基於ECDSA之部分盲簽章及其在比特幣上應用之研究

盲簽章是一種能夠不讓簽名者知道自己所簽訊息的數位簽章。然而在實際應用中，簽名者往往需要記錄一些與簽名相關的額外訊息。為了解決這個問題，部分盲簽章的概念被提出。除了具有盲簽章的性質外，部分盲簽章可以讓簽名者能從所簽訊息中獲取到所需的相關的資訊。部分盲簽章在被提出至今有不少成果被提出，但這些成果都需要花費較多的運算時間，或是不易應用到實際應用中。除此之外，隨著數位貨幣（如：比特幣）的興起，愈來愈多消費者會購買數位貨幣。但目前的購買方式無法隱藏消費者的電子錢包位置，因此一些研究將重點放在基於橢圓曲線簽章算法（Elliptic Curve Digital Signature Algorithm，ECDSA）的盲簽章的研究上。然而由於盲簽章存在簽名者完全不知道所簽訊息的特性，使得這些基於ECDSA的盲簽章難以靈活地運用在數位貨幣系統上。因此，我們提出了提出了三個部分盲簽章。我們的第一個簽章是到目前為止的研究是效能最好的部分盲簽章。另外，為了與比特幣系統更加契合，我們提出了兩種改版之ECDSA及其在通用群模型（Generic Group Model）下的安全性證明，並基於此提出了兩種首次與現行比特幣系統相契合的ECDSA部分盲簽章。我們為上述的部分盲簽章都提供了安全性證明及效能分析。最後我們提出了我們的部分盲簽章在購買比特幣時的應用方式。

關鍵字

ECDSA ；部分盲簽章；比特幣

並列摘要

Blind signatures allow a user to obtain a signature without revealing message information to the signer. However, in many cases, the signer must record additional information relevant to the signature. Therefore, a partially blind signature was proposed to enable the signer to obtain some information from the signed message. Although many partially blind signature schemes have been proposed, they are time intensive and impractical. Additionally, with the development of blockchain technology, users increasingly use Bitcoin for purchasing and trading with coin providers. Some studies have indicated that elliptic curve digital signature algorithm (ECDSA)-based blind signatures are compatible with Bitcoin because they prevent the linking of sensitive information due to the untamability of Bitcoin. However, these approaches are not sufficiently flexible because blind signatures do not allow the signer to obtain any information. In this thesis, we proposed three partially blind signature schemes. To the best of our knowledge, compared with other state-of-the-art schemes, our first scheme is the most practical partially blind signature. Additionally, to be more compatible with the current Bitcoin protocol, we introduced two variants of ECDSA with their security proofs under generic group model. Based on these two variants of ECDSA we proposed two partially blind signature schemes. Security proofs are provided to demonstrate that all proposed schemes have satisfactory unforgeability and blindness. At last we describe a application of bitcoin purchasing based on proposed schemes.