Abstract: A verification device stores verification information and first random information in a storage. The verification information depends upon contents of comparative information, and not upon an information volume of the comparative information. The verification device generates an authentication information generation factor using the first random information and transmits the factor to a proving device, which generates authentication information using the authentication information generation factor and held information and transmits the authentication information to the verification device. The authentication information depends upon contents of the authentication information generation factor and the held information, and not upon the information volume of the held information. A decision section of the verification device decides whether a predetermined relationship is established between the authentication information and the verification information and the first random information.

Abstract: A signature is generated by a scheme in which x denotes a secret key of a signature generating apparatus, mrec ? {0, 1}M denotes a recovery message, k denotes an arbitrary value, g denotes a generator of a cyclic group G of order q, R represents gk ? G, H1 represents a hash function H1: {0, 1}*?{0, 1}L, H2 represents a hash function H2: {0, 1}*?{0, 1}M that has a variable output length, H3 represents a hash function H3: {0, 1}*?Zq, r=H1(R, mrec)|mrec(+)H2(R, H1(R, mrec)), where (+) represents an exclusive-OR operator, t is defined for ?, which depends on r, as t=H3(?), s is defined as s=k?t·x ? Z, and a signature is ?=(r, s).

Abstract: A verification device stores verification information and first random information in a first storage section. The verification information depends upon the contents of comparative information and does not depend upon an information volume of the comparative information. Further, the verification device generates an authentication information generation factor by using the first random information and transmits the factor to a proving device. The proving device generates authentication information by using the authentication information generation factor and held information and transmits the authentication information to the verification device. The authentication information depends upon the contents of the authentication information generation factor and the held information and does not depend upon the information volume of the held information.