Key generation apparatus, anonymous signature system, management device, program and anonymous signature method

摘要

PROBLEM TO BE SOLVED: To provide an anonymous signature technique which enables a group manager to trace a malicious member even while a signer can arbitrarily specify a group, and satisfies a safety element.;SOLUTION: In each anonymous signature generator, a public key h(w), a secret key x(w) and a trace key t(w) are generated, wherein the key x(w) is an arbitral integer, the key y(w) is an elliptic scalar multiplication value y(w)=x(w) g1{S}G1, and the key t(w) is an elliptic scalar multiplication value y(w)=x(w) g1{S}G2, provided that {S} is the substitution of the symbol of a set (similarly hereafter). The anonymous signature generator generates (g1, y(k), h, σ(k)) for all the anonymous signature generators constituting a signature group so that only the set of four members (g1, y(i), h, σ(i)){S}G1⁴ of a cyclic group G1 becomes the set of DDH tuple using its on secret key x(i) and the public key y(i) of another anonymous signature generator constituting the signature group, and generates an anonymous signature σ including them. In the case that the management device invalidates the anonymity of the anonymous signature σ, k=i to be e(h, t(k))=e(σ(k), g2)=1 is detected using the trace key t(k) of all k{S}L, and a true anonymous signature generator is detected.;COPYRIGHT: (C)2008,JPO&INPIT