研究成果

In cryptographic applications, there is often a need for protecting privacy of users besides integrity of message transmitted in a public channel. In information-theoretic (or unconditional) security setting, a model of GA-codes (Group Authentication codes) which can ensure both the integrity of the message and the anonymity for senders was proposed. In this model, there are multiple senders and a single receiver. And, one of the senders can generate an authenticated message anonymously. That is, the receiver can verify the validity of the authenticated message, but he cannot specify the sender of it. In GA-codes, it is assumed that both the sender and receiver are honest. However, it may be unnatural and an ideal assumption in several situations. In this paper, we remove the assumption and newly propose a formal definition (i.e., the model and security definitions) of GA²-codes (Group Authentication codes with Arbitration). In GA²-codes, it is assumed that the sender or the receiver can be dishonest and thus a dispute between them may occur. To resolve such a dispute, we introduce an honest arbiter in GA²-codes. This model can be considered as natural extension of that of both the GAcodes and the traditional A²-codes (Authentication codes with Arbitration). In addition, we propose a construction which meets our security definition of GA²-codes by using polynomials over finite fields. We also consider the case that the arbiter is not always honest and call this model GA³-codes (GA²-codes with protection against arbiter’s attack), which is further extension of GA²-codes and be naturally considered from a similar setting of the traditional A³-codes (A²-code with protection against arbiter’s attack).