Publications-Theses
Article View/Open
Publication Export
-
題名 基於ECDSA之部分盲簽章及其在比特幣上應用之研究
A Study on Partially Blind ECDSA and Its Application on Bitcoin作者 黃泓遜
Huang, Hong-Xun貢獻者 左瑞麟
Tso, Ray-Lin
黃泓遜
Huang, Hong-Xun關鍵詞 ECDSA
部分盲簽章
比特幣
ECDSA
Partially Blind Signature
Bitcoin日期 2021 上傳時間 2-Mar-2021 14:34:04 (UTC+8) 摘要 盲簽章是一種能夠不讓簽名者知道自己所簽訊息的數位簽章。然而在實際應用中，簽名者往往需要記錄一些與簽名相關的額外訊息。為了解決這個問題，部分盲簽章的概念被提出。除了具有盲簽章的性質外，部分盲簽章可以讓簽名者能從所簽訊息中獲取到所需的相關的資訊。部分盲簽章在被提出至今有不少成果被提出，但這些成果都需要花費較多的運算時間，或是不易應用到實際應用中。除此之外，隨著數位貨幣（如：比特幣）的興起，愈來愈多消費者會購買數位貨幣。但目前的購買方式無法隱藏消費者的電子錢包位置，因此一些研究將重點放在基於橢圓曲線簽章算法（Elliptic Curve Digital Signature Algorithm，ECDSA）的盲簽章的研究上。然而由於盲簽章存在簽名者完全不知道所簽訊息的特性，使得這些基於ECDSA的盲簽章難以靈活地運用在數位貨幣系統上。因此，我們提出了提出了三個部分盲簽章。我們的第一個簽章是到目前為止的研究是效能最好的部分盲簽章。另外，為了與比特幣系統更加契合，我們提出了兩種改版之ECDSA及其在通用群模型（Generic Group Model）下的安全性證明，並基於此提出了兩種首次與現行比特幣系統相契合的ECDSA部分盲簽章。我們為上述的部分盲簽章都提供了安全性證明及效能分析。最後我們提出了我們的部分盲簽章在購買比特幣時的應用方式。
Blind signatures allow a user to obtain a signature without revealing message information to the signer. However, in many cases, the signer must record additional information relevant to the signature. Therefore, a partially blind signature was proposed to enable the signer to obtain some information from the signed message.\nAlthough many partially blind signature schemes have been proposed, they are time intensive and impractical.\nAdditionally, with the development of blockchain technology, users increasingly use Bitcoin for purchasing and trading with coin providers.\nSome studies have indicated that elliptic curve digital signature algorithm (ECDSA)-based blind signatures are compatible with Bitcoin because they prevent the linking of sensitive information due to the untamability of Bitcoin. However, these approaches are not sufficiently flexible because blind signatures do not allow the signer to obtain any information.\nIn this thesis, we proposed three partially blind signature schemes.\nTo the best of our knowledge, compared with other state-of-the-art schemes, our first scheme is the most practical partially blind signature. Additionally, to be more compatible with the current Bitcoin protocol, we introduced two variants of ECDSA with their security proofs under generic group model. Based on these two variants of ECDSA we proposed two partially blind signature schemes. Security proofs are provided to demonstrate that all proposed schemes have satisfactory unforgeability and blindness. At last we describe a application of bitcoin purchasing based on proposed schemes.參考文獻 [1] D. R. Brown, “Generic groups, collision resistance, and ECDSA,” Designs, Codes and\nCryptography, vol. 35, no. 1, pp. 119–152, 2005.\n[2] A. Lysyanskaya, “Signature schemes and applications to cryptographic protocol design,”\nPh.D. dissertation, Massachusetts Institute of Technology, 2002.\n[3] W. Diffie and M. Hellman, “New directions in cryptography,” IEEE transactions on\nInformation Theory, vol. 22, no. 6, pp. 644–654, 1976.\n[4] D. Chaum, A. Fiat, and M. Naor, “Untraceable electronic cash,” in Conference on the\nTheory and Application of Cryptography. Springer, 1988, pp. 319–327.\n[5] D. Chaum, “Blind signatures for untraceable payments,” in Advances in cryptology.\nSpringer, 1983, pp. 199–203.\n[6] M. Abe and E. Fujisaki, “How to date blind signatures,” in International Conference on\nthe Theory and Application of Cryptology and Information Security. Springer, 1996, pp.\n244–251.\n[7] M. Abe and T. Okamoto, “Provably secure partially blind signatures,” in Annual\nInternational Cryptology Conference. Springer, 2000, pp. 271–286.\n[8] S. Nakamoto, “Bitcoin: A peertopeer electronic cash system,” Manubot, Tech. Rep.,\n2019.\n[9] D. Johnson, A. Menezes, and S. Vanstone, “The elliptic curve digital signature algorithm\n(ECDSA),” International journal of information security, vol. 1, no. 1, pp. 36–63, 2001.\n[10] D. W. Kravitz, “Washington, DC: U.S. patent and trademark office,” U.S. Patent No. 5,\nvol. 231, p. 668, 1993.\n[11] 李鴻, “一種基於橢圓曲線的部分盲簽名方案,” 宿州學院學報, no. 1, pp. 89–91, 2004.\n[12] M. An, “Blind signatures with DSA/ECDSA?” Annual International Cryptology\nConference, pp. 271–286, 2004. [Online]. Available: http://lists.virus.org/cryptography0404/msg00149.html\n[13] W. Ladd, “Blind signatures for bitcoin transaction anonymity,” 2012.\n[14] X. Yi and K.Y. Lam, “A new blind ECDSA scheme for bitcoin transaction anonymity,”\nin Proceedings of the 2019 ACM Asia Conference on Computer and Communications\nSecurity, 2019, pp. 613–620.\n[15] D. Pointcheval and J. Stern, “Provably secure blind signature schemes,” in International\nConference on the Theory and Application of Cryptology and Information Security.\nSpringer, 1996, pp. 252–265.\n[16] M. Stadler, J.M. Piveteau, and J. Camenisch, “Fair blind signatures,” in International\nConference on the Theory and Applications of Cryptographic Techniques. Springer, 1995,\npp. 209–219.\n[17] Y. Frankel, Y. Tsiounis, and M. Yung, ““indirect discourse proofs”: Achieving efficient fair\noffline ecash,” in International Conference on the Theory and Application of Cryptology\nand Information Security. Springer, 1996, pp. 286–300.\n[18] Y. Xie, F. Zhang, X. Chen, and K. Kim, “Idbased distributed ’magic ink’ signature,” in\nInformation and Communications Security, Fifth International Conference, ICICS, 2003,\npp. 10–13.\n[19] A. Shamir, “Identitybased cryptosystems and signature schemes,” in Workshop on the\ntheory and application of cryptographic techniques. Springer, 1984, pp. 47–53.\n[20] A. J. Menezes, T. Okamoto, and S. A. Vanstone, “Reducing elliptic curve logarithms to\nlogarithms in a finite field,” iEEE Transactions on information Theory, vol. 39, no. 5, pp.\n1639–1646, 1993.\n[21] F. Zhang and K. Kim, “Idbased blind signature and ring signature from pairings,” in\nInternational Conference on the Theory and Application of Cryptology and Information\nSecurity. Springer, 2002, pp. 533–547.\n[22] S. Lal and A. K. Awasthi, “Proxy blind signature scheme,” Journal of Information Science\nand Engineering. Cryptology ePrint Archive, Report, vol. 72, 2003.\n[23] F. Zhang, R. SafaviNaini, and C.Y. Lin, “New proxy signature, proxy blind signature\nand proxy ring signature schemes from bilinear pairing.” IACR Cryptol. ePrint Arch., vol.\n2003, p. 104, 2003.\n[24] Z. Tan, Z. Liu, and C. Tang, “Digital proxy blind signature schemes based on DLP and\nECDLP,” MM Research Preprints, vol. 21, no. 7, pp. 212–217, 2002.\n[25] S. S. Chow, L. C. Hui, S.M. Yiu, and K. Chow, “Forwardsecure multisignature and blind\nsignature schemes,” Applied Mathematics and Computation, vol. 168, no. 2, pp. 895–908,\n2005.\n[26] D. N. Duc, J. H. Cheon, and K. Kim, “A forwardsecure blind signature scheme\nbased on the strong RSA assumption,” in International Conference on Information and\nCommunications Security. Springer, 2003, pp. 11–21.\n[27] L. Liu and Z. Cao, “Universal forgeability of a forwardsecure blind signature scheme\nproposed by Duc et al.” IACR Cryptol. ePrint Arch., vol. 2004, p. 262, 2004.\n[28] X. Chen, F. Zhang, and K. Kim, “IDbased multiproxy signature and blind multisignature\nfrom bilinear pairings,” Proceedings of KIISC, vol. 3, pp. 11–19, 2003.\n[29] A. Lysyanskaya and Z. Ramzan, “Group blind digital signatures: A scalable solution to\nelectronic cash,” in International Conference on Financial Cryptography. Springer, 1998,\npp. 184–197.\n[30] J. Kim, K. Kim, and C. Lee, “An efficient and provably secure threshold blind signature,”\nin International Conference on Information Security and Cryptology. Springer, 2001, pp.\n318–327.\n[31] D. L. Vo, F. Zhang, and K. Kim, “A new threshold blind signature scheme from pairings,”\n2003.\n[32] T. K. Chan, K. Fung, J. K. Liu, and V. K. Wei, “Blind spontaneous anonymous group\nsignatures for ad hoc groups,” in European Workshop on Security in Adhoc and Sensor\nNetworks. Springer, 2004, pp. 82–94.\n[33] D. Jena, S. K. Jena, and B. Majhi, “A novel untraceable blind signature based on elliptic\ncurve discrete logarithm problem,” 2007.\n[34] M. Nikooghadam and A. Zakerolhosseini, “An efficient blind signature scheme based on\nthe elliptic curve discrete logarithm problem,” ISeCureThe ISC International Journal of\nInformation Security, vol. 1, no. 2, pp. 125–131, 2009.\n[35] D. He, J. Chen, and R. Zhang, “An efficient identitybased blind signature scheme without\nbilinear pairings,” Computers & Electrical Engineering, vol. 37, no. 4, pp. 444–450, 2011.\n[36] H.Y. Chien, J.K. Jan, and Y.M. Tseng, “RSAbased partially blind signature with\nlow computation,” in Proceedings. Eighth International Conference on Parallel and\nDistributed Systems. ICPADS 2001. IEEE, 2001, pp. 385–389.\n[37] F. Zhang, R. SafaviNaini, and W. Susilo, “Efficient verifiable encrypted signature\nand partially blind signature from bilinear pairings,” in International Conference on\nCryptology in India. Springer, 2003, pp. 191–204.\n[38] G. Maitland and C. Boyd, “A provably secure restrictive partially blind signature scheme,”\nin International Workshop on Public Key Cryptography. Springer, 2002, pp. 99–114.\n[39] S. S. Chow, L. C. Hui, S.M. Yiu, and K. Chow, “Two improved partially blind signature\nschemes from bilinear pairings,” in Australasian Conference on Information Security and\nPrivacy. Springer, 2005, pp. 316–328.\n[40] T. Okamoto, “Efficient blind and partially blind signatures without random oracles,” in\nTheory of Cryptography Conference. Springer, 2006, pp. 80–99.\n[41] C.P. Schnorr, “Efficient identification and signatures for smart cards,” in Conference on\nthe Theory and Application of Cryptology. Springer, 1989, pp. 239–252.\n[42] V. S. Miller, “Use of elliptic curves in cryptography,” in Conference on the theory and\napplication of cryptographic techniques. Springer, 1985, pp. 417–426.\n[43] D. Pointcheval and J. Stern, “Provably secure blind signature schemes,” in International\nConference on the Theory and Application of Cryptology and Information Security.\nSpringer, 1996, pp. 252–265.\n[44] ——, “Security arguments for digital signatures and blind signatures,” Journal of\ncryptology, vol. 13, no. 3, pp. 361–396, 2000.\n[45] J. H. Silverman and J. Suzuki, “Elliptic curve discrete logarithms and the index calculus,”\nin International Conference on the Theory and Application of Cryptology and Information\nSecurity. Springer, 1998, pp. 110–125.\n[46] V. I. Nechaev, “Complexity of a determinate algorithm for the discrete logarithm,”\nMathematical Notes, vol. 55, no. 2, pp. 165–172, 1994.\n[47] V. Shoup, “Lower bounds for discrete logarithms and related problems,” in International\nConference on the Theory and Applications of Cryptographic Techniques. Springer, 1997,\npp. 256–266.\n[48] S. Goldwasser, S. Micali, and C. Rackoff, “The knowledge complexity of interactive proof\nsystems,” SIAM Journal on computing, vol. 18, no. 1, pp. 186–208, 1989.\n[49] A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification\nand signature problems,” in Conference on the theory and application of cryptographic\ntechniques. Springer, 1986, pp. 186–194.\n[50] O. Blazy, D. Pointcheval, and D. Vergnaud, “Compact roundoptimal partiallyblind\nsignatures,” in International Conference on Security and Cryptography for Networks.\nSpringer, 2012, pp. 95–112.\n[51] W.J. Tsaur, J.H. Tsao, and Y.H. Tsao, “An efficient and secure ECCbased partially\nblind signature scheme with multiple banks issuing ecash payment applications,” in\nProceedings of the International Conference on eLearning, eBusiness, Enterprise\nInformation Systems, and eGovernment (EEE). The Steering Committee of The World\nCongress in Computer Science, Computer …, 2018, pp. 94–100.\n[52] S. H. Islam and G. Biswas, “A pairingfree identitybased authenticated group key\nagreement protocol for imbalanced mobile networks,” Annals of télécommunicationsannales des telecommunications, vol. 67, no. 1112, pp. 547–558, 2012.\n[53] ——, “Provably secure and pairingfree certificateless digital signature scheme using\nelliptic curve cryptography,” International Journal of Computer Mathematics, vol. 90,\nno. 11, pp. 2244–2258, 2013.\n[54] N. Tahat, E. Ismail, and A. Alomari, “Partially blind signature scheme based on chaotic\nmaps and factoring problems,” Italian Journal of Pure and Applied Mathematics, p. 165,\n2018.\n[55] N. Gura, A. Patel, A. Wander, H. Eberle, and S. C. Shantz, “Comparing elliptic curve\ncryptography and RSA on 8bit CPUs,” in International workshop on cryptographic\nhardware and embedded systems. Springer, 2004, pp. 119–132.\n[56] E. B. Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza,\n“Zerocash: Decentralized anonymous payments from bitcoin,” in 2014 IEEE Symposium\non Security and Privacy. IEEE, 2014, pp. 459–474.\n[57] G. Wood et al., “Ethereum: A secure decentralised generalised transaction ledger,”\nEthereum project yellow paper, vol. 151, no. 2014, pp. 1–32, 2014. 描述 碩士
國立政治大學
資訊科學系
107753047資料來源 http://thesis.lib.nccu.edu.tw/record/#G0107753047 資料類型 thesis dc.contributor.advisor 左瑞麟 zh_TW dc.contributor.advisor Tso, Ray-Lin en_US dc.contributor.author (Authors) 黃泓遜 zh_TW dc.contributor.author (Authors) Huang, Hong-Xun en_US dc.creator (作者) 黃泓遜 zh_TW dc.creator (作者) Huang, Hong-Xun en_US dc.date (日期) 2021 en_US dc.date.accessioned 2-Mar-2021 14:34:04 (UTC+8) - dc.date.available 2-Mar-2021 14:34:04 (UTC+8) - dc.date.issued (上傳時間) 2-Mar-2021 14:34:04 (UTC+8) - dc.identifier (Other Identifiers) G0107753047 en_US dc.identifier.uri (URI) https://ah.lib.nccu.edu.tw/item?item_id=153116 - dc.description (描述) 碩士 zh_TW dc.description (描述) 國立政治大學 zh_TW dc.description (描述) 資訊科學系 zh_TW dc.description (描述) 107753047 zh_TW dc.description.abstract (摘要) 盲簽章是一種能夠不讓簽名者知道自己所簽訊息的數位簽章。然而在實際應用中，簽名者往往需要記錄一些與簽名相關的額外訊息。為了解決這個問題，部分盲簽章的概念被提出。除了具有盲簽章的性質外，部分盲簽章可以讓簽名者能從所簽訊息中獲取到所需的相關的資訊。部分盲簽章在被提出至今有不少成果被提出，但這些成果都需要花費較多的運算時間，或是不易應用到實際應用中。除此之外，隨著數位貨幣（如：比特幣）的興起，愈來愈多消費者會購買數位貨幣。但目前的購買方式無法隱藏消費者的電子錢包位置，因此一些研究將重點放在基於橢圓曲線簽章算法（Elliptic Curve Digital Signature Algorithm，ECDSA）的盲簽章的研究上。然而由於盲簽章存在簽名者完全不知道所簽訊息的特性，使得這些基於ECDSA的盲簽章難以靈活地運用在數位貨幣系統上。因此，我們提出了提出了三個部分盲簽章。我們的第一個簽章是到目前為止的研究是效能最好的部分盲簽章。另外，為了與比特幣系統更加契合，我們提出了兩種改版之ECDSA及其在通用群模型（Generic Group Model）下的安全性證明，並基於此提出了兩種首次與現行比特幣系統相契合的ECDSA部分盲簽章。我們為上述的部分盲簽章都提供了安全性證明及效能分析。最後我們提出了我們的部分盲簽章在購買比特幣時的應用方式。 zh_TW dc.description.abstract (摘要) Blind signatures allow a user to obtain a signature without revealing message information to the signer. However, in many cases, the signer must record additional information relevant to the signature. Therefore, a partially blind signature was proposed to enable the signer to obtain some information from the signed message.\nAlthough many partially blind signature schemes have been proposed, they are time intensive and impractical.\nAdditionally, with the development of blockchain technology, users increasingly use Bitcoin for purchasing and trading with coin providers.\nSome studies have indicated that elliptic curve digital signature algorithm (ECDSA)-based blind signatures are compatible with Bitcoin because they prevent the linking of sensitive information due to the untamability of Bitcoin. However, these approaches are not sufficiently flexible because blind signatures do not allow the signer to obtain any information.\nIn this thesis, we proposed three partially blind signature schemes.\nTo the best of our knowledge, compared with other state-of-the-art schemes, our first scheme is the most practical partially blind signature. Additionally, to be more compatible with the current Bitcoin protocol, we introduced two variants of ECDSA with their security proofs under generic group model. Based on these two variants of ECDSA we proposed two partially blind signature schemes. Security proofs are provided to demonstrate that all proposed schemes have satisfactory unforgeability and blindness. At last we describe a application of bitcoin purchasing based on proposed schemes. en_US dc.description.tableofcontents 致謝 i\n摘要 ii\nAbstract iii\n1 Introduction 1\n1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1\n1.2 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3\n1.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4\n1.4 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5\n2 Related Work 6\n3 Background 9\n3.1 Digital Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9\n3.2 Schnorr Blind Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10\n3.3 Elliptic Curve Discrete Logarithm Problem . . . . . . . . . . . . . . . . . . . 11\n3.4 ECDSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11\n3.5 Yi’s Blind ECDSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12\n4 Preliminary 15\n4.1 Unforgeability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15\n4.1.1 Existential Forger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15\n4.1.2 Selective Forger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16\n4.2 Property of Hash Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16\n4.2.1 OneWayness (PreimageResistance) . . . . . . . . . . . . . . . . . . 16\n4.2.2 SecondPreimageResistance . . . . . . . . . . . . . . . . . . . . . . . 16\n4.2.3 ZeroFinderResistance . . . . . . . . . . . . . . . . . . . . . . . . . . 16\n5 Generic Group Model 18\n6 VariantECDSA 22\n6.1 Definition of VariantECDSA . . . . . . . . . . . . . . . . . . . . . . . . . . . 22\n6.2 Unforgeability of variantECDSA . . . . . . . . . . . . . . . . . . . . . . . . 23\n6.2.1 Existential Unforgeability Against NoMessage Attacks . . . . . . . . 23\n6.2.2 Selective Unforgeability Against Adaptive ChosenMessage Attacks . . 23\n7 VariantECDSA1 25\n7.1 Scheme of VariantECDSA1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 25\n7.2 Generic Group Oracle for VariantECDSA1 . . . . . . . . . . . . . . . . . . . 25\n7.3 Security Proof of VariantECDSA1 . . . . . . . . . . . . . . . . . . . . . . . 27\n8 VariantECDSA2 29\n8.1 Scheme of VariantECDSA2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 29\n8.2 Generic Group Oracle for VariantECDSA2 . . . . . . . . . . . . . . . . . . . 29\n8.3 Security Proof of VariantECDSA2 . . . . . . . . . . . . . . . . . . . . . . . 31\n9 Partially Blind Signature 33\n9.1 Definition of Partially Blind Signature . . . . . . . . . . . . . . . . . . . . . . 33\n9.2 Security Definitions of Partially Blind Signature . . . . . . . . . . . . . . . . . 34\n9.2.1 Unforgeability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34\n9.2.2 Partial Blindness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34\n10 The Proposed Scheme 1 36\n11 The Proposed Scheme 2 38\n12 The Proposed Scheme 3 42\n13 Security Analysis 46\n14 Efficiency Analysis 51\n15 Performance 55\n16 Discussion 56\n17 Application of the Proposed Schemes 58\n17.1 Application on Bitcoin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58\n17.2 Further Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61\n17.2.1 Fixed Denominations . . . . . . . . . . . . . . . . . . . . . . . . . . . 61\n17.2.2 Different Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61\n17.2.3 Amount of Daily Trades . . . . . . . . . . . . . . . . . . . . . . . . . 62\n17.2.4 The Tradeoff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62\n17.3 Applications beyond Bitcoin . . . . . . . . . . . . . . . . . . . . . . . . . . . 63\n18 Conclusion 64\nBibliography 65 zh_TW dc.format.extent 683443 bytes - dc.format.mimetype application/pdf - dc.source.uri (資料來源) http://thesis.lib.nccu.edu.tw/record/#G0107753047 en_US dc.subject (關鍵詞) ECDSA zh_TW dc.subject (關鍵詞) 部分盲簽章 zh_TW dc.subject (關鍵詞) 比特幣 zh_TW dc.subject (關鍵詞) ECDSA en_US dc.subject (關鍵詞) Partially Blind Signature en_US dc.subject (關鍵詞) Bitcoin en_US dc.title (題名) 基於ECDSA之部分盲簽章及其在比特幣上應用之研究 zh_TW dc.title (題名) A Study on Partially Blind ECDSA and Its Application on Bitcoin en_US dc.type (資料類型) thesis en_US dc.relation.reference (參考文獻) [1] D. R. Brown, “Generic groups, collision resistance, and ECDSA,” Designs, Codes and\nCryptography, vol. 35, no. 1, pp. 119–152, 2005.\n[2] A. Lysyanskaya, “Signature schemes and applications to cryptographic protocol design,”\nPh.D. dissertation, Massachusetts Institute of Technology, 2002.\n[3] W. Diffie and M. Hellman, “New directions in cryptography,” IEEE transactions on\nInformation Theory, vol. 22, no. 6, pp. 644–654, 1976.\n[4] D. Chaum, A. Fiat, and M. Naor, “Untraceable electronic cash,” in Conference on the\nTheory and Application of Cryptography. Springer, 1988, pp. 319–327.\n[5] D. Chaum, “Blind signatures for untraceable payments,” in Advances in cryptology.\nSpringer, 1983, pp. 199–203.\n[6] M. Abe and E. Fujisaki, “How to date blind signatures,” in International Conference on\nthe Theory and Application of Cryptology and Information Security. Springer, 1996, pp.\n244–251.\n[7] M. Abe and T. Okamoto, “Provably secure partially blind signatures,” in Annual\nInternational Cryptology Conference. Springer, 2000, pp. 271–286.\n[8] S. Nakamoto, “Bitcoin: A peertopeer electronic cash system,” Manubot, Tech. Rep.,\n2019.\n[9] D. Johnson, A. Menezes, and S. Vanstone, “The elliptic curve digital signature algorithm\n(ECDSA),” International journal of information security, vol. 1, no. 1, pp. 36–63, 2001.\n[10] D. W. Kravitz, “Washington, DC: U.S. patent and trademark office,” U.S. Patent No. 5,\nvol. 231, p. 668, 1993.\n[11] 李鴻, “一種基於橢圓曲線的部分盲簽名方案,” 宿州學院學報, no. 1, pp. 89–91, 2004.\n[12] M. An, “Blind signatures with DSA/ECDSA?” Annual International Cryptology\nConference, pp. 271–286, 2004. [Online]. Available: http://lists.virus.org/cryptography0404/msg00149.html\n[13] W. Ladd, “Blind signatures for bitcoin transaction anonymity,” 2012.\n[14] X. Yi and K.Y. Lam, “A new blind ECDSA scheme for bitcoin transaction anonymity,”\nin Proceedings of the 2019 ACM Asia Conference on Computer and Communications\nSecurity, 2019, pp. 613–620.\n[15] D. Pointcheval and J. Stern, “Provably secure blind signature schemes,” in International\nConference on the Theory and Application of Cryptology and Information Security.\nSpringer, 1996, pp. 252–265.\n[16] M. Stadler, J.M. Piveteau, and J. Camenisch, “Fair blind signatures,” in International\nConference on the Theory and Applications of Cryptographic Techniques. Springer, 1995,\npp. 209–219.\n[17] Y. Frankel, Y. Tsiounis, and M. Yung, ““indirect discourse proofs”: Achieving efficient fair\noffline ecash,” in International Conference on the Theory and Application of Cryptology\nand Information Security. Springer, 1996, pp. 286–300.\n[18] Y. Xie, F. Zhang, X. Chen, and K. Kim, “Idbased distributed ’magic ink’ signature,” in\nInformation and Communications Security, Fifth International Conference, ICICS, 2003,\npp. 10–13.\n[19] A. Shamir, “Identitybased cryptosystems and signature schemes,” in Workshop on the\ntheory and application of cryptographic techniques. Springer, 1984, pp. 47–53.\n[20] A. J. Menezes, T. Okamoto, and S. A. Vanstone, “Reducing elliptic curve logarithms to\nlogarithms in a finite field,” iEEE Transactions on information Theory, vol. 39, no. 5, pp.\n1639–1646, 1993.\n[21] F. Zhang and K. Kim, “Idbased blind signature and ring signature from pairings,” in\nInternational Conference on the Theory and Application of Cryptology and Information\nSecurity. Springer, 2002, pp. 533–547.\n[22] S. Lal and A. K. Awasthi, “Proxy blind signature scheme,” Journal of Information Science\nand Engineering. Cryptology ePrint Archive, Report, vol. 72, 2003.\n[23] F. Zhang, R. SafaviNaini, and C.Y. Lin, “New proxy signature, proxy blind signature\nand proxy ring signature schemes from bilinear pairing.” IACR Cryptol. ePrint Arch., vol.\n2003, p. 104, 2003.\n[24] Z. Tan, Z. Liu, and C. Tang, “Digital proxy blind signature schemes based on DLP and\nECDLP,” MM Research Preprints, vol. 21, no. 7, pp. 212–217, 2002.\n[25] S. S. Chow, L. C. Hui, S.M. Yiu, and K. Chow, “Forwardsecure multisignature and blind\nsignature schemes,” Applied Mathematics and Computation, vol. 168, no. 2, pp. 895–908,\n2005.\n[26] D. N. Duc, J. H. Cheon, and K. Kim, “A forwardsecure blind signature scheme\nbased on the strong RSA assumption,” in International Conference on Information and\nCommunications Security. Springer, 2003, pp. 11–21.\n[27] L. Liu and Z. Cao, “Universal forgeability of a forwardsecure blind signature scheme\nproposed by Duc et al.” IACR Cryptol. ePrint Arch., vol. 2004, p. 262, 2004.\n[28] X. Chen, F. Zhang, and K. Kim, “IDbased multiproxy signature and blind multisignature\nfrom bilinear pairings,” Proceedings of KIISC, vol. 3, pp. 11–19, 2003.\n[29] A. Lysyanskaya and Z. Ramzan, “Group blind digital signatures: A scalable solution to\nelectronic cash,” in International Conference on Financial Cryptography. Springer, 1998,\npp. 184–197.\n[30] J. Kim, K. Kim, and C. Lee, “An efficient and provably secure threshold blind signature,”\nin International Conference on Information Security and Cryptology. Springer, 2001, pp.\n318–327.\n[31] D. L. Vo, F. Zhang, and K. Kim, “A new threshold blind signature scheme from pairings,”\n2003.\n[32] T. K. Chan, K. Fung, J. K. Liu, and V. K. Wei, “Blind spontaneous anonymous group\nsignatures for ad hoc groups,” in European Workshop on Security in Adhoc and Sensor\nNetworks. Springer, 2004, pp. 82–94.\n[33] D. Jena, S. K. Jena, and B. Majhi, “A novel untraceable blind signature based on elliptic\ncurve discrete logarithm problem,” 2007.\n[34] M. Nikooghadam and A. Zakerolhosseini, “An efficient blind signature scheme based on\nthe elliptic curve discrete logarithm problem,” ISeCureThe ISC International Journal of\nInformation Security, vol. 1, no. 2, pp. 125–131, 2009.\n[35] D. He, J. Chen, and R. Zhang, “An efficient identitybased blind signature scheme without\nbilinear pairings,” Computers & Electrical Engineering, vol. 37, no. 4, pp. 444–450, 2011.\n[36] H.Y. Chien, J.K. Jan, and Y.M. Tseng, “RSAbased partially blind signature with\nlow computation,” in Proceedings. Eighth International Conference on Parallel and\nDistributed Systems. ICPADS 2001. IEEE, 2001, pp. 385–389.\n[37] F. Zhang, R. SafaviNaini, and W. Susilo, “Efficient verifiable encrypted signature\nand partially blind signature from bilinear pairings,” in International Conference on\nCryptology in India. Springer, 2003, pp. 191–204.\n[38] G. Maitland and C. Boyd, “A provably secure restrictive partially blind signature scheme,”\nin International Workshop on Public Key Cryptography. Springer, 2002, pp. 99–114.\n[39] S. S. Chow, L. C. Hui, S.M. Yiu, and K. Chow, “Two improved partially blind signature\nschemes from bilinear pairings,” in Australasian Conference on Information Security and\nPrivacy. Springer, 2005, pp. 316–328.\n[40] T. Okamoto, “Efficient blind and partially blind signatures without random oracles,” in\nTheory of Cryptography Conference. Springer, 2006, pp. 80–99.\n[41] C.P. Schnorr, “Efficient identification and signatures for smart cards,” in Conference on\nthe Theory and Application of Cryptology. Springer, 1989, pp. 239–252.\n[42] V. S. Miller, “Use of elliptic curves in cryptography,” in Conference on the theory and\napplication of cryptographic techniques. Springer, 1985, pp. 417–426.\n[43] D. Pointcheval and J. Stern, “Provably secure blind signature schemes,” in International\nConference on the Theory and Application of Cryptology and Information Security.\nSpringer, 1996, pp. 252–265.\n[44] ——, “Security arguments for digital signatures and blind signatures,” Journal of\ncryptology, vol. 13, no. 3, pp. 361–396, 2000.\n[45] J. H. Silverman and J. Suzuki, “Elliptic curve discrete logarithms and the index calculus,”\nin International Conference on the Theory and Application of Cryptology and Information\nSecurity. Springer, 1998, pp. 110–125.\n[46] V. I. Nechaev, “Complexity of a determinate algorithm for the discrete logarithm,”\nMathematical Notes, vol. 55, no. 2, pp. 165–172, 1994.\n[47] V. Shoup, “Lower bounds for discrete logarithms and related problems,” in International\nConference on the Theory and Applications of Cryptographic Techniques. Springer, 1997,\npp. 256–266.\n[48] S. Goldwasser, S. Micali, and C. Rackoff, “The knowledge complexity of interactive proof\nsystems,” SIAM Journal on computing, vol. 18, no. 1, pp. 186–208, 1989.\n[49] A. Fiat and A. Shamir, “How to prove yourself: Practical solutions to identification\nand signature problems,” in Conference on the theory and application of cryptographic\ntechniques. Springer, 1986, pp. 186–194.\n[50] O. Blazy, D. Pointcheval, and D. Vergnaud, “Compact roundoptimal partiallyblind\nsignatures,” in International Conference on Security and Cryptography for Networks.\nSpringer, 2012, pp. 95–112.\n[51] W.J. Tsaur, J.H. Tsao, and Y.H. Tsao, “An efficient and secure ECCbased partially\nblind signature scheme with multiple banks issuing ecash payment applications,” in\nProceedings of the International Conference on eLearning, eBusiness, Enterprise\nInformation Systems, and eGovernment (EEE). The Steering Committee of The World\nCongress in Computer Science, Computer …, 2018, pp. 94–100.\n[52] S. H. Islam and G. Biswas, “A pairingfree identitybased authenticated group key\nagreement protocol for imbalanced mobile networks,” Annals of télécommunicationsannales des telecommunications, vol. 67, no. 1112, pp. 547–558, 2012.\n[53] ——, “Provably secure and pairingfree certificateless digital signature scheme using\nelliptic curve cryptography,” International Journal of Computer Mathematics, vol. 90,\nno. 11, pp. 2244–2258, 2013.\n[54] N. Tahat, E. Ismail, and A. Alomari, “Partially blind signature scheme based on chaotic\nmaps and factoring problems,” Italian Journal of Pure and Applied Mathematics, p. 165,\n2018.\n[55] N. Gura, A. Patel, A. Wander, H. Eberle, and S. C. Shantz, “Comparing elliptic curve\ncryptography and RSA on 8bit CPUs,” in International workshop on cryptographic\nhardware and embedded systems. Springer, 2004, pp. 119–132.\n[56] E. B. Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza,\n“Zerocash: Decentralized anonymous payments from bitcoin,” in 2014 IEEE Symposium\non Security and Privacy. IEEE, 2014, pp. 459–474.\n[57] G. Wood et al., “Ethereum: A secure decentralised generalised transaction ledger,”\nEthereum project yellow paper, vol. 151, no. 2014, pp. 1–32, 2014. zh_TW dc.identifier.doi (DOI) 10.6814/NCCU202100361 en_US
