A General Model of Multisignature Schemes with Message Flexibility, Order Flexibility, and Order Verifiability∗∗

SUMMARY Multisignature scheme realizes that plural users generate the signature on a message, and that the signature is verified. Various studies on multisignature have been proposed([2], [6], [11], [15], [18]). They are classified into two types: RSA([13])-based multisignature([6], [11]), and discrete logarithm problem(DLP) based multisig-nature([2], [15], [18]), all of which assume that a message is fixed beforehand. In a sense, these schemes do not have a feature of message flexibility. Furthermore all schemes which satisfy with order verifiability designate order of signers beforehand [2], [18]. Therefore these protocols have a feature of order verifiability but not order flexibility. For a practical purpose of circulating messages soundly through Internet, a multisignature scheme with message flexibility, order flexibility and order verifiability should be required. However, unfortunately, all previous multisignature do not realize these features. In this paper , we propose a general model of multisignature schemes with flexibility and verifiability. We also present two practical schemes based on DLP based message recover signa-ture([10]) and RSA signature([6]), respectively.