在協作平台服務中，當工作團隊的領導者收到一份撰寫文件的工作時，領導者將工作分配給協作者們，協作者可透過協作平台即時對文件編修，也可即時看到其他協作者的修改。然而，雖然協作平台使得團隊工作更有效率，卻也產生一些協作者間的問題。一、當領導者發現文件某些部份錯誤時，無法得知該編輯者身分，二、當所有協作者完成編修後，因所有編修皆儲存於協作平台，故領導者必須確認所有編修的正確性。為解決協作平台上的問題，我們認為協作平台的運作必須與數位簽章機制整合，每次的編修均產生一份該編輯者的簽章。然而目前協作平台的相關研究多數仍針對平台的安全存取控制，並無一個較合適的簽章機制。
為了解決以上問題，我們提出了雙暗門雜湊函數的概念，其特色為將雜湊函數值的碰撞分為兩個程序，並提供一次碰撞的雙暗門雜湊函數。於協作平台中，我們將一次碰撞雙暗門雜湊函數及數位簽章機制整合，提供了三項特色：降低線上階段的運算成本、提供領導者與平台系統搜尋編輯者身分的機制與支援批次確認所有編修的正確性。

In a collaborative workflow platform, when a group leader receives a document which requires cooperators' support, she/he assigns the task to the cooperators. Each cooperator can modify the document in real-time and view the other cooperators’ modifications simultaneously. Though a collaborative platform makes a team work more efficiently, problems can occur. First, when the leader finds an error in the document, she/he cannot know who made the error. Second, when all cooperators have finished their modifications, the leader must verify the validity of all revisions stored on the collaborative platform. To solve these problems, we propose that a collaborative workflow platform is combined with a digital signature scheme: one signature per revision. Most studies about collaborative platforms consider access control mechanisms rather than signature schemes.
In this thesis, we propose the implementation of a new trapdoor hash function: a bi-trapdoor hash function that requires two trapdoor keys when a collision is found. We combine a one-collision bi-trapdoor hash function with a digital signature scheme in order to create a secure and efficient collaborative platform. Our proposed scheme has three advantages: a low computation cost in the online phase; a rapid approach to finding the editor of a revision in a collaborative platform; and batch verification support for all revisions.

論文審定書 i
Acknowledgments iv
摘要v
Abstract vi
List of Figures x
List of Tables xi
Chapter 1 Introduction 1
1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Chapter 2 Background 4
2.1 The Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Nyberg’s Fast Accumulated Hash Function . . . . . . . . . . . . . . . . . . . . . 6
2.3 Schnorr Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4 Batch Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Chapter 3 Related Works 8
3.1 Bellare et al.’s Two-Party RSA Signature Schemes . . . . . . . . . . . . . . . . 8
3.1.1 Review of Bellare et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . 9
3.2 Shamir et al.’s Online/Offline Signature Scheme . . . . . . . . . . . . . . . . . . 10
3.2.1 The Hash-Sign-Switch Paradigm . . . . . . . . . . . . . . . . . . . . . . 10
3.2.2 Shamir et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . 11
3.3 Krawczyk et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . 12
3.3.1 Review of Krawczyk et al.’s Scheme . . . . . . . . . . . . . . . . . . . . 12
3.4 Chandrasekhar et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . 13
3.4.1 Review of Chandrasekhar et al.’s Scheme . . . . . . . . . . . . . . . . . 13
3.5 Chen et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . . . . 14
3.5.1 Review of Chen et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . 14
3.6 Joye’s Online/Offline Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . 15
3.6.1 Review of Joye’s scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Chapter 4 The Proposed Scheme 17
4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.2 One-Collision Bi-Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . 18
4.2.1 Definition of Bi-Trapdoor Hash Function . . . . . . . . . . . . . . . . . 18
4.2.2 Schnorr-Type Signature Scheme . . . . . . . . . . . . . . . . . . . . . . 19
4.2.3 One-Collision Bi-Trapdoor Hash Function . . . . . . . . . . . . . . . . 19
4.3 Construction of Collaborative Platform . . . . . . . . . . . . . . . . . . . . . . . 22
Chapter 5 Security Proof 28
5.1 Schnorr-Type Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
5.2 One-Collision Bi-Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . 30
Chapter 6 Performance 38
Chapter 7 Conclusion and Future Works 43
Bibliography 44
Appendix A Batch Verification 48
A.1 Shamir et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . . . 48
A.2 Krawczyk et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . 49
A.3 Chandrasekhar et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . 49
A.4 Chen et al.’s Trapdoor Hash Function . . . . . . . . . . . . . . . . . . . . . . . . 50
A.5 Joye’s Online/Offline Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . 50
A.6 Bellare et al.’s Two-Party RSA Signature Schemes . . . . . . . . . . . . . . . . 50

[1] G. Ateniese and B. de Medeiros. Identity-based chameleon hash and applications. Financial Cryptography, pages 164–180, 2004.
[2] G. Ateniese and B. de Medeiros. On the key exposure problem in chameleon hashes. In Proceedings of the 4th International Conference on Security in Communication Networks, SCN’04, pages 165–179, Berlin, Heidelberg, 2005. Springer-Verlag.
[3] F. Bao, R. H. Deng, X. Ding, J. Lai, and Y. Zhao. Hierarchical identity-based chameleon hash and its applications. In Proceedings of 9th International Conference on Applied Cryptography and Network Security, volume 6715 of Lecture Notes in Computer Science,
pages 201–219. Springer Berlin Heidelberg, 2011.
[4] M. Bellare, J. A. Garay, and T. Rabin. Fast batch verification for modular exponentiation and digital signatures. In Advances in Cryptology —EUROCRYPT’98, pages 236–250. Springer-Verlag, 1998.
[5] M. Bellare and R. Sandhu. The security of practical two-party RSA signature schemes. IACR Cryptology ePrint Archive, page 60, 2001.
[6] C. Boyd and C. Pavlovski. Attacking and repairing batch verification schemes. Advances in Cryptology —ASIACRYPT 2000, 1976:58–71, 2000.
[7] S. Chandrasekhar, S. Chakrabarti, M. Singhal, and K.L. Calvert. Efficient proxy signatures based on trapdoor hash functions. Information Security, 4(4):322–332, 2010.
[8] X. Chen, F. Zhang, and K. Kim. Chameleon hashing without key exposure. In Proceedings of the 7th International Conference on Information Security, pages 87–98. Springer Berlin Heidelberg, 2004.
[9] X. Chen, F. Zhang, W. Susilo, H. Tian, J. Li, and K. Kim. Identity-based chameleon hash scheme without key exposure. In Proceedings of the 15th Australasian Conference on Information Security and Privacy, Lecture Notes in Computer Science, pages 200–215. Springer Berlin Heidelberg, 2010.
[10] X. Chen, F. Zhang, H. Tian, B. Wei, and K. Kim. Discrete logarithm based chameleon hashing and signatures without key exposure. Computers and Electrical Engineering, 37(4):614–623, 2011.
[11] A. Fiat. Batch RSA. Advances in Cryptology —CRYPTO ’89, pages 175–185, 1989.
[12] L. Harn. Batch verifying multiple DSA-type digital signatures. Electronics Letters, 34(9):870–871, 1998.
[13] L. Harn, W.J. Hsin, and C. Lin. Efficient on-line/off-line signature schemes based on multiple-collision trapdoor hash families. The Computer Journal, 53(9):1478–1484, 2010.
[14] T. Jaeger and A. Prakash. Requirements of role-based access control for collaborative systems. In Proceedings of the First ACM Workshop on Role-based Access Control, RBAC’95, New York, NY, USA, 1996. ACM.
[15] M. Joye. An efficient on-line/off-line signature scheme without random oracles. In Proceedings of 7th International Conference on Cryptology and Network Security, volume 5339 of Lecture Notes in Computer Science, pages 98–107. Springer Berlin Heidelberg,
2008.
[16] A.A. El Kalam, Y. Deswarte, A. Baina, and M. Kaaniche. Access control for collaborative systems: A web services based approach. In IEEE International Conference on Web Services, pages 1064–1071, 2007.
[17] A. Kittur, B. Suh, B.A. Pendleton, and E.H. Chi. He says, she says: Conflict and coordination in wikipedia. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’07, pages 453–462, New York, NY, USA, 2007. ACM.
[18] H. Krawczyk and T. Rabin. Chameleon signatures. In Proceedings of the Network and Distributed Systems Security Symposium, 2000.
[19] K. Lauter. The advantages of elliptic curve cryptography for wireless security. IEEE Wireless Communications, 11(1):62–67, 2004.
[20] Z. Li, J. Higgins, and M. Clement. Performance of finite field arithmetic in an elliptic curve cryptosystem. In Proceedings of 9th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems, pages 249–256, 2001.
[21] M. Mehta and L. Harn. Efficient one-time proxy signatures. IEE Proceedings Communications, 152(2):129–133, 2005.
[22] P. Mell and T. Grance. The NIST definition of cloud computing, 2011.
[23] Alfred J. Menezes, Scott A. Vanstone, and Paul C. Van Oorschot. Handbook of Applied Cryptography. CRC Press, Inc. Boca Raton, 2001.
[24] G.L. Miller. Riemann’s hypothesis and tests for primality. In Proceedings of Seventh Annual ACM Symposium on Theory of Computing, STOC ’75, pages 234–239, 1975.
[25] K. Nyberg. Fast accumulated hashing. In Proceedings of the Third International Workshop on Fast Software Encryption, pages 83–87. Springer-Verlag, 1996.
[26] D. Pointcheval and J. Stern. Security proofs for signature schemes. Advances in Cryptology —EUROCRYPT ’96, 1070:387–398, 1996.
[27] D. Pointcheval and J. Stern. Security arguments for digital signatures and blind signatures. Journal of Cryptology, 13:361–396, 2000.
[28] C.P. Schnorr. Efficient identification and signatures for smart cards. Advances in Cryptology —CRYPTO’89 Proceedings, 435:239–252, 1990.
[29] A. Shamir and Y. Tauman. Improved online/offline signature schemes. Advances in Cryptology —CRYPTO 2001, 2139:355–367, 2001.
[30] Y. Sun, X. Chen, and X. Du. An efficient elliptic curve discrete logarithm based trapdoor hash scheme without key exposure. Journal of Computers, 8(11):2851–2856, 2013.
[31] W. Tolone, G.J. Ahn, T. Pai, and S.P. Hong Hong. Access control in collaborative systems. ACM Computing Surveys, 37(1):29–41, 2005.
[32] H. Zhu. Some issues of role-based collaboration. In IEEE Canadian Conference on Electrical and Computer Engineering, volume 2, pages 687–690, 2003.