臺灣博碩士論文加值系統

隨著網際網路快速的發展，電子商務在網路上發展的議題備受高度關注。如何能確保在網路上交易的安全性與公平性問題更顯的重要。簡單來說，公平交易的定義是指，在公平交易協定後，參與交易的雙方能公平的接收到對方所要的有價值的物品，或是雙方皆得不到任何有用的資訊。
在2004年，Chen等學者提出一種新的簽章方式，稱為並存簽章(Concurrent Signature，CS)。並存簽章可以提供另一種方法來解決公平交換的問題，此方法不需要可信任的第三方幫忙，而且擁有較少的交互訊息。交換的協定過程中，在額外的資訊(例如: keystone)被其中一方公佈之前，被交易雙方所產生的簽章都是模糊的，意即並不會洩漏簽章者的身份。然而，控制keystone的一方比另一方有更大的優勢，因此無法達到完全的公平。
在本論文中，我們先指出先前文獻在設計上的缺失，所以會遭受訊息取代攻擊。因此，本論文提出一個改進的方法，此改進方法可以來防止先前設計上的缺失並滿足了accountability的特性。此外，延伸方案也被提出，此方案將方法延伸至基於身分的並存簽章，並且具有accountability的特性。
一個達到並存簽章之完全公平性的新觀念被提出，可提供更有效率的轉換機制。相似於傳統的公平交換，在我們新設計的模型中也引入了一個可信任的第三方，來扮演仲裁者的角色，可解決交易雙方之紛爭。

With the rapid development of Internet, E-Commerce has attracted more and more attention. How to ensure the security and fairness of transaction via the Internet is a critical issue. Briefly, a fair exchange is defined that the two involved parties, after the fair exchange succeeds, can obtain their wanted valuable goods or neither of them can obtain useful information.
In 2004, Chen et al. proposed a new kind of signature called concurrent signature (CS). Concurrent signature, which does not need the assistance of TTP and has few message interactions, can provide an alternative approach to solve the fair exchange problem. During the exchange protocol, the signatures generated by the two involved parties are ambiguous with respect to the identity of the signers before an extra piece of information (i.e. keystone) is released by one party. However, the party who controls the keystone has a degree of advantage over the other. It is failed to achieve full fairness.
In this thesis, we point out the design drawbacks of the previous literatures which suffer from the message substitute attack. Therefore, we propose an improved scheme that can satisfy the property of accountability. Moreover, an extended scheme to the identity-based concurrent signature with improved accountability is also proposed.
A new concept to achieve the full fairness of concurrent signature scheme is presented to provide an efficient conversion mechanism. Similar to the traditional fair exchange, a trusted third party who acts as an arbiter to solve the dispute between the two parties is involved in our new designed model.

中文摘要 i
Abstract ii
致謝 iv
CONTENTS vi
LIST OF FIGURES ix
LIST OF TABLES x
Chapter 1. Introduction 1
1.1 Overview 1
1.2 Motivation 2
1.3 Organization of This Thesis 3
Chapter 2. Related Works 4
2.1 Fair Exchange 4
2.1.1 Simultaneously Exchange 4
2.1.2 On-line Trusted Third Party 5
2.1.3 Off-line Trusted Third Party 6
2.1.4 Verifiable Encryption Message (VEM) 7
2.1.5 Verifiable Encryption Signature (VES) 7
2.1.6 Optimistic Fair Exchange 9
2.2 Concurrent Signature Schemes 9
2.2.1 Identity-based Concurrent Signature Schemes 10
2.3 Literature Review 11
2.3.1 Schnorr-like Signature Scheme 11
2.3.2 Perfect Concurrent Signature 12
2.3.3 Improved Perfect Concurrent Signature (iPCS) 13
2.3.4 Zhang and Wang’s Scheme 15
Chapter 3. Identity-based Concurrent Signature Scheme with Improved Accountability 19
3.1 Proposed Scheme 21
3.1.1 Concurrent Signature with Improved Accountability 21
3.2 Identity-based Concurrent Signature 25
3.2.1 Basic concept on Bilinear Pairings 25
3.2.2 Basic Algorithm 26
3.2.3 Proposed Protocol 28
3.2.4 Analysis and Discussion 31
Chapter 4. An Efficient Model of Enhancing Fairness Level in Concurrent Signatures by Using an Off-line TTP 34
4.1 Verifiable Encrypted Message (VEM) and Fair Exchange 36
4.1.1 Verifiable Encrypted Message (VEM) 36
4.1.2 Non-interactive Zero-knowledge proof 38
4.1.3 VEDL with a Designated Verifier 39
4.1.4 Proposed Scheme 40
4.2 Discussion 43
4.2.1 Security of the proposed scheme 43
4.2.2 Comparison 47
Chapter 5. Conclusions and Future Works 50
Reference 52

[1] M. Abe, M. Ohkubo and K. Suzuki, “1-out-of-n signatures from a variety of keys,” Advances in Cryptology – ASIACRYPT’02, Lecture Notes in Computer Science (LNCS), Vol. 2501, 2002, pp.415-432.

[2] N. Asokan, V. Shoup and M.Waidner, “Optimistic fair exchange of digital signature,” IEEE Journal on Selected Areas in Communications, Vol. 18, 2000, pp. 591-610.

[3] F. Bao, R. H. Deng, and W. Mao, “Effcient and practical fair exchange protocols with off-line TTP,” IEEE Symposium on Security and Privacy, 1998, pp. 77-85.

[4] F. Bao, G. Wang, J. Zhou, and H. Zhu, “Analysis and improvement of Micali’s fair contract signing protocol, ” 9th Australasian Conference on Information Security and Privacy(ACISP’04), Lecture Notes in Computer Science (LNCS), Vol. 3108, 2004, pp. 176-187.

[5] D. Boneh, B.Lynn and H. Shacham, “Short Signatures from the Weil Pairing,” Advances in Cryptology – ASIACRYPT’01, Lecture Notes in Computer Science (LNCS), Vol. 2248, 2001, pp. 514-532.

[6] L. Chen, C. Kudla, and K. Paterson, “Concurrent signature,” Advances in Cryptology – EUROCRYPT’04, Lecture Notes in Computer Science (LNCS), Vol. 3027, 2004, pp. 287-305.

[7] S.M. Chow, W.C. Lui, C.K. Hui and S. M. Yiu, “Identity Based Ring Signature: Why, How and What Next,” 2th European PKI Workshop on Research and Applications, Lecture Notes in Computer Science (LNCS), Vol. 3545, 2005, pp. 144-161.

[8] S. Chow and W. Susilo, “Generic construction of (identity-based) perfect concurrent signatures,” 7th International Conference on Information and Communications Security, Lecture Notes in Computer Science (LNCS), Vol. 3783, 2005, pp. 194-206.

[9] R. H. Deng, L. Gong, A. A. Lazar and W. Wang, “Practical protocols for certified electronic mail,” Journal of Network and Systems Management, Vol. 4, 1996, pp. 279-297.

[10] J. A. Garay, M. Jakobsson, and P. MacKenzie, “Abuse-free optimistic contract signing,” Advances in Cryptology – CRYPTO’99, Lecture Notes in Computer Science (LNCS), Vol. 1666, 1999, pp. 449-466.

[11] O. Goldreich, “A simple protocol for signing contracts,” Advances in Cryptology – CRYPTO’83, 1984, pp. 133-136.

[12] Z. Huang, K. Chen, and Y. Wang, “Analysis and Improvements of Two Identity-Based Perfect Concurrent Signature Schemes,” Informatica, Vol.18, 2007, pp. 375-394.

[13] X. Huang and L. Wang, “A Fair Concurrent Signature Scheme Based on Identity,” Second International Conference on High Performance Computing and Applications, Lecture Notes in Computer Science (LNCS), Vol. 5938, 2010, pp. 198-205.

[14] M. Jakobsson, K. Sako, and R. Impagliazzo, “Designated verifier proofs and their application,” Advances in Cryptology – EUROCRYPT’96, Lecture Notes in Computer Science (LNCS),Vol.1070, 1996, pp.143-154.

[15] A. Joux, “The Weil and Tate Pairings as Building Blocks for Public Key Cryptosystems,” 5th International Symposium on Algorithmic Number Theory Symposium, Lecture Notes in Computer Science (LNCS), Vol. 2369, 2002, pp. 20-32.

[16] Y. Li, D. He, and X. Lu, “Accountability of Perfect Concurrent Signature,” International Conference on Computer and Electrical Engineering, 2008, pp. 773-777.

[17] X. Liang, Z. Cao, R. Lu and L. Qin, “Efficient and secure protocol in fair document exchange,” Computer Standards & Interfaces, Vol. 30,2008, pp. 167–176.

[18] K. Nguyen, “Asymmetric Concurrent Signatures,” 7th International Conference on Information and Communications Security, Lecture Notes in Computer Science (LNCS), Vol. 3783, 2005, pp. 181-193.

[19] T. Okamoto and K. Ohta, “How to simultaneously exchange secrets by general as sumption,” 2nd ACM Conference on Computer and Communications Security, 1994, pp. 184-192.

[20] I. Ray, I. Ray and N. Natarajan, “An anonymous and failure resilient fair-exchange e-commerce protocol,” Decision Support Systems, Vol. 39, 2005, pp. 267-292.

[21] R. Rivest, A. Shamir, and Y. Tauman, “How to leak a secret,” Advances in Cryptology – ASIACRYPT’01, Lecture Notes in Computer Science (LNCS), Vol. 2248, 2001, pp. 552- 565.

[22] C.P. Schnorr, “Efficient signature generation by smart cards,” Journal of cryptology, Vol. 4, 1991, pp. 161-174.

[23] A. Shamir, “Identity based cryptosystems and signature schemes,” Advances in Cryptology – CRYPTO’84, Lecture Notes in Computer Science (LNCS), Vol. 196, 1984, pp. 47-53.

[24] Z. Shao, “Fair exchange protocol of signatures based on aggregate signatures,” Computer Communications, Vol. 31, 2008, pp. 1961-1969.

[25] Z. Shao, “Fair exchange protocol of Schnorr signatures with semi-trusted adjudicator,” Computers & Electrical Engineering, Vol. 36, 2010, pp. 1035-1045.

[26] M. Stadler, “Publicly verifiable secret sharing,” Advances in Cryptology - EUROCRYPTO’96, Lecture Notes in Computer Science (LNCS), Vol. 1070, 1996, pp. 190-199.

[27] W. Susilo and Y. Mu, “Tripartite concurrent signatures,” International Information Security Conference on Security and Privacy in the Age of Ubiquitous Computing, Vol. 181, 2005, pp. 425-441.

[28] W. Susilo, Y. Mu and F. Zhang, “Perfect concurrent signature schemes,” 6th International Conference on Information and Communications Security, Lecture Notes in Computer Science (LNCS), Vol. 3269, 2004, pp. 14-26.

[29] D. Tonien, W. Susilo and R. Safavi-Naini, “Multi-party Concurrent Signatures,” 9th International Conference on Information Security, Lecture Notes in Computer Science (LNCS), Vol. 4176, 2006, pp. 131-145.

[30] G. Wang, “An abuse-free fair contract signing protocol based on the RSA signature,” IEEE Transactions on Information Forensics and Security, Vol. 5, 2010, pp. 158-168.

[31] G. Wang, “Generic non-repudiation protocols supporting transparent off-line TTP,” Journal of Computer Security, Vol. 14, 2006, pp. 441-467.

[32] G. Wang, F. Bao and J. Zhou, “The fairness of perfect concurrent signatures,” 8th International Conference on Information and Communications Security, Lecture Notes in Computer Science (LNCS), Vol. 4307, 2006, pp. 435-451.

[33] C. H. Wang and C. H. Yin, “Practical Implementations of a Non-disclosure Fair Contract Signing Protocol,” IEICE Trans. on Fundamentals of Electronics, Communications and Computer Science, Vol. E89-A, 2006, pp. 297-309.

[34] Y. Zhang and X. Wang, “Message Substitute Attack on Concurrent Signatures Protocol and its Improvement,” International Symposium on Electronic Commerce and Security, 2008, pp. 497-501.

[35] J. Zhou and D. Gollmann, “A fair non-repudiation protocol,” IEEE Symposium on Security and Privacy, 1996, pp. 55-61.