群體導向之加密與簽章

電腦網路已然為這資訊社會帶來極大的進步。公司行號、組織機構、或政府部門正廣泛使用電腦網路來處理或傳送資料。但，這也導致群體導向的密碼學應用系統蓬勃發展，種種的安全需求也就此因應而生。　　在這論文中，我們研究基本的密碼學工具，並使用它們來設計複雜的應用系統。很多基礎的密碼學工具，不僅本身就是一個有用的應用，在設計更複雜的安全系統時，它們也能被使用當作基本的建構元件。使用這些建構元件，我們發展新的群體導向的密碼學應用系統，包括一個完全公開金匙背叛者追蹤系統，和一個可轉換的群體不可否認簽章系統。　　一個完全公開金匙背叛者追蹤系統，是一個允許訂閱者秘密選擇自己的解密金匙，而這金匙無需讓他人知道的一個公開金匙背叛者追蹤系統。數位內容的廣播者利用所有訂閱者所公開的資訊來得到一個加密金匙，用這金匙加密後的資料，再播送給所有的訂閱者。每一個訂閱者能使用自己的解密金匙解得原始的內容。當某些訂閱者合謀產生一個盜版的解密器，即使這解密器內部的解密金匙不能被取得，系統也有一個追蹤的演算法能利用這解密器來追蹤這些共謀者。在這論文中，我們提出了一個這樣的系統。在我們的系統中，當訂閱者離開，或新使用者加入，原始訂閱者的解密金匙均不用重新計算，也就是訂閱者的解密金匙是長命的。此外，我們的系統也能保證訂閱者匿名的性質。　　一個群體不可否認簽章系統滿足以下三個性質：（１）只有群體的成員能匿名的簽章代表這個群體；（２）一個驗證者必須和這群體的管理者交談才能驗證簽章；（３）這群體的管理者能辨識一個合法簽章的簽章者。一個可轉換的群體不可否認簽章系統，允許這群體的管理者轉換所選擇的群體不可否認簽章為一般的群體簽章。在這論文中我們提出一個有效率的此種簽章系統。在我們的系統中，簽章不能被偽造、群體成員不會被構陷簽章、簽章之間沒有關聯、而且能避免聯合攻擊。此外，群體的管理者能把確認簽章和否認簽章的能力委任給信賴的人。最後，我們系統的加密金匙大小和成員所產生的簽章大小都跟整個群體成員的多寡無關。

關鍵字

可轉換性；群體不可否認簽章；背叛者追蹤

並列摘要

Computer networks bring tremendous progress to the information-based society. Companies, organizations, and governments have been using computers and networks to process or transmit digital data. But this also results in many different types of security requirements for group-oriented cryptographic applications. In this thesis we study existing cryptographic tools and then use them to design more complex cryptographic systems. Several fundamental cryptographic primitives are useful not only as stand-alone applications but also as building blocks in the designing of secure cryptographic objects. Using these building blocks, we develop new cryptographic applications, including a full public-key traitor-tracing scheme and a convertible group undeniable signature scheme. A fully public-key traitor-tracing scheme is a public-key traitor-tracing scheme that allows a subscriber to choose his or her own private decryption key without others learning the key. The distributor of the digital content uses the public data coming from all subscribers to compute a public encryption key. The paid contents are then transmitted to the subscribers, after being encrypted with the public key. Each subscriber can decrypt the data using his or her own secret key. Even if a coalition of subscribers conspire to create a pirate decoder with a tamper-free decryption key, there is a tracing algorithm to trace them. A realization of the scheme is presented in this thesis. Our scheme is long-lived, which means that the subscribers' secret keys need not be regenerated after the pirate key is detected or when subscribers join or leave the system. Finally, our scheme guarantees anonymity. A group undeniable signature satisfies the following requirements: (1) only group members can anonymously sign on behalf of the group; (2) a verifier must interact with the group manager to verify the signature; (3) the group manager can identify the signer of a valid signature. A convertible group undeniable signature scheme allows the group manager to turn select group undeniable signatures into universally verifiable group signatures. An efficient realization of the scheme is proposed in this thesis. Our scheme is unforgeable, exculpable, unlinkable, and coalition-resistant. The proposed scheme allows the group manager to delegate the ability to confirm and deny signatures to trusted parties. The sizes of the public key and signatures are independent of the group size.

並列關鍵字

group undeniable signature ； traitor-tracing ； convertibility

參考文獻

[6] G. Ateniese, J. Camenisch, M. Joye, and G. Tsudik, “A practical and provably secure coalition-resistant group signature scheme,” in Advances in Cryptology---CRYPTO 2000, vol. 1880 of LNCS, pp. 255--270, Springer-Verlag, 2000.

[7] B. Barak, “How to go beyond the black-box simulation barrier,” in Proceedings of the 35th Annual Symposium on Foundations of Computer Science, FOCS '01, pp. 106--115, IEEE Computer Society, 2001.

[11] M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation,” in Proceedings of

[13] D. Bleichenbacher, “Generating ElGamal signatures without knowing the secret key,” in Advances in cryptology---EUROCRYPT '96, vol. 1070 of LNCS, pp. 10--18, Springer-Verlag, 1996.

[14] M. Blum, “Coin °ipping by telephone: A protocol for solving impossible problems,” in Proceedings of the 24th IEEE Computer Conference, IEEE COMPCON, pp. 133--137, 1982.

國際替代計量

群體導向之加密與簽章

全文下載

主題瀏覽