Signature verification system, signature-device, verification device, and signature verification method

Abstract

A group structure preserving signature system that can be applied to groups based on symmetric bilinear mapping, that reduces the signature length, and that enables efficient computation of verification equations is provided. At least, information indicating p, G, G, G, e, g, and g, information needed to obtain e(h, h), and data that includes g, h, g, h, {g, h}, . . . , {g, h} are held as a public key vk, and data that includes vk, γ, δ, γ, δ, δ, δ, {γ, δ}, . . . , {γ, δ} are held as a secret key sk. A signature device selects ζ and ρ at random from integers between 0 and p−1, both inclusive, obtains w, s, t, and r, and generates, as a signature σ, data that includes w, s, t, and r. A verification device verifies the signature σ by using two verification equations.