RING SIGNATURE SYSTEM, TERMNAL, METHOD, AND PROGRAM

1 . A ring signature system comprising:

a plurality of member terminals belonging to a ring signature group; and

a verifier terminal that verifies a ring signature,

wherein each member terminal among the member terminals includes

a memory; and

a processor coupled to the memory and configured to:

generate a public key and a secret key of lattice-based cryptography as a verification key and a signature key, respectively, and

generate a signature for a message by a linkable ring signature to which a Schnorr signature is applied using the signature key of the member terminal and verification keys of the other member terminals, and

the verifier terminal includes

a memory; and

a processor coupled to the memory and configured to:

verify the signature using a verification key of the member terminal and the message.

2 . The ring signature system according to claim 1 , wherein the processor of each member terminal is configured to generate tag information of the member terminal using a hash value of a verification key list of the other member terminals and the signature key of the member terminal and generate a signature including the tag information.

3 . The ring signature system according to claim 2 , wherein

when an index representing each of the other member terminals is i=1, . . . , π−1, π+1, . . . , and N, and an index representing the member terminal is i=π,

the processor of each member terminal is configured to

calculate c π+1 ←H 1 (L, T, M, Au, Hu), where L is the verification key list, T is the tag information of the member terminal, M is the message, A is public information given in advance, u is a random number, and His a hash value of the verification key list L, and c i+1 ←H 1 (L, T, M, As i +Y i c i , Hs i +T i c i ), where i=1, . . . , π−1, π+1, . . . , and N, s i is a random number, Y i is a verification key of the member terminal corresponding to the index i, and T i is tag information of the member terminal corresponding to the index i,

calculate s π by using c π , and

generate (c 1 , s 1 , . . . , s N , T) as the signature.

4 . The ring signature system according to claim 3 , wherein the processor of each member terminal is configured to calculate s π by s π ←u−X π c π , where X π is the signature key of the member terminal.

5 . The ring signature system according to claim 3 , wherein the processor of the verifier terminal is configured to

calculate c i+1 ←H 1 (L, T, M, As i +Y i c i , Hs i +T i c i ) for i=1, . . . , N−1, and

successfully verify the signature when c 1 =H 1 (L, T, M, As N +Y N c N , Hs N +T N c N ).

6 . A member terminal in a ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal verifying a ring signature, the member terminal comprising:

a memory; and

a processor coupled to the memory and configured to:

generate a public key and a secret key of lattice-based cryptography as a verification key and a signature key, respectively; and

generate a signature for a message by a linkable ring signature to which a Schnorr signature is applied using the signature key of the member terminal and verification keys of the other member terminals.

7 . A method used for a ring signature system including a plurality of member terminals belonging to a ring signature group and a verifier terminal verifying a ring signature, the method comprising:

generating, by each member terminal among the member terminals, a public key and a secret key of lattice-based cryptography as a verification key and a signature key, respectively;

generating, by the each member terminal, a signature for a message by a linkable ring signature to which a Schnorr signature is applied using the signature key of the member terminal and verification keys of the other member terminals; and

verifying, by the verifier terminal, the signature using a verification key of the member terminal and the message.

8 . A non-transitory computer-readable recording medium storing a program causing a computer to perform the method of claim 7 .