提出安全證明是設計一個密碼系統時最重要的工作. 我們通常藉由“問題化約” 這個技巧來說明一個密碼系統的安全程度. 在本篇論文中, 我們花了不少篇幅對於證明密碼系統安全的技巧作了介紹, 這些技巧包含了 Random Oracle 模型及 Forking Lemma. 我們並介紹了一些可以用這些技巧來證明安全的密碼系統. 我們也提出了一個植基於范所提出的盲簽章系統的安全性證明. 在論文的最後, 我們也將我們所提出的證明與 David Pointcheval 及 Jacques Stern 這兩位學者對於另一個盲簽章系統所提出的證明作了比較. 同時對於使用 Random Oracle 模型來證明密碼系統安全性這個方法作了一些討論.

Providing a security proof is always an important issue in the process of designing a cryptographic scheme or protocol. We often show the security of a cryptosystem via “problem reduction.” In this thesis, lots of emphasis was put on the review of techniques for proving the security of cryptosystems. These techniques consist of Random Oracle Model and Forking Lemma. We also introduced some well-known
cryptographic schemes which can be proved secure using these techniques. Then we offered a security proof of a blind signature scheme based on the one proposed by Fan. In the end, we made a comparison between our proof and the proof of another blind signature scheme provided by David Pointcheval and Jacques Stern. Some arguments and discussions about using the Random Oracle Model to prove
the security of a cryptosystem were also included.

1 可證明安全的意義1
1.1 前言. . . . . . . . . . . . . . . . . . . . . . . . . .1
1.2 問題化約的實例. . . . . . . . . . . . . . . . . . . . .1
1.3 本篇論文的結構. . . . . . . . . . . . . . . . . . . . .3
2 在Random Oracle 模型下可被證明安全的密碼系統5
2.1 Random Oracle 模型. . . . . . . . . . . . . . . . . . .5
2.2 相關名詞解釋. . . . . . . . . . . . . . . . . . . . . .6
2.3 一個在Random Oracle 模型下被證明安全的加密系統. . . . .7
2.4 一個在Random Oracle 模型下被證明安全的簽章系統. . . . 11
3 在標準模型下可被證明安全的密碼系統17
3.1 相關名詞解釋. . . . . . . . . . . . . . . . . . . . . 17
3.2 一個在標準模型下被証明安全的加密系統. . . . . . . . . 20
4 Forking Lemma — 一個藉由重複執行攻擊者而解決難題的技巧27
4.1 對於攻擊者的假設. . . . . . . . . . . . . . . . . . . 27
4.2 在Random Oracle 模型下可被Forking Lemma 證明安全的簽章系統28
4.2.1 如何利用重複執行攻擊者來解決離散對數問題. . . . . . 29
4.2.2 DiscreteLog1 能成功解決離散對數問題的機率. . . . . .30
4.3 在Random Oracle 模型下可被Forking Lemma 證明安全的盲簽章系統33
4.3.1 如何利用重複執行攻擊者來解決特殊離散對數問題. . . . 34
5 一個可被證明安全的盲簽章系統43
5.1 在Random Oracle 模型下可被Forking Lemma 證明安全的盲簽章系統43
6 對於Random Oracle 模型的爭議57
6.1 對於Random Oracle 模型更精確的說明. . . . . . . . . . 58
6.2 在Random Oracle 模型下證明安全後卻不安全的實例(訊息長度不受限制) 59
6.2.1 用來代替random oracle 的代替品—function ensemble . 59
6.2.2 實例. . . . . . . . . . . . . . . . . . . . . . . . 62
6.3 在Random Oracle 模型下證明安全後卻不安全的實例(訊息長度受到限制) 64
6.3.1 互動及非互動式證明系統. . . . . . . . . . . . . . . 64
6.3.2 如何用Merkle tree 作訊息驗證. . . . . . . . . . . . 67
6.3.3 實例. . . . . . . . . . . . . . . . . . . . . . . . 69
7 結論及未來的工作75
參考文獻80

[1] Michel Abdalla, Mihir Bellare, and Phillip Rogaway. The oracle diffie-hellman assumptions and an analysis of dhies. In Proceedings of the 2001 Conference on Topics in Cryptology, pages 143–158. Springer-Verlag, 2001.
[2] Mihir Bellare and Phillip Rogaway. Random oracles are practical: a paradigm for designing efficient protocols. In Proceedings of the 1st ACM conference on Computer and communications security, pages 62–73. ACM Press, 1993.
[3] Ran Canetti, Oded Goldreich, and Shai Halevi. On the random-oracle methodology as applied to length-restricted signature schemes. Cryptology ePrint Archive, Report 2003/150, 2003. http://eprint.iacr.org/.
[4] Ran Canetti, Oded Goldreich, and Shai Halevi. The random oracle methodology, revisited. J. ACM, 51(4):557–594, 2004.
[5] Chun-I Fan. Improved low-computation partially blind signatures. Applied Mathematics and Computation, 145(2–3):853–867, 2003.
[6] Rosario Gennaro, Shai Halevi, and Tal Rabin. Secure hash-and-sign signatures without the random oracle. In EUROCRYPT, pages 123–139, 1999.
[7] Shafi Goldwasser and Silvio Micali. Probabilistic encryption. Journal of Computer Security, 28:270–299, 1984.
[8] T. Okamoto. Provably secure and practical identification schemes and corresponding signature schemes. In Ernest F. Brickell, editor, Advances in Cryptology - Crypto ’92, pages 31–53, Berlin, 1992. Springer-Verlag. Lecture Notes in Computer Science Volume 740.
[9] David Pointcheval and Jacques Stern. Security arguments for digital signatures and blind signatures. Journal of CRYPTOLOGY, 13(3):361–396, 2000.
[10] R. L. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM, 21(2):120–126, 1978.
[11] C. P. Schnorr. Efficient signature generation by smart cards. Journal of CRYPTOLOGY, 4(3):161–174, 1991.