在一個匿名憑證系統中, 任何人皆無法從憑證當中找出憑證擁有者的身份, 且無法連結
任何兩個憑證之間的關係, 亦即是否為同一人所擁有。不可連結性在匿名憑證系統中是
一個非常重要的特性。Jan Camenisch 和Anna Lysyanskaya 在2002年時提出了一個
稱為CL 簽章的簽章系統。CL簽章可以允許使用者去證實自己的身份而不會洩漏出使用
者的身份資料。此外, 當使用者把簽章給驗證者驗證時, 驗證者也無法得知此簽章是在哪
一次簽章過程所中產生的。CL簽章是由大量的零知識證明技術組織而成, 採用這些運算
需求很高的技術導致CL 簽章的結構非常複雜且缺乏效率, 如此沉重的運算需求將限制
CL 簽章的應用領域。在本篇論文中我們提出了一個植基於ElGamal 簽章的盲簽章機
制, 同時也提出一個更有效率的匿名驗證過程。最後, 我們亦實作完成所提出的協定。

In an anonymous credential system, when a credential has been shown for verification,
none can identify the owner of the credential and link the relationship between
any two credentials. The unlinkability is the crucial feature for any anonymous credential
system. In 2002, Jan Camenisch and Anna Lysyanskaya proposed a signature
scheme (CL signature) which allows users to demonstrate their credentials without
revealing their identity information. However, CL signature is compounded of a
lot of zero-knowledge proof technologies which cause inefficiency for CL signatures.
Such heavy computation requirements may limit the scope which CL signatures can
be applied to. In this thesis, we propose a new blind signature scheme based on
ElGamal signatures and design an anonymous verification procedure which is more
efficient than the CL signature scheme. Finally, we also implement our proposed
protocols.

1 Introduction 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Overview of the Thesis . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2 Related Works 5
2.1 Preliminary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1.1 ElGamal’s Signature Scheme . . . . . . . . . . . . . . . . . . . 5
2.1.2 Chaum’s Blind Signature Scheme . . . . . . . . . . . . . . . . 7
2.1.3 Proof of Knowledge . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2 Literature Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.2.1 CL Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 The Proposed Scheme 13
3.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3 Signature Generation Protocol . . . . . . . . . . . . . . . . . . . . . . 14
3.4 Showing Signature Protocol . . . . . . . . . . . . . . . . . . . . . . . 15
3.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4 Security 19
4.1 Unlinkability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.1.1 The Linkability Game I . . . . . . . . . . . . . . . . . . . . . 19
4.1.2 The Linkability Game II . . . . . . . . . . . . . . . . . . . . . 22
4.2 Unforgeability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.3 Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5 Conclusions 27
Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
A The Implementation of the Scheme 32
A.1 The Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
A.2 The Demonstration of the Scheme . . . . . . . . . . . . . . . . . . . . 33
A.2.1 Signature Generation . . . . . . . . . . . . . . . . . . . . . . . 33
A.2.2 Showing Signature . . . . . . . . . . . . . . . . . . . . . . . . 38
B The Key Part of the Source Codes 41
B.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
B.2 The Codes of the User . . . . . . . . . . . . . . . . . . . . . . . . . . 42
B.2.1 Signature Generation . . . . . . . . . . . . . . . . . . . . . . . 42
B.2.2 Showing Signature . . . . . . . . . . . . . . . . . . . . . . . . 44
B.3 The Codes of the Signer . . . . . . . . . . . . . . . . . . . . . . . . . 44
B.4 The Codes of the Verifier . . . . . . . . . . . . . . . . . . . . . . . . . 45

[1] A. Fujioka, T. Okamoto, and K. Ohta, ”A practical secret voting scheme for large scale elections,” Advances in Cryptology-AUSCRYPT’92, LNCS 718, Springer-Verlag, pp. 244-251, 1992.
[2] A. Juels, M. Luby, and R. Ostrovsky, ”Security of Blind Digital Signature,” Advances in Cryptology-Crypto’97, LNCS 1294, Springer-Verlag, pp. 150-164, 1997.
[3] A. Menezes, P. Oorschot, and S. Vanstone, Handbook of Applied Cryptography, CRC Press LLC, 1997.
[4] A. Lysyanskaya, R. L. Rivest, A. Sahai, and S. Wolf, ”Pseudonym Systems,” Proceedings of the 6th Annual International Workshop on Selected Areas in Cryptography, p.184-199, 1999.
[5] C. P. Schnorr, ”Efficient Identification and Signatures for Smart Cards,” Advances in Cryptology - EUROCRYPT ’89, pp. 239-252, Springer-Verlag, 1990.
[6] D. Chaum, ”Blind Signatures for Untraceable Payments,” Advances in Cryptology - CRYPTO’82, pp. 199-203, 1983.
[7] D. Chaum, ”Blind signatures for untraceable payments,” Advances in Cryptology-CRYPTO’82, Springer-Verlag, pp. 199-203, 1983.
[8] D. Chaum, The voting system ”PunchScan”.
[9] D. Chaum, A. Fiat, and M. Naor, ”Untraceable electronic cash,” Advances in Cryptology-CRYPTO’88, LNCS 403, Springer-Verlag, pp. 319-327, 1990.
[10] D. Chaum, ”Security without Identification: Transaction Systems to Make Big Brother Obsolete,” Communications of the ACM, vol. 28, no. 10, pp. 1030-1044, 1985.
[11] D. Chaum and J. Evertse, ”A Secure and Privacy-Protecting Protocol for Transmitting Personal Information between Organizations,” Proceedings on Advances in cryptology-CRYPTO’86, pp. 118-167, 1987.
[12] D. Pointcheval and J. Stern, ”Security Arguments for Digital Signatures and Blind Signatures,” Journal of Cryptology, vol. 13, no. 3, pp. 361-396, Springer - Verlag, 2000.
[13] E. Fujisaki and T. Okamoto, ”A Practical and Provably Secure Scheme for Publicly Verifiable Secret Sharing and Its Applications,” Advances in Cryptology - EUROCRYPT’98, vol. 1403, pp. 32-46, Springer Verlag, 1998.
[14] H. Chen, P. P. Y. Lam, and H. C. B. Chan, ”Business-to-Consumer Mobile Agent-Based Internet Commerce System,” IEEE Transactions on Systems, Man, and Cybernetics-Part C: Applications and Reviews, vol. 37, no. 6, pp. 1174-1189, 2007.
[15] H. Orman and P. Hoffman, ”Determining Strengths For Public Keys Used For Exchanging Symmetric Keys,” IETF RFC 3766, 2004.
[16] I. Damg°ard, ”Efficient Concurrent Zero-Knowledge in the Auxiliary String Model,” Advances in Cryptology - EUROCRYPT 2000, vol. 1807, Lecture Notes in Computer Science , pp. 431-444, Springer-Verlag, 2000.
[17] I. Damg°ard and E. Fujisaki, ”An Integer Commitment Scheme Based on Groups with Hidden Order”, http://eprint.iacr.org/2001, 2001.
[18] I. Damg°ard, ”Payment Systems and Credential Mechanisms with Provable Security Against Abuse by Individuals,” Proceedings on Advances in Cryptology, pp. 328-335, 1990.
[19] J. Camenisch and A. Lysyanskaya, ”A Signature Scheme with Efficient Protocols,” Security in Communication Networks, LNCS 2576, pp. 268-289, 2002.
[20] J. Camenisch and M. Michels, ”Proving in Zero-Knowledge That a Number n Is the Product of Two Safe Primes,” Advances in Cryptology-CRYPTO’99, Lecture Notes in Computer Science, vol. 1592, pp. 107-122, 1999.
[21] J. K. Jan and C. C. Tai, ”A secure electronic voting protocol with IC carsd.” Journal of Systems and Software, vol. 39, no. 2, pp. 93-101, 1997.
[22] M. Abe and T. Okamoto, ”Provably Secure Partially Blind Signature,” Advances in Cryptology-Crypto’00, Lecture Notes in Computer Science, vol. 1880, Springer, Berlin, pp. 271-286, 2000.
[23] R. L. Rivest, A. Shamir, and L. Adleman, ”A Method for Obtaining Digital Signatures and Public-Key Cryptosystems,” Communications of the ACM, vol. 21, no. 2, pp. 120-126, 1978.
[24] S. Goldwasser, S. Micali, and C, Rackoff, ”The Knowledge Complexity of Interactive Proof-Systems,” SIAM Journal on Computing, vol. 18, no. 1, pp. 186-208, 1989.
[25] S. Goldwasser, S. Micali, and R. Rivest., ”A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks”, SIAM Journal of Computing, vol. 17, no. 2, pp.281-308, 1988.
[26] T. Cao, D. Lin, and R. Xue, ”A randomized RSA-based partially blind signature scheme for electronic cash,” Computers & Security, vol. 24, no. 1, pp. 44-49, 2005.
[27] T. ElGamal, ”A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” IEEE Transactions on Information Theory, vol. 31, no. 4, pp. 469-472, 1985.
[28] W. C. Ku and S. D. Wang, ”A Secure and Practical Electronic Voting Scheme,” Computer Communications, vol. 22, no. 3, pp. 279-286, 1999.