Patent Publication Number: US-6341349-B1

Title: Digital signature generating/verifying method and system using public key encryption

Description:
BACKGROUND OF THE INVENTION 
     The present invention relates to a method and a system for generating and/or verifying a digital signature by using a public key encryption method for securing the security in a computer network. 
     The digital signature technology for imparting electric documents or the like for electronic comments or transactions with a function equivalent to that of a conventional seal (hanko in Japanese) promises high efficiency utilization of computer-network system. However, with the conventional electronic mail encryption technology (also known as Privacy Enhanced Mail or PEM in abbreviation), it is impossible to process more than one digital signature for a single enhanced mail. In this conjunction, in the electronic commerce fields, it is expected in the not-so-distant future that the electronic document such as message and the like affixed with a number of digital signatures including not only the digital signature of a purchaser but also those of a distributor, salesman and/or monetary business-man will be handled. Under the circumstances, there arises a demand for the multiple digital signature technology which allows the electronic documents affixed with a plurality of digital signatures to be processed. In this conjunction, it is noted that a person receiving an electronic document affixed with a plurality of digital signatures will be forced to verify the authenticity of plural or N digital signatures written by other persons before writing or generating his or her own single digital signature. Thus, in order to enhance the availability of the digital signature facility in the computer network system, it will be required to increase the speed for verification of the plural (N) digital signatures. Besides, it is conceivable that in the electronic commerces, there is a possibility that comments may be added by a plurality of persons in the course of processing the electronic document. 
     For having better understanding of the invention, description will first be made in some detail of the technical background of the invention. As a typical one of the digital signature techniques known heretofore, there may be mentioned the public-key cryptography elliptic curve system disclosed in J. Koeller, A. J. Menezes, M. Qu and S. A. Vanstone: “Standard for RSA, Diffie-Hellman and Related Public-Key Cryptography Elliptic Curve Systems (Draft 8)” in “IEEE P1363 Standard” published by the IEEE, May 3, 1996 and May 14, 1996, respectively. 
     FIG. 9 is a schematic diagram showing generally a configuration of a computer network system in which the techniques disclosed in the above-mentioned literatures are adopted. 
     Referring to FIG. 9, there are connected to a network  1001  a system manager&#39;s computer  1002 , a user A&#39;s computer  1003  and a user B&#39;s computer  1004  for mutual communication. 
     Operations of the individual units shown in FIG. 9 will be described below. 
     System Setup 
     The system manager&#39;s computer  1002  is in charge of generating an elliptic curve (E)  1006 . Subsequently, a base point (also referred to as the system key) (P)  1007  of the order (n)  1008  is generated and registered in a public file  1005 . 
     Key Generation 
     A key generating function module  1011  incorporated in the user A&#39;s computer  1003  is designed to execute the processing steps which will be mentioned below. 
     Step  1 : In an interval [2, n−2], an integer d A  is selected at random as a private key. 
     Step  2 : A key Q A  is computed in accordance with Q A =d A P. 
     Step  3 : The key (Q A )  1015  is opened to the public as the public key. More specifically, the public key (Q A )  1015  is transmitted together with the identifier name of the user A to the system manager&#39;s computer  1002  via the network  1001 , whereon the identifier name of the user A is written in the public file  1005  at a column  1009  for the user A&#39;s name with the value of the public key (Q A )  1015  being written in a column  1010  for the public key Q A . 
     Step  4 : In the user A&#39;s computer  1003 , the value of the private key (d A )  1014  is held as the private key of the user A. 
     Digital Signature Generation Process 
     A digital signature generating function module  1033  incorporated in the user A&#39;s computer  1003  is designed to execute the processing steps mentioned below. 
     Step  1 : Message (M)  1016  is received. 
     Step  2 : Hash value e=H(M) is computed by using a hash function (H)  1028 . 
     Step  3 : Random number  k  is selected from the interval [2, n−2] by using a random number generation function  1029 . 
     Step  4 : Point kP=(x, y) is computed by a so-called “scalar multiplication on elliptic curve (E)”  1030 . 
     Step  5 : A first tally  r  given by r=x+e (mod n) is determined in accordance with the modular computation “r=x+e (mod n)”  1031 . 
     Step  6 : A private key (d A )  1017  is inputted to modular computation process “s=k−d A r (mod n)”  1032  for thereby determining a second tally  s  (=k−d A r (mod n)). 
     Step  7 : A message M  1016  and the digital signature (r, s)  1019  are sent to the user B&#39;s computer  1004  via the network  1001 . 
     As the parameters required for the computations performed by the digital signature generating function module  1033 , the elliptic curve (E)  1006 , the base point which may also be referred to system key (P)  1007  and the order (n)  1008  registered in the public file  1005  held by the system manager&#39;s computer  1002  are referenced. 
     Digital Signature Verification Process 
     A digital signature verifying function module  1023  incorporated in the user B&#39;s computer  1004  is designed to execute the processing steps mentioned below. 
     Step  1 : The user A&#39;s public key (Q A )  1010  is fetched from the public file  1005  held by the system manager&#39;s computer  1002  to be set as a public key (Q A )  1020 . Additionally, the base point (system key) (P)  1007  is fetched from the public file  1005  held by the system manager&#39;s computer  1002  to be set as the base point (P)  1007 B. Furthermore, the digital signature (r, s)  1019  sent from the user A&#39;s computer  1003  is received to be set as a digital signature (r, s)  1021 . Besides, the message (M)  1016  sent from the user A&#39;s computer  1003  is received to be set as a message (M)  1022 . 
     Step  2 : The base point or system key (P)  1007 B, the public key (Q A )  1020 , the digital signature (r, s)  1021  are inputted to the process “scalar multiplication on elliptic curve (E)” and “addition”  1024  to thereby carry out the calculation “(x, y)=sP+rQ A ”. 
     Step  3 : The message M  1022  is inputted into the hash function H  1025  to thereby compute the hash value e=H(M). 
     Step  4 : Through the computation process “r′=x+e (mod n)”  1026 , a first tally “r′=x+e (mod n)” is determined. 
     Step  5 : When the decision “r=r′?”  1027  results in r=r′ or YES, data “authenticated” is outputted, and if otherwise, “not authenticated” is outputted. 
     As the parameters required for the computations performed by the digital signature verifying function module  1023 , the elliptic curve (E)  1006 , the base point or system key (P)  1007  and the order (n)  1008  as registered in the public file  1005  held by the system manager&#39;s computer  1002  are referenced. 
     Through the processes described above, the digital signature (r, s) functions as an electronic seal (i.e., seal or “hanko” impressed electronically by the user A for the message M). To say in another way, the user B can hold the set of the message M and the digital signature (r, s) as the evidence indicating that the message M is issued by the user A. Further, although the user B can recognize the authenticity of the set of the message M and the digital signature (r, s), the user B can not originally generate the set of the message M and the digital signature (r, s). For this reason, the user A can not negate later on the fact that the digital signature (r, s) has been generated by the user A. 
     However, the conventional system described above suffers the problems which will be elucidated below. 
     (1) Insufficient Proof for Security 
     In general, generation of a digital signature by a person having no private key provides a problem. If otherwise, the authenticity of the digital signature can not be ensured, degrading the creditability of the electronic commerce and rendering it impractical. 
     In the conventional system described above, it is required to provide that such tally combination (r, s) can not be generated which allows the output “authenticated” to be generated in the course of the digital signature verification processing without knowing the private key d A . However, the conventional system provides no proof to this end. Parenthetically, it should be mentioned that the problem mentioned above has been pointed out in conjunction with ElGamal signature technology on which the conventional system described above is based. 
     (2) Long bit length of the digital signature 
     Now, assuming that relevant parameters have respective bit lengths as follows: 
     (a) The bit length representing the order  n  of the base point P is l n  bits (e.g. 160 bits). 
     (b) The bit length representing the output of the hash function H is l H  bits (e.g. 160 bits). 
     (c) The bit length of the private key d A  is l d  bits (e.g. 160 bits). 
     The output value of the hash function H given by of 160 bits is considered as being necessary in view of the fact that the hash function H has a collision-free property. In this conjunction, it is contemplated with the phrase “collision-free property” to mean that difficulty is encountered in finding two different input values which result in a same output value in view of the computational overhead. By way of example, in the case where the output value of a hash function H is 160 bits, it will be possible to find two different input values which results in a same output value by carrying out an attack method known as “Paradox of Birthday” a number of times on the order of 2 80  on an average, which is however difficult in view of the computational overhead. 
     Further, the bit length of 160 bits for the order  n  of the base point (system key) is considered as being necessary because of difficulty of solving the discrete logarithm problem relevant to the addition on the elliptic curve. 
     In this case, when the length of the tally  r  of the digital signature (r, s) is of l n  bits with the length of the tally  s  being of l n  bits, then the total bit number amounts to (l n +l n ) bits (e.g. 320 bits). 
     (3) The length of the digital signature is determined in dependence on the length of the parameter  n  of the elliptic curve. Consequently, when the length of the parameter  n  is increased for ensuring the security of the digital signature more positively in the future, the length of the digital signature increases correspondingly. Parenthetically, in conjunction with RSA and EES, it is noted that the length of the parameter  n  is unavoidably increased because of enhancement of the decryption method and the computer performance promoted as a function of the time lapse. The same will also apply equally to the elliptical encryption in the future. To say in another way, it is expected that the length of the parameter  n  will necessarily increase as the decryption technology and the computer performance are enhanced as a function of time lapse. Such being the circumstances, it is desirable in conjunction with the elliptic encryption to realize the digital signature which does not depend on the length of the order  n  of the base point or system key P. 
     SUMMARY OF THE INVENTION 
     In the light of the state of the art described above, it is an object of the present invention to provide a digital signature generating and/or verifying method and system using a public key encryption scheme with high security as well as a recording medium for storing a program for carrying out the method. 
     Another object of the present invention is to provide a digital signature generating and/or verifying method and system using a public key encryption scheme, which allows the bit length of the digital signature to be shortened, and a recording medium for storing a program realizing the same. 
     Yet another object of the present invention is to provide a digital signature generating/verifying method and system which are based on the use of a public key encryption method in which the length of the digital signature is made to be independent of the length of the order of the base point, and a recording medium employed for storing a program realizing the same. 
     In view of the above and other objects which will become apparent as the description proceeds, there is provided according to a first generic aspect of the present invention a digital signature generating/verifying method of generating and/or verifying a digital signature authenticating electronically a signature affixed to a given document or message (M) by resorting to a public key encryption scheme. The digital signature generating/verifying method includes processing steps of determining for the given document or message (M) a hash value (e) satisfying a condition that e=H(M) by using a hash function (H), and determining for a numerical value (x) derived from translation of a random number a hash value (r) satisfying a condition that r=h(x) by using a hash function (h) whose output value is shorter than that of the first-mentioned hash function (H). 
     Further, according to another general aspect of the present invention, there is provided a digital signature generating and/or verifying method of generating or verifying a multiple digital signature authenticating electronically signatures affixed to document such as messages and/or comments (M i ) as created and/or added sequentially by N users  i  (where i=1, . . . , N) by using a public key encryption scheme. The digital signature generating/verifying method includes the steps of (a) determining for a given one of the messages (M i ) a hash value (e i ) satisfying a condition that e i =H(M i ) by using a hash function (H), (b) determining for a numerical value (x i ) obtained from translation of a random number a hash value (r i ) satisfying a condition that r i =h(x i ) by using a hash function (h) whose output value is shorter than that of the first-mentioned hash function (H) and (c) executing the above-mentioned steps (a) and (b) for each of the users  i  (where i=1, . . . , N). 
     According to another general aspect of the present invention, there is provided a digital signature generating/verifying system for generating a digital signature authenticating electronically a signature affixed to a given message (M) by resorting to a public key encryption scheme. The digital signature generating/verifying system is composed of a processing unit for determining for the message (M) a hash value (e) satisfying a condition that e=H(M) by using a hash function (H), a processing unit or module for determining for a numerical value (x) obtained from translation of a random number a hash value (r) satisfying a condition that r=h(x) by using a hash function (h) whose output value is shorter than that of the hash function (H). 
     Furthermore, according to another general aspect of the present invention, there is provided a digital signature generating and/or verifying system for generating and/or verifying a multiple digital signature authenticating electronically signatures affixed to document such as messages and/or comments (M i ) as created and/or added sequentially by N users  i  (where i=1, . . . , N) by resorting to the use of a public key encryption scheme, wherein the digital signature generating/verifying system includes a module for determining for a given one of the messages (M i ) a hash value (e i ) satisfying a condition that e i =H(M i ) by using a hash function (H), a module for determining for a numerical value (x i ) derived from translation of a random number a hash value (r i ) satisfying a condition that r i =h(x i ) by using a hash function (h) whose output value is shorter than that of the first-mentioned hash function (H), and a module for validating the above-mentioned modules for each of the users  i  (where i=1, . . . , N). 
     The above and other objects, features and attendant advantages of the present invention will more easily be understood by reading the following description of the preferred embodiments thereof taken, only by way of example, in conjunction with the accompanying drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     In the course of the description which follows, reference is made to the drawings, in which: 
     FIG. 1 is a schematic block diagram showing generally a system configuration according to an exemplary embodiment of the present invention; 
     FIG. 2A is a block diagram showing a system configuration of a single digital signature generating/verifying unit executed by a user A&#39;s personal computer shown in FIG. 1; 
     FIG. 2B is a flow chart for illustrating a processing involved in the single digital signature generation algorithm executed by the user A&#39;s personal computer in conjunction with the system shown in FIG. 1; 
     FIG. 3 is a flow chart for illustrating a processing for a single digital signature verification processing or algorithm executed by a user B&#39;s personal computer in the system shown in FIG. 1; 
     FIG. 4 is a flow chart for illustrating a processing for a duple digital signature generation processing or algorithm executed by the user B&#39;s personal computer in the system shown in FIG. 1; 
     FIG. 5 is a flow chart for illustrating a processing for a duple digital signature verification processing or algorithm executed by a user C&#39;s personal computer in the system shown in FIG. 1; 
     FIG. 6 is a block diagram showing a computer network configuration according to another embodiment of the invention; 
     FIG. 7 is a flow chart for illustrating a processing for a triple digital signature generation algorithm executed by the user C&#39;s personal computer shown in FIG. 6; 
     FIG. 8 is a flow chart for illustrating a processing for a triple digital signature verification algorithm executed by a user D&#39;s personal computer in the system shown in FIG. 6; and 
     FIG. 9 is a schematic diagram showing generally a configuration of a conventional computer network system designed for transferring electronic documents affixed with digital signatures known heretofore. 
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     Now, the present invention will be described in detail in conjunction with what is presently considered as preferred or typical embodiments thereof by reference to the drawings. In the following description, like reference characters designate like or corresponding parts throughout the several views. Also in the following description, it is to be understood that such terms as “document”, “comment”, “message” and the like are words of convenience and are not to be construed as limiting terms. 
     FIG. 1 is a schematic block diagram showing generally a system configuration according to an exemplary embodiment of the invention. Referring to the figure, there are connected to a network  101 , a user A&#39;s personal computer  102 , a user B&#39;s personal computer  103  and a user C&#39;s personal computer  104 . In the user A&#39;s personal computer  102 , a user A&#39;s signature (r 1 , s 1 )  111  is generated for a user A&#39;s created document (M 1 )  110  by using a base point which may also be referred to as the system key (P)  117  and a user A&#39;s private key (d 1 )  118  in accordance with a single digital signature generation algorithm (AL 1 )  105  to be subsequently sent to the user B&#39;s personal computer  103  via the network  101 . In this conjunction, “r 1 ” and “s 1 ” of the user A&#39;s signature (r 1 , s 1 )  111  are defined as a first tally and a second tally, respectively. In the user B&#39;s personal computer  103 , authenticity of the user A&#39;s issued document  109  composed of a set of the user A&#39;s created document (M 1 )  110  and the user A&#39;s signature (r 1 , s 1 )  111  is verified by using a base point or system key (P)  119  and a user A&#39;s public key (Q 1 )  120  in accordance with a single digital signature verification algorithm (AL 1 ′)  106  and at the same time, a user A&#39;s and B&#39;s multiple signature (r 1 , r 2 , s 2 )  113  is generated for the user A&#39;s created document (M 1 ) (i.e., document M 1  created by user A)  115 , the user A&#39;s signature (r 1 , s 1 )  111  and a user B&#39;s addition such as comment (M 2 )  114  by using the base point (P)  119  and the user B&#39;s private key (d 2 )  121  in accordance with a duple digital signature generation algorithm (AL 2 )  107  to be subsequently sent to the user C&#39;s personal computer  104  via the network  101 . In the user C&#39;s personal computer  104 , authenticity of the user B&#39;s issued document  112  composed of the set of the user A&#39;s created document (M 1 )  115  and the user B&#39;s addition or comment (M 2 )  114  as well as the user A&#39;s and B&#39;s multiple (duple) signature (r 1 , r 2 , s 2 )  113  is verified by using the base point (P)  122 , a user A&#39;s public key (Q 1 )  123  and a user B&#39;s public key (Q 2 )  124  in accordance with a duple digital signature verification algorithm (AL 2 ′)  108 . 
     FIG. 2A is a block diagram showing a system configuration of the single digital signature generation/verification system shown in FIG.  1  and FIG. 2B is a flow chart for illustrating the processing for the single digital signature generation algorithm (AL 1 )  105  mentioned previously in conjunction with the system shown in FIG.  1 . Description will now be made by reference to FIGS. 2A and 2B. 
     The system configuration shown in FIG. 2A bears correspondence to the one shown in FIG.  9 . It can be seen that the former differs from the latter in respect to the algorithm in the digital signature generating blocks  1031  and  1032 , the algorithm in the digital signature verifying block  1026  and the output algorithm in the block  1024 . 
     Single Digital Signature Generation Algorithm (AL 1 )  105   
     Step  201 : Processing for executing this algorithm (AL 1 )  105  is started. 
     Step  202 : The user A&#39;s created document (M 1 )  110 , the base point (P)  117  and the user A&#39;s private key (d 1 )  118  are inputted. 
     Step  203 : A random number k 1  of l H  bits is generated. 
     Step  204 : Computation is performed for determining k 1 P=(x 1 , y 1 ). 
     Step  205 : Hash value r 1  (=h(x 1 )) of l H /2 bits is computed. 
     Step  206 : Hash value e 1  (=H(M 1 )) of l H  bits is computed. 
     Step  207 : Computation is performed for determining a tally s 1  in accordance with s 1 =k 1 +d 1 (e 1 +r 1 ) (mod n). 
     Step  208 : value of the single digital signature (r 1 , s 1 )  111  is outputted. 
     Step  209 : The processing is terminated. 
     The single digital signature generated through the processing described above corresponds to an electronic image of a seal (“hanko” in Japanese) impressed on the message M 1  by the user A. In other words, the single digital signature (r 1 , s 1 ) can be generated only when the private key d 1  equivalent to the seal kept only by the user A is used for the message M 1  as furnished. 
     FIG. 3 is a flow chart for illustrating a processing for the single digital signature verification algorithm (AL 1 ′)  106  in conjunction with the system shown in FIG.  1 . Description will now be made by reference to FIG.  3 . 
     Single Digital Signature Verification Algorithm (AL 1 ′)  106   
     Step  301 : Processing is started. 
     Step  302 : The user A&#39;s created document (M 1 )  110  and the single digital signature (r 1 , s 1 )  111  is inputted. 
     Step  303 : The system key (P)  119  and the public key (Q 1 )  120  are inputted. 
     Step  304 : Hash value e 1 =H(M 1 ) of l H  bits is computed. 
     Step  305 : Computation is performed for determining a first point on an elliptic curve, i.e., a first elliptic point (x 1 , y 1 )=s 1 P−(e 1 +r 1 )Q 1 . 
     Step  306 : A numeric value r 1 ′=h(x 1 ) is computed. 
     Step  307 : When the condition that r 1 =r 1 ′ is met, the processing proceeds to a step  308  while if otherwise to a step  310 . 
     Step  308 : A signal or data “authenticated” is outputted. Step  309 : The first elliptic point (x 1 , y 1 ) is outputted, whereon the processing proceeds to a step  311 . 
     Step  310 : “Not authenticated” is outputted. 
     Step  311 : The processing is then terminated. 
     Through the processing described above, it can be confirmed whether or not the single or simple digital signature (r 1 , s 1 ) is a correct signature, i.e., whether or not the single digital signature (r 1 , s 1 ) corresponds to the correct or true seal image. More specifically, upon reception of the message M 1  and the single or simple digital signature (r 1 , s 1 ), the user B (or user B&#39;s computer) checks to confirm the authenticity of the digital signature by referencing the public key Q 1  which corresponds to the registered seal (“hanko”). 
     FIG. 4 is a flow chart for illustrating a processing for the duple digital signature generation algorithm (AL 2 )  107  in conjunction with the system shown in FIG.  1 . Description will now be made by reference to FIG.  4 . 
     Duple Digital Signature Generation Algorithm (AL 2 )  107   
     Step  401 : Processing is started. 
     Step  402 : User B&#39;s addition or comment (M 2 )  114 , the base point (or system key) (P)  119  and the user B&#39;s private key (d 2 )  121  are inputted. 
     Step  403 : The first point (x 1 , y 1 ) on the elliptic curve outputted in the step  309  is fetched. 
     Step  404 : A random number k 2  of l H  bits is generated. 
     Step  405 : A point (x, y)=k 2 P is computed. 
     Step  406 : A second point (x 2 , y 2 )=(x 1 , y 1 )+(x, y) is computed. 
     Step  407 : Hash value r 2 =h(x 2 ) of l H /2 bits is computed. 
     Step  408 : Hash value e 2 =H(M 2 ) of l H  bits is computed. 
     Step  409 : Computation for determining a tally given by s 2 =s 1 +k 2 +d 2 (e 2 +r 1 +r 2 ) (mod n) is performed. 
     Step  410 : Value of the duple digital signature (r 1 , r 2 , s 2 )  113  is outputted. 
     Step  411 : The processing comes to an end. 
     The duple digital signature (r 1 , r 2 , s 2 ) generated through the processing described above corresponds to the seal image impressed on a whole document prepared by adding the user B&#39;s comment or addition (M 2 )  114  to the message (M 1 )  110  created by the user A and affixed with the single digital signature (r 1 , s 1 )  111 . More specifically, when the message M 1  created by other person (user A) and affixed with the other person&#39;s single digital signature or the user A&#39;s single digital signature (r 1 , s 1 ) in the case of the illustrated example is received by the user B and when the user B wants to add the comment M 2 , the duple digital signature (r 1 , r 2 , s 2 ) is generated, which indicates that the seal is impressed for the whole document by using the private key d 2  corresponding to the seal which only the user B possesses. 
     FIG. 5 is a flow chart for illustrating a processing for a duple digital signature verification algorithm (AL 2 ′)  108  in conjunction with the system shown in FIG.  1 . Description will now be made by reference to FIG.  5 . 
     Duple Digital Signature Verification Algorithm (AL 2 ′)  108   
     Step  501 : Processing is started. 
     Step  502 : The user A&#39;s created document (M 1 )  115 , the user B&#39;s added comment or addition (M 2 )  114 , and the duple digital signature (r 1 , r 2 , s 2 )  113  are inputted. 
     Step  503 : The base point or system key (P)  122 , the user A&#39;s public key (Q 1 )  123  and the user B&#39;s public key (Q 2 )  124  are inputted. 
     Step  504 : A hash value e 1 =H(M 1 ) of l H  bits is computed. 
     Step  505 : A hash value e 2 =H(M 2 ) of As bits is computed. 
     Step  506 : A second elliptic point given by (x 2 , y 2 )=s 2 P−(e 1 +r 1 )Q 1 −(e 2 +r 1 +r 2 )Q 2  is computed. 
     Step  507 : A numerical value r 2 ′=h(x 2 ) is computed. 
     Step  508 : When r 2 =r 2 ′, the processing proceeds to a step  509 , and if otherwise, to a step  511 . 
     Step  509 : A signal “authenticated” is outputted. 
     Step  510 : The second elliptic point (x 2 , y 2 ) is outputted, whereon the processing proceeds to a step  512 . 
     Step  511 : A signal or data “not authenticated” is outputted. 
     Step  512 : The processing comes to an end. 
     Through the processing described above, it is confirmed whether or not the duple digital signature (r 1 , r 2 , s 2 ) is a correct signature, i.e., whether or not the duple digital signature (r 1 , r 2 , s 2 ) corresponds to the correct or true seal image. More specifically, upon reception of the message M 1 , message M 2  and the duple digital signature (r 1 , r 2 , s 2 ), the user C checks to confirm that the digital signature is made authentically by the very users A and B by referencing the public keys Q 1  and Q 2  which correspond to the registered seals. In that case, the user C can confirm the authenticity of the digital signature without using either the private key d 1  corresponding to the user A&#39;s seal or the private key d 2  corresponding to the user B&#39;s seal. 
     In the foregoing, generation of the duple digital signature by using two private keys d 1  and d 2  has been described as an exemplary embodiment of the invention. In this conjunction, it should be mentioned that the principle underlying the digital signature generating/verifying method described above can be extended in general for the generation of an N-tuple digital signature generated by using N private keys d 1 , d 2 , . . . , d N . 
     FIG. 6 is a block diagram showing a computer network configuration according to another embodiment of the invention on the assumption that the system is expanded so as to enable triple digital signatures, i.e., N=3. Referring to the figure, there are newly connected to the network  101 , a user D&#39;s personal computer  606  in addition to the user A&#39;s personal computer  102 , the user B&#39;s personal computer  103  and the user C&#39;s personal computer  104 . Set up newly in the user C&#39;s personal computer  104  in addition to the dual digital signature verification algorithm (AL 2 ′)  108 , the system key or base point (P)  122 , the user A&#39;s public key (Q 1 )  123  and the user B&#39;s public key (Q 2 )  124  are a triple digital signature generation algorithm (AL 3 )  604  and a user C&#39;s private key (d 3 )  605 . The user C&#39;s personal computer  104  creates a user C&#39;s issued document  601  and sends it to the user D&#39;s personal computer  606 . The user C&#39;s issued document  601  contains newly a user C&#39;s addition or comment (M 3 )  603  and users A&#39;s, B&#39;s and C&#39;s signatures (r 1 , r 2 , r 3 , s 3 )  602  in addition to the user A&#39;s created document (M 1 )  613 , the user B&#39;s addition such as a comment (M 2 )  614  and a user A&#39;s and B&#39;s signatures (r 1 , r 2 , s 2 )  612 . Set up in the user D&#39;s personal computer  606  are a triple digital signature verification algorithm (AL 3 ′)  607 , a base point (P)  608 , the user A&#39;s public key (Q 1 )  609 , the user B&#39;s public key (Q 2 )  610  and the user C&#39;s public key (Q 3 )  611 . 
     FIG. 7 is a flow chart for illustrating a processing for the triple digital signature generation algorithm (AL 3 )  604  executed by the user C&#39;s personal computer  104  shown in FIG.  6 . 
     Triple Digital Signature Generation Algorithm (AL 3 )  604   
     Step  701 : Processing is started. 
     Step  702 : The user C&#39;s addition or comment (M 3 )  603 , the private key (d 3 )  605 , the base point (P)  122  and the duple digital signature (r 1 , r 2 , s 2 )  612  are inputted. 
     Step  703 : Second elliptic point (x 2 , y 2 ) outputted in the step  510  is fetched. 
     Step  704 : A random number k 3  of l H  bits is generated. 
     Step  705 : A point k 2 P=(x, y) is computed. 
     Step  706 : Coordinates (x 3 , y 3 )=(x 2 , y 2 )+(x, y) are computed. 
     Step  707 : A hash value r 3 =h(x 3 ) of l H /2 bits is computed. 
     Step  708 : A hash value e 3 =H(M 3 ) of l H  bits is computed. 
     Step  709 : A tally s 3 =s 2 +k 3 +d 3 (e 3 +r 1 +r 2 +r 3 ) (mod n) is computed. 
     Step  710 : Value of the triple digital signature (r 1 , r 2 , r 3 , s 3 )  602  is outputted. 
     Step  411 : The processing is terminated. 
     The triple digital signature (r 1 , r 2 , r 3 , s 3 ) generated through the processing described above corresponds to the seal image impressed on a whole document obtained by adding the user C&#39;s comment or addition M 3  to the messages M 1  and M 2  affixed with the users A and B&#39;s multiple digital signatures (r 1 , r 2 , s 2 ). More specifically, when the messages M 1  and M 2  affixed with other users&#39; multiple digital signature (i.e., the users A&#39;s and Bs&#39; multiple digital signatures in the case of the illustrated example) (r 1 , r 2 , s 2 ) are received by a user (i.e., user C) and when the user C wants to add the comment M 3 , the triple digital signature (r 1 , r 2 , r 3 , s 3 ) can be generated for the whole document created by the users A and B and added with the comment M 3  by the user C only by using a private key d 3  corresponding to the seal which only the user C possesses. 
     FIG. 8 is a flow chart for illustrating a processing for the triple digital signature verification algorithm (AL 3 ′)  607  executed by the user D&#39;s personal computer  606  in conjunction with the system shown in FIG.  6 . Description will now be made by reference to FIG.  8 . 
     Triple Digital Signature Verification Algorithm (AL 3 ′)  607   
     Step  801 : Processing is started. 
     Step  802 : The user A&#39;s created document (M 1 )  613 , the user B&#39;s addition or comment (M 2 )  614 , the user C&#39;s addition or comment (M 3 )  603  and the triple digital signature (r 1 , r 2 , r 3 , s 3 )  602  is inputted. 
     Step  803 : The base point (P)  608 , the user A&#39;s public key (Q 1 )  609 , the user B&#39;s public key (Q 2 )  610  and the user C&#39;s public key (Q 3 )  611  are inputted. 
     Step  804 : A hash value e 1 =H(M 1 ) of l H  bits is computed. 
     Step  805 : A hash value e 2 =H(M 2 ) of l H  bits is computed. 
     Step  806 : A hash value e 3 =H(M 3 ) of l H  bits is computed. 
     Step  807 : A third point on the elliptic curve, i.e., a third elliptic point (x 3 , y 3 )=s 3 P−(e 1 +r 1 )Q 1 −(e 2 +r 1 +r 2 )Q 2 −(e 3 +r 1 +r 2 +r 3 )Q 3  is computed. 
     Step  808 : Tally r 3 ′=h(x 3 ) is computed. 
     Step  809 : When r 3 ′=r 3 , the processing proceeds to a step  810 , and if otherwise, proceeds to a step  812 . 
     Step  810 : Signal “authenticated” is outputted. 
     Step  811 : The third elliptic point (x 3 , y 3 ) is outputted, whereon the processing proceeds to a step  813 . 
     Step  812 : Signal “not authenticated” is outputted. 
     Step  813 : The processing comes to an end. 
     Through the processing described above, it is confirmed whether or not the triple digital signature (r 1 , r 2 , r 3 , s 3 ) is a correct signature, i.e., whether or not the triple digital signature (r 1 , r 2 , r 3 , s 3 ) corresponds to the correct or true seal image. More specifically, upon reception of the message M 1 , the message M 2 , the message M 3  and the triple digital signature (r 1 , r 2 , r 3 , s 3 )), the user D can check to confirm whether or not the digital signatures have been made by the very users A, B and C by referencing the public keys Q 1 , Q 2  and Q 3  which correspond to the registered seals (“hanko”) of the users A, B and C, respectively. 
     The above-mentioned digital signature generation/verification method can be expanded to the case where N is equal to or greater than “4” (four). In other words, in general, a digital signature generating/verifying method for verifying electronically a multiple digital signature affixed to messages and/or comments M 1  created and/or added by N users (i=1, . . . , N) can be carried out in general as follows: 
     Procedure for Verifying Multiple Digital Signature by Users i (2≦i≦N) 
     Step  901 : Processing is started. 
     Step  902 : The (i−1) messages or comments M 1 , . . . , M i−1  and the (i−1)-tuple digital signature (r 1 , . . . , r i−1 , s i−1 ) issued by an immediately preceding user (i−1) are received. 
     Step  903 : Computation of a hash value e k =H(M k ) is repeated for the user (i−1) starting from k=1. 
     Step  904 : Public keys Q k  previously generated for satisfying Q k =d k P and registered are inputted repetitionally for the user (i−1) starting from k=1. 
     Step  905 : A point (x i−1 , y i−1 ) on the elliptic curve given by the following expression (5) is computed.          (       x     i   -   1       ,     y     i   -   1         )     =         s     i   -   1          P     -       ∑     k   =   1       i   -   1                         (       e   k     +       ∑     M   =   1     k                     r   m         )          Q   k                           
     Step  906 : A hash value r i−1 ′=h(x i−1 ) is computed. 
     Step  907 : When r i−1 =r i−1 ′, then data or signal indicating “authenticated” is issued. 
     Step  908 : Point (x i−1 , y i−1 ) on the elliptic curve is outputted, whereon the processing proceeds to a step  910 . 
     Step  909 : If r i−1 °r i−1 ′, data indicating “not-authenticated” is issued. 
     Step  910 : The processing comes to an end. 
     In other words, the digital signature generation/verification method for generating electronically the multiple digital signature affixed to messages and/or comments (i.e., document) M i  created or added by N users (i=1, . . . , N) can be performed as follows: 
     Generation Procedure of Multiple Digital Signature by Users i (2≦i≦N) 
     Step  1001 : Processing is started. 
     Step  1002 : The point (x i−1 , y i−1 ) obtained at the step  908  is inputted. 
     Step  1003 : A hash value e i =H(M i ) is computed. 
     Step  1004 : A random number k i  is generated. 
     Step  1005 : Point k i P=(x, y) is computed. 
     Step  1006 : Point (x i , y i )=(x i−1 , y i−1 )+(x, y) are computed. 
     Step  1007 : A hash value r i =h(x i ) is computed. 
     Step  1008 : By using private keys d i , the tally s i  given by the following expression is determined.          s   i     =       s     i   -   1       +     k   i     +         d   i          (       e   i     +       ∑     k   =   1     i                     r   k         )                       (     mod                 n     )                         
     Step  1009 : A set of the numerical values (r 1 , . . . , r i , . . . , s i ) is outputted as the digital signature. 
     The embodiments of the invention described by reference to FIGS. 3 to  5  are directed to the multiple digital signature realized by making use of the addition defined on the elliptic curve. However, in general, such multiple digital signature can equally be realized by resorting to binary operation defined on the abelian group. 
     By way of example, in a set Z n  of integers from “1” to “n−1” (where n represents a large prime number on the order of 1,000 bits), multiplication is defined in the world of modulo n. Then, Z n  represents an abelian group. The base point P (1&lt;P&lt;n) is selected appropriately with the private key d and the public key Q being so selected that the following relation can apply valid: 
     
       
         Q=P d  (mod n)  (1) 
       
     
     In conjunction with the above expression (1), it is noted that the problem of determining d for given values of Q, P and n represents a discrete logarithm problem which is difficult to solve in view of the computational overhead when the value of  n  is large. 
     On the presumption mentioned above, the single digital signature generation algorithm (AL 1 )  105  described previously by reference to FIG. 2, for example, is modified as follows: 
     Single Digital Signatures Generation Algorithm (AL 1 ) 
     Step  201 : The processing is started. 
     Step  202 : The user A&#39;s created document M 1 , the base point P and the private key d 1  are inputted. 
     Step  203 : A random number or integer k 1  of l H  bits is generated. 
     Step  204 : Computation is performed for determining x 1 =P k     1   . 
     Step  205 : A hash value r 1 =h(x 1 ) of l H /2 bits is computed. 
     Step  206 : A hash value e 1 =H(M 1 ) of l H  bits is computed. 
     Step  207 : Computation is performed for determining the tally s 1 =k 1 +d 1 (e 1 +r 1 ) (mod n). 
     Step  208 : Value of the single digital signature (r 1 , s 1 ) is outputted. 
     Step  209 : The processing comes to an end. 
     The single digital signature (r 1 , s 1 ) obtained, being modified as mentioned above, brings about advantageous effects similar to those obtained in the digital signature generating/verifying method described hereinbefore by reference to FIG.  2 . Similar modification of the multiple digital signatures can provide similar advantages as those mentioned hereinbefore. 
     With the arrangements of the digital signature generating/verifying systems described above, there can be assured such advantageous effects as mentioned below. 
     (1) It is impossible to forge a digital signature of other person without knowing the other person&#39;s private key. Security concerning the forgery prevention of the single digital signature (r 1 , s 1 ) will be demonstrated by the proposition  1  described hereinafter. 
     (2) The length of the digital signature can be shortened. By way of example, assuming that the order n is 160 bits and that the length of the output value of the total hash function H is 160 bits, then the length of the single digital signature in the conventional system is 240 bits. By contrast, in the case of the systems according to the invention, the length of the single digital signature is 240 bits. Furthermore, the length of the duple digital signature in the conventional system is 640 bits, whereas in the systems according to the invention, it is only 320 bits. In general, in the case where the N-tuple digital signature is affixed, the total length of the digital signatures is of 320×N bits, whereas in the system according to the present invention, it is 160+80×N bits. Thus, when the value of N is large, the length of the digital signature according to the invention can be reduced by ca. ¼ when compared with the signature length in the conventional system. In other words, the length of the digital signature can be significantly reduced according to the teachings of the invention. 
     (3) According to the invention, it is possible to make the length of the digital signature be independent of the length of the order  n . Assuming now that the length of the output of the total hash function H is sufficiently greater than that of the random integer  k , the length of the tally  s  of the signature can be suppressed smaller than the length of the outputs of the total hash function H plus the length of the private key  d . Thus, independent of the length of the order  n , the length of the N-tuple digital signatures can be made to be not greater than “the length of the output of the whole hash function H+private key  d +N×length of the output of the half-hash function h”. 
     In each of the digital signature generation/verification system according to the embodiment of the invention described above, the processing steps of executing the digital signature generating method can be stored in the form of a programs in a recording medium such as a CD-ROM, a floppy-disk, a semiconductor memory or the like, wherein the program can be loaded and executed in a computer for generating the digital signature for thereby generating the digital signature. Similarly, the processing steps included in the input digital signature verifying method can be loaded in the computer for the digital signature verification in the form of a program to be executed for verifying the digital signature. Needless to say, the digital signature generating/verifying program mentioned above may be down-loaded to client personal computers from the server computer. 
     Lemma (Subsidiary Proposition) 1 
     It is presumed that H represents a hash function having a one-way property, the algorithm AL is not difficult to execute in view of the computational overhead and that data generated without resorting to the use of the hash function is inputted to thereby generate on a memory in the course of computation the numerical values of  x  and  y  which satisfy the equation “y=H(x)”. In that presumed case, the numerical value  y  can never make appearance on the memory so long as the numerical value  x  has not made appearance ever on the memory in the past. 
     Demonstration 
     Demonstration will be made by resorting to “reductio ad absurdum (reduction to absurdity)” or irrationality. It is assumed that the value  y  satisfying the function y=H(x) has made appearance on the memory in precedence to the value  x . However, since the hash function H is of the one-way property, computation for the reverse transformation of the hash function H, i.e., x=H −1 (y) is impossible. Accordingly, in order to generate the value  x  on the memory, it is necessary to supply externally such input data from which the value  x  capable of satisfying the hash function y=H(x), which however contradicts to the inputting of the data generated without using the hash function H. 
     The Demonstration of the lemma 1 is now concluded. 
     Proposition  1   
     It is presumed that the discrete logarithm problem concerning the addition on the elliptic curve can not be solved. Additionally, it is assumed that the hash function H(•) of l H  bits has collision-free property as well as the one-way property. Furthermore, it is presumed that the hash function h(•) of l H /2 bits has also the one-way property. In that case, when l n ≧l H , there exists no algorithm AL 3  which can output in response to the inputting of the base point (system key) P and the public key Q 1  the message M 1  and the single digital signature (r 1 , s 1 ) for which the algorithm AL 1  outputs “authenticate” so long as the private key d 1  is unknown. 
     Demonstration 
     Now, it is supposed that such algorithm AL 3  exists which can output in response to the inputted system key or base point P and the public key Q 1 , the message M 1  and the single digital signature (r 1 , s 1 ) for which the verification processing AL 1 ′ outputs “authenticate” without knowing the private key d 1 . More specifically, it is supposed that such algorithm AL 3  exists for which the inputs and the outputs are as follows: 
     Input to the algorithm AL 3 : system key (base point) P, and public key Q 1    
     Output from the algorithm AL 3 : message M 1 , single digital signature (r 1 , s 1 ) where the message M 1  and the single digital signature (r 1 , s 1 ) satisfy the following conditions: 
     
       
         (x 1 , y 1 )=s 1 P−(e 1 +r 1 )Q 1   (2) 
       
     
     
       
         r 1 =h(x 1 )  (3) 
       
     
     
       
         e 1 =H(M 1 )  (4) 
       
     
     It should be noted that l n ≧l H  holds true. 
     On the conditions mentioned above, the number of the outputs from the algorithm AL 3  is three, i.e., M 1 , s 1  and r 1 . Accordingly, in the course of the processing according to the algorithm AL 3 , the correct output values make appearance in either one of the orders or sequences mentioned below: Case 1: Correct output values make appearance in the sequence of s 1 , r 1  and M 1 . Case 2: Correct output values make appearance in the sequence of r 1 , s 1  and M 1 . Case 3: Correct output values make appearance in the sequence of s 1 , M 1  and r 1 . Case 4: Correct output values make appearance in the sequence of M 1 , s 1  and r 1 . Case 5: Correct output values make appearance in the sequence of r 1 , M 1  and s 1 . Case 6: Correct output values make appearance in the sequence of M 1 , r 1  and s 1 . 
     In the cases 1 and 2 mentioned above, the correct output values of s 1  and r 1  make appearance in precedence with the correct value of the message M 1  making no appearance at a given time point in the course of the processing. Since  h  in the expression (3) represents the hash function, the correct output value of the tally x 1  must make appearance in precedence to that of the tally r 1  in the light of the “Lemma 1” stated previously. When the value of the tally x 1  is determined the value of the tally y 1  assumes either one of two values ±β because the term (x 1 , y 1 ) in the expression (2) represents a point on the elliptic curve E. In correspondence to the value +β or −β of the tally y 1 , the hash value e 1  which can satisfy the condition given by the expression (2) is limited to two different values. After the time point of concern, the message M 1  satisfying the condition given by the expression (4) so that the hash value e 1  assumes either one of the two value must be determined, which however contradicts to the fact that “H” in the expression (4) represents the hash function. Accordingly, the situations corresponding to the Cases 1 and 2 can not take place. 
     In the Cases 3 and 4 mentioned above, the correct output value of s 1  and the message M 1  make appearance in precedence with the correct value of the correct output value r 1  making no appearance at a given time point in the course of the processing. At this time point, the hash value e 1  can be determined definitely in accordance with the expression (4). After this time point, the value of the tally r 1  satisfying the conditions given by the expressions (2) and (3) must be determined. However, it will never occur that the correct output value of the tally r 1  makes appearance at first, being followed by determination of the value for the coordinate x1. This is because “h” in the expression (3) represents the hash function. Besides, such case will not occur in which the correct output value of x 1  makes appearance in precedence and thereafter the value of r 1  is determined. Because, if otherwise, the discrete logarithm problem concerning the addition on the ellipse can be solved in conjunction with the expression (2), which contradicts the proposition stated hereinbefore. In other words, the value of r 1  can not be determined at any time point. Thus, the situations corresponding to the Cases 3 and 4 can not occur. 
     In the Cases 5 and 6 mentioned above, the correct output values of the tally r 1  and the message M 1  make appearance in precedence with the correct value of the tally s 1  making no appearance at a given time point in the course of the processing. At this given time point, the hash value e 1  can be determined definitely in accordance with the expression (4). After this time point, the value of the tally s 1  satisfying the conditions given by the expressions (2) and (3) must be determined. However, it will never occur that the correct output value of the tally s 1  makes appearance at first, being then followed by determination of the value for the coordinate x 1 . This is because “h” in the expression (3) represents the hash function and the correct output value of x 1  can make appearance before the output value of r 1  is determined precedingly. Besides, such case will not occur in which the correct output value of x 1  makes appearance in precedence and thereafter the value of s 1  is determined. Because, if otherwise, the expression (2) can be solved concerning the unknown s 1 , that is, the discrete logarithm problem concerning the addition on the ellipse can be solved, which contradicts however the proposition stated hereinbefore. In other words, the value of s 1  can not be determined at any time point. Thus, the situations corresponding to the Cases 5 and 6 can not occur. 
     Thus, there occurs none of the situations corresponding to the Cases 1 to 6 mentioned previously. Thus, the algorithm AL 3  does not exist. 
     Now, the demonstration is concluded. 
     By the way, it should be noted that in conjunction with the demonstration of the Proposition  1  that the algorithm AL 3  may exist unless the Proposition  1  that l n ≧l H  applies valid. 
     To say in another way, if the condition l n &lt;l H  should hold true, there may arise such situation that the message M 1  and the single digital signature (r 1 , s 1 ) for which the single digital signature verifying algorithm AL 1 ′ outputs “authenticated” can be generated without knowing the private key  d . 
     By way of example, let&#39;s suppose that in the computation “s=k+d(r+e) (mod n)”, the value of l n  is small and hence the value of  n  is small. Then, the collision-free property of hash value  e =H(M) (mod n) may collapse, incurring such case where computation is performed such that the tally  s  can assume a same value for messages M and M′ notwithstanding of the fact that the message M is not same as the message M′, i.e., M≠M′, as exemplified below. 
     Let&#39;s suppose, by way of example, that the messages M and M′ are written applications for purchasing a car. 
     Message M 
     To FT J#&amp;•GH Sales Company 
     I will purchase the car A at 1,050,000 yens. 
     To be signed by Takaragi 
     Message M′ 
     To IG#. Hy 8 (Jk) Sales Company 
     I will purchase the car A at 2,050,000 yens. 
     To be signed by Takaragi 
     Again suppose that the malicious sales company prepared the written application for purchase such as the message M and handed it over to Mr. Takaragi under the false pretense that the leading character string “FT J#•GH” is added for the purpose of ensuring security and that Mr. Takaragi signed the written application (message M) with pleasure because of low price of the car A. Later on, Mr. Takaragi receives a bill demanding payment of 2,050,000 yens together with the exhibit of the message M′ affixed with his signature, to his great surprise. However, verification of the message M′ shows that Mr. Takaragi has signed the written application or message M′. 
     In order to exclude positively the injustice such as mentioned above, it is necessary that H represents the hash function which has not only the one-way property but also the collision-free property and that the parameter  n  relevant to the elliptic curve relation is assigned with a large value for validating the condition that l n ≧l H . 
     It should be additionally mentioned in conjunction with the “Demonstration” described above that the hash function  h  may be only of the one-way property and need not necessarily have the collision-free property. However, in case the hash function  h  is not of the one-way property, the values which can satisfy the condition given by the expression (3) may be found by arithmetically determining a variety of values for  x  by changing  s  and M while fixing  r  in the expression (2). The message M and the signature (s, r) found in this way may constitute forged message and signature. For this reason, it is necessarily required that the hash function  h  is of the one-way property. 
     Moreover, according to the teaching of the invention, the length of the digital signature can be shortened. 
     More specifically, the single digital signature (r 1 , s 1 ) has a bit length equal to l n +l H /2 (e.g. 240 bits), and thus the length of the signature can be shortened when compared with the conventional signature length l n +l n  (e.g. 320 bits). Furthermore, the length of the duple digital signature (r 1 , r 2 , s 2 ) is (l n +l H /2+l H /2) bits (e.g. 320 bits), which is significantly shorter than the length of the conventional signature l n +l n +l n  (e.g. 480 bits). 
     Proposition  2   
     It is presumed that the discrete logarithm problem concerning the addition on the elliptic curve can not be solved. Additionally, it is assumed that the hash function H(•) of l H  bits has the collision-free property as well as the one-way property. Furthermore, it is presumed that the hash function h(•) of l H /2 bits has the one-way property as well. In that case, so long as l n ≧l H , there exists no algorithm AL 4  which can output the duple digital signature (r 1 , r 2 , s 2 ) for which the algorithm AL 2  outputs “authenticated” without knowing the private key d 1 . 
     Demonstration 
     Now, it is supposed that such algorithm AL 4  exists which generates the duple digital signature (r 1 , r 2 , s 2 ) for which the verification processing according to the algorithm AL 2 ′ outputs “authenticated” without knowing both the private key d 1  and the private key d 2 . Namely, presumption is made as follows: 
     Input to the processing AL 4 : system key (base point) P, and public keys Q 1  and Q 2 , and 
     Output from the processing AL 4 : messages M 1  and M 2 , duple digital signature (r 1 , r 2 , s 2 ), 
     where the duple digital signature (r 1 , r 2 , s 2 ) satisfies the following conditions: 
      e 1 =H(M 1 )  (4) 
     
       
         e 2 =H (M 2 )  (5) 
       
     
     
       
         (x 2 , y 2 )=s 2 P−(e 1 +r 1 )Q 1 −(e 2 +r 1 +r 2 )Q 2   (6) 
       
     
     
       
         r 2 =h(x 2 )  (7) 
       
     
     In the course of executing the processing according to the algorithm AL 4 , the correct output values make appearance in either one of the sequences mentioned below: Case 1: Correct output values make appearance in the sequence of s 2 , r 1  and r 2 . Case 2: Correct output values make appearance in the sequence of r 1 , s 2  and r 2 . Case 3: Correct output values make appearance in the sequence of s 2 , r 2  and r 1 . Case 4: Correct output values make appearance in the sequence of r 2 , s 2  and r 1 . Case 5: Correct output values make appearance in the sequence of r 1 , r 2  and s 2 . Case 6: Correct output values make appearance in the sequence of r 2 , r 1  and s 2 . 
     In conjunction with the Case 1 to 6 mentioned above, it is noted that the computation sequence that the correct output value of the tally r 2  is determined in accordance with the expression (7) only after the correct output value of the coordinate  x  has made appearance is common to all the Case 1 to 6. If otherwise, it contradicts the presumption that the hash function  h  is of the one-way property. 
     Additionally, the computation sequence that the hash values e 1  and e 2  are determined in accordance with the expressions (4) and (5), respectively, only after the correct output values of the messages M 1  and M 2  have made appearance is also common to the all the aforementioned Cases 1 to 6. If otherwise, it contradicts the presumption that the hash function H is of the one-way property and collision-free. 
     In the Cases 1 and 2, the correct output values of the tallies s 2  and r 1  make appearance at first at a given time point in the course of executing the processing whereas the correct output value of the tally r 2  makes no appearance. After the above-mentioned given time point, the tally r 2  which satisfies the condition given by the expression (6) must be determined. In this conjunction, however, the following facts (a), (b) and (c) have to be taken into account. 
     (a) Such situation does not occur in which the correct output value of the tally r 2  makes appearance finally after the appearance of the correct hash values e 1  and e 2 . More specifically, the computation sequence in this case will be such that the value of the coordinate x 2  is determined and then the tally r 2  determined. However, this means that the equation (6) can be solved with the tally r 2  as the unknown, which contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. 
     (b) Such situation can not occur that the correct hash value e 2  is outputted only after the appearance of the correct output values for the hash value e 1  and the tally r 2 , because, if otherwise, the equation (6) is solved with the hash value e 2  as the unknown, which contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. 
     (c) Such situation can not occur that the correct output value for the hash value e 1  makes appearance only after the appearance of the correct output voltages for the hash value e 2  and the tally r 2 , because, if otherwise, the equation (6) is solved with the hash value e 2  as the unknown, which of course contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. 
     In the Cases 3 and 4, the correct output values of the tallies s 2 , r 2  and x 2  make appearance at first at a given time point in the course of executing the processing, whereas the correct output value of the tally r 2  makes no appearance. After the above-mentioned given time point, the tally r 1  which satisfies the condition given by the expression (6) must be determined. Such situation does not occur in which the correct output value of the tally r 1  makes appearance finally after the appearance of the correct hash values e 1  and e 2 . Supposing that the correct output value for the hash value e 2  makes appearance finally, then it follows: 
     (i) If the private keys d 1  and d 2  are known, the expression (6) can be modified as follows: 
     
       
         (x 2 , y 2 )={s 2 −d 1 (e 1 +r 1 )}P−(e 2 +r 1 +r 2 )Q 2   (8) 
       
     
     The above equation (8) is solvable with a tally r 1  as the unknown, which of course contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. 
     (ii) If the private key d 2  is known with the private key d 1  being unknown, the expression (6) can be modified as follows: 
     
       
         (x 2 , y 2 )={s 2 −d 2 (e 2 +r 1 +r 2 )}P−(e 1 +r 1 )Q 1   (9) 
       
     
     The above equation (9) is solvable with the tally r 1  as the unknown, which is in contradiction to the presumption that the discrete logarithm problem on the elliptic curve is solvable. 
     (iii) When neither the private key d 2  nor the private key d 1  is known, the equation (6) is solvable with the tally r 1  as the unknown, which is in contradiction to the presumed insolvability of the discrete logarithm problem on the elliptic curve. 
     In view of the foregoing, it can be concluded that the correct output value for the tally r 1  can not make appearance finally after the output of the correct hash values e 1  and e 2 . 
     (b) Such situation can not occur that the correct output value for the hash value e 1  makes appearance only after the appearance of the correct output voltages for the hash value e 1  and the tally r 1 , because, if otherwise, the equation (6) is solved with the hash value e 1  as the unknown, which of course contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. 
     (c) Such situation can not occur that the correct output value for the hash value e 1  makes appearance only after the appearance of the correct output voltages for the hash value e 1  and the tally r 1 , because, if otherwise, the equation (6) is solved with the hash value e 2  as the unknown, which of course contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. Thus, Cases 3 and 4 can not occur. 
     In the Cases 5 and 6, the correct output values of the tallies r 1 , r 2  and x 2  make appearance at first at a given time point in the course of executing the processing whereas the correct output value of the tally s 2  makes no appearance. After the above-mentioned given time point, the tally s 2  which satisfies the condition given by the expression (6) must be determined. In this conjunction, however, the following facts (a), (b) and (c) have to be taken into account. However, in that case, (a) such situation does not occur in which the correct output value of the tally s 2  makes appearance finally after the appearance of the correct hash values e 1  and e 2 . Because, this means that the equation (6) can be solved with the tally s 2  as the unknown, which contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. Further, (b) such situation can not occur that the correct hash value e 2  is outputted only after the appearance of the correct output values for the hash value e 1  and the tally s 2 , because, if otherwise, the equation (6) is solved with the hash value e 2  as the unknown, which contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. Furthermore, (c) such situation can not occur that the correct output value for the hash value e 1  makes appearance only after the appearance of the correct output voltages for the hash value e 2  and the tally s 2 , because, if otherwise, the equation (6) is solved with the hash value e 1  as the unknown, which of course contradicts the presumption that the discrete logarithm problem on the elliptic curve is insolvable. Thus, Cases 5 and 6 can not occur. 
     From the foregoing, it is concluded that none of the Cases 1 to 6 can occur and thus the algorithm AL 4  does not exist. 
     Now, the demonstration is concluded. 
     As will now be appreciated from the foregoing description, there have been provided a public key encryption method of high security and a system for carrying out the same. 
     Further, with the public key encryption method and the system according to the invention, the length of the digital signature can be shortened. 
     Additionally, according to the present invention, the public key encryption method and the system can be so realized that the length of the digital signature has no dependency on the length of the order of the base point (system key). 
     Many features and advantages of the present invention are apparent from the detailed description and thus it is intended by the appended claims to cover all such features and advantages of the system which fall within the true spirit and scope of the invention. Further, since numerous modifications and combinations will readily occur to those skilled in the art, it is not intended to limit the invention to the exact construction and operation illustrated and described. Accordingly, all suitable modifications and equivalents may be resorted to, falling within the spirit and scope of the invention.