| 摘要 |
<P>PROBLEM TO BE SOLVED: To provide a commitment method which has a group structure maintenance property and is small in calculation cost. <P>SOLUTION: A commitment generation device selects any original ta,tb,t(i) and outputs a commitment C which includes c<SB POS="POST">a</SB>=g(0)<SP POS="POST">ta</SP>×Π<SB POS="POST">i=1</SB><SP POS="POST">k</SP>g(i)<SP POS="POST">t(i)</SP>, c<SB POS="POST">b</SB>=h(0)<SP POS="POST">tb</SP>×Π<SB POS="POST">i=1</SB><SP POS="POST">k</SP>h(i)<SP POS="POST">t(i)</SP>EG<SB POS="POST">1</SB>, and c(i)=m(i)×g<SB POS="POST">2</SB><SP POS="POST">t(i)</SP>EG<SB POS="POST">2</SB>. The commitment generation device outputs a decommit key D which includes d<SB POS="POST">a</SB>=g<SB POS="POST">2</SB><SP POS="POST">ta</SP>EG<SB POS="POST">2</SB>and d<SB POS="POST">b</SB>=g<SB POS="POST">2</SB><SP POS="POST">tb</SP>EG<SB POS="POST">2</SB>. A commitment verification device accepts input of the commitment C and accepts inputs of a message m<SP POS="POST">→</SP>, the commitment key ck and the decommit key D, and verifies whether both of the relationships e(c<SB POS="POST">a</SB>, g<SB POS="POST">2</SB>)=e(g(0), d<SB POS="POST">a</SB>)×Π<SB POS="POST">i=1</SB><SP POS="POST">k</SP>e(g(i), c(i)/m(i)) and e(c<SB POS="POST">b</SB>, g<SB POS="POST">2</SB>)=e(h(0), d<SB POS="POST">b</SB>)×Π<SB POS="POST">i=1</SB><SP POS="POST">k</SP>e(h(i), c(i)/m(i)) are satisfied. <P>COPYRIGHT: (C)2013,JPO&INPIT |
