmod p

[0345] s=(H₀(m)−s_ZA·r)·k⁻¹mod (p−1).

[0346] The digital signature (r, s) of the ElGamal cryptosystem of the plain text m is the anonymous public key certificate. The plain text m may be used as a parameter representative of the type of the anonymous public key certificate.

[0347] As the parameter representative of the type of the anonymous public key certificate, a predetermined fixed value may be used instead of the plain text m or H₀(m).

[0348] Step S202: Delivery of Anonymous Public Key Certificate

[0349] Next, in the certificate publisher ZA terminal device 20, the secrecy communication unit 20 transmits as the anonymous public key certificate (m, r, s) the digital signature r and s generated by the signature generating unit 22 and the parameter m representative of the type of the anonymous public key certificate to the user j terminal device 30.

[0350] Step S203: Upon reception of the certificate, in the user j terminal device 80, the verification unit 32 judges in the following manner whether the anonymous public key certificate (m, r, s) from the certificate publisher ZA terminal device 20 was issued to the user j. The verification unit 32 obtains

[0351] s_j′=s·s_j⁻¹mod (p−1),

[0352] and confirms whether the following is satisfied:

[0353] α^H0(m)≡v_ZA^r·r^sj′ (mod p)

[0354] Step S204: Generation of Group Signature

[0355] The user j terminal device 30 generates a digital signature by using the public key cryptogram basing upon the discrete logarithm problem, in accordance with

[0356] α^H0(m)≡v_ZA^−r≡r^sj′ (mod p)

[0357] where “r” is a base, “α^H0(m)≡v_ZA^−rmod p” is a public key, and “s_j′” is a secret key.

[0358] For example, in generating a digital signature of the ElGamal cryptosystem, the signature generating unit 33 of the user j terminal device 30 generates a digital signature of a plain text (message) m′ in the following manner.

[0359] (1) The signature generating unit 33 generates a random number k′ (ε Z_p−1*).

[0360] (2) The signature generating unit 33 calculates:

[0361] r′=α^k′ mod p.

[0362] (3) The signature generating unit 33 calculates:

[0363] s′=(H₀(m′)−s_j′·r)·(k′)⁻¹mod (p−1).

[0364] (4) The user j terminal device 30 transmits m′ and the r′ and s′ obtained by the signature generating unit 33 together with the anonymous public key certificate (m, r) supplied from the certificate publisher ZA terminal device 20, to the communication partner (in this example, user v terminal device 50).

[0365] Step S205: Verification of Signature

[0366] When the user v terminal device 50 receives the anonymous public key certificate, the signature verification unit 54 confirms if the following equation is satisfied:

[0367] r^H0(m′)≡(α^H0(m)·v_ZA^−r)^r′·(r′)^s′ (mod p).

[0368] If it is confirmed that the equation is satisfied, the user v terminal device 50 can recognize that the signature of m′ was generated by a user received the anonymous public key certificate from the certificate publisher ZA, i.e., the signature was generated by the member of the group 60.

[0369] Identifying the user generated an arbitrary group signature, i.e., disclosing the group signature, is performed in the following manner.

[0370] It is herein assumed that the group signature is ((m, r), m′, r′, s′), the signed user is the user j, and r=v_jmod p.

[0371] In this case, in issuing the anonymous public key certificate, the certificate publisher ZA terminal device 20 stores the user identification and a corresponding random number in the memory unit 24. When the group signature (m, r) to be disclosed is given to the certificate publisher ZA terminal device 20, the signature discrimination unit 20 thereof searches the stored contents in the memory unit 24 and confirms that r=v_jmod p. The certificate publisher ZA terminal device 20 can therefore know that the signed user is the user j.

[0372] The certificate publisher ZA terminal device 20 also verifies:

[0373] log[g](g^H0(m)vZA^−r)^s−1=log[v_j]r(=k)

[0374] by obtaining “s” of the anonymous public key certificate (m, r, s) and using a zero knowledge verifying protocol for verifying the discrete logarithms are equal.

[0375] An example of the zero knowledge verifying protocol for verifying the discrete logarithms are equal, will be given in the following.

[0376] A zero knowledge verifying protocol for verifying:

[0377] log[g]x=log[α]y(=s).

[0378] (1) The user v terminal device 50 selects random numbers a and b (a, b ε Z_q) and calculates

[0379] c=g^aα^b

[0380] to transmit c to a verifier P terminal device (certificate publisher ZA terminal device 20).

[0381] (2) The verifier P terminal device selects a random number t (t≡Z_q) and calculates

[0382] h₁=c·α^t

[0383] h₂=h₁^s

[0384] to transmit h₁and h₂to the user v terminal device 50.

[0385] (3) The user v terminal device 50 transmits the random numbers a and b to the verifier P terminal device.

[0386] (4) The verifier P terminal device confirms whether the following equation is satisfied:

[0387] c=g^aα^b

[0388] If satisfied, a random number t is transmitted to the user v terminal device 50.

[0389] (5) The user v terminal device 50 confirms whether the following equations are satisfied:

[0390] h₁=g^aα^b+t

[0391] h₂=x^ay^b+t.

[0392] The protocol for verifying that log [g] x=log [α] y (=s) is not limited to the above-described protocol including (1) to (5), other similar protocols may also be used.

[0393] Next, the fifth embodiment will be described.

[0394] In the fifth embodiment, a modification of the digital signature method of the ElGamal cryptosystem is applied to the communication system of the fourth embodiment.

[0395] Therefore, the modulo arithmetic is performed by using p−1 in the ElGamal cryptosystem in the forth embodiment, whereas the modulo arithmetic is performed by using a prime q in the fifth embodiment.

[0396] The structure of the communication system 100 used in the fifth embodiment is the same as the fourth embodiment, and so the detailed description thereof is omitted.

[0397] Only different points from the fourth embodiment will be specifically described with reference to FIG. 9.

[0398] Step S300: Used as common data of the communication system 100 are large primes p and q (p|p−1, namely q divides p−1 without any remainder), a which is an element of Z_p* and an order q, and one way hash functions H₁:Z→Z_q\{0} and H₂:Z_p×Z→{0, . . . , 2^t−1}.

[0399] It is assumed herein that “p>2⁵¹²”, “q>2¹⁶⁰”, and “t>72”.

[0400] These parameters (public parameters PV) are registered in the public database PD.

[0401] In the certificate publisher ZA terminal device 20, the public key generating unit 21 generates a secret key s_ZA(ε Z_q\{0}) and a public key v_ZA(v_ZA=α^sZAmod p) and registers the public key v_ZAin the public database PD.

[0402] In an arbitrary user terminal device (in this example, the user j terminal device 30), the public key generating unit 31 generates a deciphering key (secret key) s_j(ε Z_q\{0}) and an enciphering key (public key) v_j(v_j=α^sjmod p) and registers the public key v_jin the public database PD.

[0403] Step S301: Generation of Anonymous Public Key Certificate

[0404] In the certificate publisher ZA terminal device 20, the signature generating unit 22 obtains r which is converted from the public key v_jof the user j by using a random number k, and generates a signature (e.g., a digital signature of the ElGamal cryptosystem) of the plain text m.

[0405] More specifically, the signature generating unit 22 selects the random number (secret random number) k (k ε Z_q\{0}) and calculates:

[0406] r=V_j^kmod p

[0407] s=(H₁(m)−s_ZA·r)·k⁻¹mod q.

[0408] The digital signature (r, s) of the ElGamal cryptosystem of the plain text m is the anonymous public key certificate. The plain text m may be used as a parameter representative of the type of the anonymous public key certificate.

[0409] As the parameter representative of the type of the anonymous public key certificate, a predetermined fixed value may be used instead of the plain text m or H₀(m).

[0410] Step S302: Delivery of Anonymous Public Key Certificate

[0411] Next, in the certificate publisher ZA terminal device 20, the secrecy communication unit 23 transmits as the anonymous public key certificate (m, r, s) the digital signature r and s generated by the signature generating unit 22 and the parameter m representative of the type of the anonymous public key certificate to the user j terminal device 30.

[0412] Step S303:

[0413] Upon reception of the certificate, in the user j terminal device 80, the verification unit 32 obtains

[0414] s_j′=s·s_j⁻¹mod q,

[0415] and confirms whether the following is satisfied:

[0416] α^H1(m)≡v_ZA^r·r^sj′ (mod p)

[0417] Step S304: Generation of Group Signature

[0418] The user j terminal device 30 generates a digital signature basing upon the discrete logarithm problem, in accordance with

[0419] α^H1(m)·v_ZA^−r≡r^sj′ (mod p)

[0420] where “r” is a base, “α^H1(m)·v_ZA^−rmod p” is a public key, and “s_j′” is a secret key.

[0421] For example, in generating a digital signature of the Schnorr cryptosystem, the signature generating unit 33 of the user j terminal device 30 generates a digital signature of a plain text (message) m′ in the following manner.

[0422] (1) The signature generating unit 33 generates a random number k′ (ε Z_p−1*).

[0423] (2) The signature generating unit 33 calculates:

[0424] x=r^k′ mod p.

[0425] (3) The signature generating unit 33 calculates:

[0426] e=H₂(x, m′).

[0427] (4) The signature generating unit 33 calculates:

[0428] y=k′−e·s_j′ mod q.

[0429] (5) The user j terminal device 30 transmits m′ and the e and y obtained by the signature generating unit 33 together with the anonymous public key certificate (m, r) supplied from the certificate publisher ZA terminal device 20, to the communication partner (in this example, user v terminal device 50).

[0430] Step S305: Verification of Signature

[0431] When the user v terminal device 50 receives the anonymous public key certificate, the signature verification unit 54 confirms if the following equation is satisfied:

[0432] e=H₂(r^y·(α^H1(m)·v_ZA^−r)^emod p, m′)

[0433] If it is confirmed that the equation is satisfied, the user v terminal device 50 can recognize that the signature of m′ was generated by a user received the anonymous public key certificate from the certificate publisher ZA, i.e., the signature was generated by the member of the group 60.

[0434] “Disclosure of group signature” in the fifth embodiment is similar to that in the fourth embodiments, and so the detailed description thereof is omitted.

[0435] As described so far, according to the fourth and fifth embodiments, anonymity of a group signature can be retained from the standpoint of information amount. Therefore, even if there occurs the case wherein the comparison problem of discrete algorithms is solved, anonymity of the group signature can be retained. It is possible to reliably improve safety of privacy protection more than a conventional method, and anonymity of the group signature can be reliably retained in any circumstance.

[0436] Even if a new group is formed or a new member is added to the existing group, two-way communication between the member and authority is not necessary. Therefore, without two-way communication between a member and an authority, anonymity of a group signature can be reliably and efficiently retained.

[0437] An arbitrary user may perform the function of an authority.