Signature verification system, signature verification method, blind signature generation method, the user device, and blind signature generation program

摘要

PPROBLEM TO BE SOLVED: To verify that a user device owns a signature, without delivering the signature from the user device to a verification device. PSOLUTION: A prime factor q and the groups G1, G2 and GT of order q in which bilinear pairing e:G1×G2→GT exists are disclosed. The user device uses a commitment key ck to calculates a commitment C to information m, and transmits the results of calculating the commitment C to a signature generation apparatus as a signature request message M. The signature generation apparatus uses random numbers x, y and r belonging to generation sources g1 and g2 and Zq of the groups G1 and G2 to generate a pair of multiple elements as a signature σ for M through calculation with the signature request message M and to transmit the results of generating the pair of multiple elements to the user device. The user device verifies whether a pairing equality is had for the element of the signature σ, generates each non-interactive zero knowledge certification for the commitment C and for the signature σ, and gives the results of generating the non-interactive zero knowledge certifications together with the information m as a blind signature to the verification device. The verification device verifies the non-interactive zero knowledge certifications. PCOPYRIGHT: (C)2010,JPO&INPIT