Patent ID: 6212637
Filing Date: 2001-04-03
Classification: H04L

Abstract:
A method whereby a verifier verifies en bloc digital signatures attached by a series of signers i=1, 2, . . . , L, said L being an integer equal to or greater than 2, to an electronified document m'.sub.i, where information containing a parameter q for each of said signer i to generate a signature function Sg.sub.i and a parameter .beta.=G.sub.1 (q) obtained with a function G.sub.1 by the use of said parameter q being published in advance, said method comprising the steps:wherein said each signer i:(a) generates a first random number s.sub.i as secret information, then generates information I.sub.i =G.sub.2 (s.sub.i, .beta.) with a function G.sub.2 through the use of a public parameter .beta. and said first random number s.sub.i, and publishes said information I.sub.i and two one-way functions f.sub.i and h.sub.i and identification information ID.sub.i used by the signer i as his public information {ID.sub.i, I.sub.i, f.sub.i, h.sub.i };(b) generates a second random number r.sub.i, then generates information X.sub.i =.PHI.(r.sub.i, .beta.) by setting said parameter .beta. and said second random number r.sub.i in a function .PHI., and sets information containing the information X.sub.i as X'.sub.i ;(c) generatese.sub.i =f.sub.i (X'.sub.i, m'.sub.i)d.sub.i =h.sub.i (X'.sub.i, m'.sub.i)with said one-way functions f.sub.i and h.sub.i through the use of document information m'.sub.i containing a document m.sub.i to be signed and said information X'.sub.i ; and(d) generates, for information containing e.sub.i, d.sub.i, s.sub.i and r.sub.i, a signaturey.sub.i =Sg.sub.i (e.sub.i, d.sub.i, s.sub.i, r.sub.i, y.sub.i-1)with a signature function Sg.sub.i generated using said parameter q and, sending information {ID'.sub.i, X'.sub.i, m'.sub.i, y.sub.i }, containing said identification information ID.sub.i as identification information ID'.sub.i, to the next signer (i+1) in the series of signers i=1 to L, the last signer L sending the information {ID'.sub.L, X'.sub.L, m'.sub.L, y.sub.L } to a verifier as a final destination: andwherein said verifier:(e) computes, from said public information {ID.sub.i, I.sub.i, f.sub.i, h.sub.i }, information I.sub.i corresponding to said identification ID.sub.i contained in said information ID'.sub.i in the received information {ID'.sub.L, X'.sub.L, m'.sub.L, y.sub.L } and said one-way functions f.sub.i and h.sub.i, and calculates e.sub.i and d.sub.i using said one-way functions f.sub.i and h.sub.i and X'.sub.i and m'.sub.i in said received pieces of information X'.sub.L and m'.sub.L ;(f) calculates said information X.sub.i contained in said information X'.sub.i, and computesZ'=V((X.sub.i *d.sub.i), (I.sub.i *e.sub.i).vertline.i=1, . . . , L)with a function V containing calculations (X.sub.i *d.sub.i) of said d.sub.i and said X.sub.i and (I.sub.i *e.sub.i) of said e.sub.i and said I.sub.i for i=1, . . . , L; and(g) computes W=.GAMMA.(y.sub.L *.beta.) with a function .GAMMA. containing a calculation (y.sub.L *.beta.) of said y.sub.L and said .beta., then makes a check to see if W=Z', and if both values match each other, decides that said signatures are all valid.