EP0766894A1

EP0766894A1 - Process for generating electronic signatures, in particular for smart cards

Info

Publication number: EP0766894A1
Application number: EP96915071A
Authority: EP
Inventors: David Naccache
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Gemplus SA
Priority date: 1995-04-20
Filing date: 1996-04-22
Publication date: 1997-04-09
Also published as: US5910989A; WO1996033567A1; FR2733379B1; JP3433258B2; JPH10506727A; FR2733379A1

Abstract

The invention concerns processes for generating digital signatures for electronic messages. The invention proposes modifying signature-generating algorithms, such as DSAs ('Digital Signature Algorithms), in order to enable smart cards with reduced calculation and storage resources to produce digital signatures with a high degree of security in spite of their reduced resources. The signature-checking terminal sends a random number a and measures the time taken by the card to send back a signal s using this random number. If the time is greater than a given duration, the signature is rejected even if the check of its authenticity is positive. In addition, part of the signature (the part which does not use the secret card key but only the public algorithm parameters) is precalculated and stored in the card in the form of signature portions produced by a compression function such that they are short. Only the second part of the signature has to be calculated by the card. According to the invention, the calculations to be made are simple so that the card does not require extensive calculation and memory resources.

Description

METHOD FOR GENERATING ELECTRONIC SIGNATURES, ESPECIALLY FOR CHIP CARDS

The invention relates to a method for generating digital signatures of electronic messages.

The method is particularly applicable to the signing of messages by portable devices of the microprocessor chip card type.

For example, this involves signing messages sent by the card to a reading terminal or to a central authority; or again, it involves making a transaction (electronic check) and signing this transaction so that it can be authenticated first by the reading terminal in which the transaction is made, then by a central authority which manages the transactions.

The process which will be described is related to the algorithms for generating digital signatures which have been published in recent years, in particular by the US National Institute of Standards and Technology, such as the DSA algorithm (Digital Signature Algorithm) described in the application for US patent 07/738431 and announced on August 30, 1991 in the Federal Register kept by this Institute, pages 42980-42982.

The object of the invention is to modify known methods, in particular to make them adaptable to microprocessor cards which do not have sufficient hardware resources (processor, memories) to quickly carry out mathematical operations on large numbers. Known algorithms, notably the DSA algorithm, use large numbers to generate the signatures with a sufficient degree of security. To better understand the invention, we will first recall what the DSA algorithm is.

A DSA signature consists of a pair {r, s} of large numbers represented in the computers by long strings of binary digits (160 digits). The digital signature is calculated using a series of calculation rules, defined by the algorithm, and a set of parameters used in these calculations. The signature allows both to certify the identity of the signatory (because it involves a secret key specific to the signatory) and the integrity of the signed message (because it involves the message itself). The algorithm allows on the one hand to generate signatures, and on the other hand to verify signatures.

DSA signature generation involves a secret key. The verification involves a public key which corresponds to the secret key but is not identical to it. Each user has a pair of keys (secret, public). Public keys can be known to everyone, while secret keys are never revealed. Anyone has the ability to verify a user's signature using their public key, but only the owner of the secret key can generate a signature corresponding to the key pair.

The parameters of the DSA algorithm are as follows:

- a prime number p such that 2 ^L_1 <p <2 ^L for L between 512 and 1024 (limits included), and

L = 64a for any integer a;

- a prime number q such that 2 ¹⁵⁹ <q <2 ¹⁶⁰ and p-1 is a multiple of q;

- a number g, of order q odulo p, such that: g = ^ P ^-1 '' ^ modulo p, where h is an integer satisfying

1 <h <p-1 and g> 1;

- a number x generated randomly or pseudo-randomly (this is the secret key, frozen for a given user);

- a number y defined by the relation y = g ^x modulo p; (this is the public key linked to the secret key); the modular operations defined below, modulo p or modulo q will be designated by mod p or mod q respectively;

- a number k generated randomly or pseudo-randomly, such as 0 <k <q.

The integers p, q, and g are system parameters that can be published and / or shared by a group of users. The keys, secret and public, of a signatory are respectively x and y. The parameter k, random, must be regenerated for each new signature. The parameters x and k are used for the generation of signatures and must be kept secret.

In order to sign a message m (which will generally be a hashed value from an initial file M), the signatory calculates the signature {r, s} by:

If r = (g mod p) mod q, and s = (m + xr) / k mod q

(where division by k means modulo q, i.e. 1 / k is the number k 'such that kk' = 1 mod q; for example if q = 5 and k = 3, then 1 / k = 2 because 3x2 = 6, i.e. 1 mod 5). After testing that r and s are different from zero, the signature {r, s} is sent to the verifier. The verifier is generally the terminal in which the smart card which sends the message m and the signature {r, s} is inserted. The verifier, who knows p, q, g (linked to the application), y (linked to the user), and m (the message he received from the card), calculates: a. = (1 / s) mod q b. ul = mw mod q c. u2 = rw mod q d. v = [g ^ul .y ^u2 mod p] mod q

Now this value [g ^ul .y ^u2 mod p] mod q is precisely equal to r if its the value (m + xr) / s mod q. Consequently, the terminal receives r and s and verifies that v is indeed equal to r to accept the signature, or to reject it otherwise.

In what follows, the terms signatory or signatory body, or proving device, or smart card will be used interchangeably to designate the device which emits the signature and which will generally be a smart card. And we will use the term verifier, or verifier body or verifier device, or verifier terminal, or even control authority, to designate the device that receives the signature and verifies it to accept or reject a transaction or a message. The simplest application of the invention is the issuance of a signature by a smart card to a reading terminal in which the card is inserted, the terminal performing the verification function and being connected or not to an authority central management.

One of the aims of the present invention is to increase the security of generation and verification of digital electronic signatures, by minimizing the computing and memory means which must be present in the smart card to produce the signatures.

It would be particularly desirable to be able to use inexpensive 8-bit microprocessors in the card, despite the fact that they cannot easily process large numbers, rather than more powerful and expensive microprocessors. But this should not be done at the expense of security.

According to a first important aspect, the invention proposes that the verification by a verifier (terminal) of the signature sent by the signatory (card) uses a step of timing the duration elapsing between an instant when a datum (in principle random ) is sent by the verifier to the signatory (card) and the moment when the signature (using this random data) returns to the verifier. If the elapsed time is too long, this means that the signature calculation processing by the signatory is abnormal and the signature is rejected even if its authenticity is confirmed by the verifier.

Indirectly, this solution allows, as we will see, to keep the same signature security while using low hardware resources (computing power and memories) in the smart card. Low resources lead to the need to modify the procedures for generating and verifying signatures, but this is to the detriment of security. The timing step according to the invention restores a sufficient level of security. This solution will be described in detail from algorithms derived from the DSA algorithm mentioned above, but it will be understood that this first aspect of the invention is applicable with other algorithms even if they are very different from the DSA algorithm. In summary, the first aspect of the invention consists in an electronic signature process, comprising the generation of a digital signature by a signatory body which calculates this signature using random data sent by a verifier body, and the verification of the signature by verifier which verifies whether a mathematical condition involving the signature sent and the random datum is fulfilled, this method being characterized in that the verification of the signature sent by the signatory to the verifier also uses a step of timing the elapsed time between an instant when the random data is sent by the verifier to the signatory and the instant when the signature using this data returns to the verifier after calculation by the signatory, the signature being accepted if the elapsed time is less than a determined threshold and if the mathematical condition is verified.

Preferably, the algorithm used is of the type in which the generation of signature produces two values {r, s}, s being calculated from r and a secret key x, and in which the verification of the signature {r , s} consists in the verification of an equality v = f (r, s) = r between r and a function f of r and s. It is then provided according to the invention that the function f is chosen to be sufficiently complex so that the duration of the search for a value s from this equality in the absence of knowledge of the secret key is much greater, even if it is done by a powerful computer, at the time of calculation and transmission by the card of the value s from r and the secret key, and this even if the card uses a not very powerful microprocessor (microprocessor of 8 bits at 20 MHz for example ). Thus, by correctly choosing the time condition introduced by the timing, it is ensured that this condition cannot be fulfilled in the absence of knowledge of the secret key and in particular cannot be fulfilled by a search for s from of equality r = f (r, s). In practice, the function f (r, s) also involves a message m to be signed, so that it can be noted f (r, s, m).

Preferably, the function f comprises mathematical calculations followed by a complex hash function. The first part of signature r is established by other mathematical calculations, followed by the same complex hash function.

This complex hash function is preferably, as will be explained below, a complex compression function resulting in a reduction in the length of the bit strings obtained by the mathematical calculations carried out.

It is recalled that a hash function is a logical processing function of binary strings, which makes it possible to obtain a character string of determined length from another character string of the same length or of different length. A complex hash function can be obtained by successive hashes and / or mathematical calculations involving the results of several hashes. Compression can be obtained at the end by taking as a result a modular value, modulo 2 ^e , where e is the length of the chain finally desired. Furthermore, according to another important aspect of the invention, a new solution is proposed for processing smaller numbers in the smart card, in digital signature algorithms of the kind in which the signature involves two numbers, r and s , only the number s involving the secret key of the card and the message to be sent.

This second aspect of the invention is an improvement to a method for generating signatures which has been described in French patent application 93 14466. In this patent application, it is explained that in an algorithm of this kind (DSA is an example), the number r depends neither on the message m sent by the card, nor on the secret key contained in the card. It only depends on fixed numbers for the application considered, and on random numbers; for example, these numbers are g, p, q and k in the DSA algorithm. It is therefore useless to have r calculated by the card, because this consumes a significant computation time. Rather, a series of n possible r values, denoted r ^, is calculated in advance by a certified central authority, i being an index ranging from 1 to n. We store the values r ^ in the map. Each time the card is used again, one of the values r ^ is used (and this value will no longer be used the following times). At the time of signing, the card only calculates the other signature part s, from a value r ^, from the secret key x, from the message m, and the message m and the pair {r ^ are sent to the verifier. , s} representing the signature which the verifier can then verify in the manner provided by the algorithm considered. The numbers r ^ are precalculated certificates, also called "signature coupons". They are only part of the signature to be sent, and they can be prepared and stored in advance on the card. The index i represents the coupon index used during a given signature.

But one of the difficulties lies in the great length of these coupons (160 bits in the DSA algorithm presented above). They consume a significant amount of non-volatile memory on the card; you cannot save a large number of them in the card if you have a limited size of non-volatile memory; and in addition, they lead to a longer computation time with an 8-bit microprocessor since it is necessary to fetch these numbers in small pieces. But if we used and stored smaller signature coupons, the guaranteed authenticity of signature might be much weaker.

The invention described here makes it possible to reconcile the concern for a guarantee of authenticity with the use of smaller rj_ signature coupons.

The invention therefore proposes a method of generating an electronic signature by a signatory body and of verification by a verifying body, using a digital signature algorithm in which the signature sent by the signatory comprises at least one signature coupon ri and a complement of signature s which is calculated from the coupon r ^ and a secret key x of the card, this algorithm allowing the verification of signature by a verifier using a verification formula of the type v = f (ri, s) = ri, this process being characterized in that a. the signature coupon is established in advance by a certified authority, in two stages: - calculation of a number represented by a long binary string, using a mathematical formula involving large binary numbers;

- and modification of the result of this calculation by a complex compression function greatly reducing the length of this result, b. a series of different short coupons are thus prepared in advance and stored in the signatory body (memory chip card and microprocessor), c. the signature generation involves the sending of a coupon r ^ and a signature complement s calculated from at least r and x, d. the signature verification algorithm includes a mathematical calculation followed by the same function complex compression than that used to prepare the coupon, and the result is compared to the coupon for signature verification.

The compression function is preferably a complex hash function which requires a fairly long computation time. This gives significant security to the signature generation and verification process. We therefore combine the advantage of a good guarantee of authenticity of signature with the possibility of saving only small coupons in the card, therefore the possibility of saving a lot. If, in addition, we use the timing mentioned above, we can see that the guarantee of authenticity can be strengthened to a very high degree. The signature calculation of course involves the message m that we want to sign, to guarantee not only the authenticity of the signature but also the integrity of the transmitted message.

Security can be further improved by one or more of the following features:

The formula for calculating the coupon ri is preferably established from a hazard J generated at the start by the card and stored in the card to be reused when the coupon is used for the establishment of a signature.

We can provide that to trigger the generation of a signature, the verifying terminal sends a random a to the card and then starts the timer; it is also expected that the establishment of the signature complement necessarily uses this hazard a and that signature verification also requires this hazard a.

The signature complement s is preferably established by a calculation involving a hash function SHA (m, a) of the message and of this hazard a, the same hash function being used for signature verification.

The additional signature s is preferably established by a calculation involving a hazard J stored in the card and having served to establish the signature coupon. More preferably, this calculation of s involves a hash function SHA (x, J, i) relating to this hazard J and to an index i representing the number of the coupon used, this same hash function having been previously used during of the long binary chain calculation provided for in the calculation of the corresponding coupon. This hashing function preferably also involves the secret key x of the card.

The additional signature s is preferably established by a calculation involving a hash function of the coupon SHA (ri), the same hash function

SHA (ri) being used for signature verification.

Thus, according to a particular aspect of the invention, a method is proposed for generating digital signatures of messages by a signatory device and for verifying these signatures by a verifier device, the signatory device comprising means of calculation, communication and data retention comprising at least one electrically programmable non-volatile memory, according to which encrypted data are prepared constituting signature coupons ri which are loaded into the non-volatile memory and which the signatory device uses to sign messages, mainly characterized in that: the coupons are compressed by application of a compression function, also called hash function, by a certified authority before being loaded into the memory, and in that it comprises the following exchanges: - a message m is transmitted and this message must be certified by a signature; the signatory sends a laughed coupon to the verifier, - the verifier sends a random number a to the signatory and starts a stopwatch, the signatory calculates the signature s of the message and sends it to the verifier,

- the verifier stops the chronometer and verifies that the signature has been obtained by the secret held in the card and the coupon received ri; this check is made by checking the following equality: v = f (ri, s, m) = ri

- the verifier accepts the signature if the verification condition v = ri is fulfilled and if the timed time does not exceed a predetermined time allotted.

To simplify, in the following we will mainly talk about card for the signatory or signatory.

Other characteristics and advantages of the invention will appear on reading the detailed description which follows and which is given with reference to the appended drawings in which: - Figure 1 describes the flowchart of a card implementing the proposed system by the present invention; FIG. 2 describes the data transmitted between the card and the terminal when the coupon is used; FIG. 3 describes the flow diagram of a terminal implementing the system proposed by the present invention;

- Figure 4 shows the data transmitted between the card and the authority during the loading coupons and organizing the memory of a card after loading n coupons.

From the explanations given in the preamble, it will be understood that the main advantage of signature coupons precalculated according to the method of the invention lies in the speed of calculation of a signature by a card based on a simple 8-bit microcontroller and the low memory occupancy of stored coupons. Typically the signature calculation can be done in approximately 300 ms, transmission time included, and each coupon can use from two to four bytes of EPROM or EEPROM memory.

The invention will be described in this example, it being understood that this is only an example, although it is considered here as the most advantageous.

In this case, the signature generation process breaks down into two distinct phases: the loading of the coupons by the authority that issued the card, then the use of these coupons by the card, facing a terminal that does not know the secret x from the menu.

The two phases here use hash functions of two different types. It is recalled that a hash function of a number, represented by a string of bits, consists in the production of another string of bits of determined length, length which is or is not the same as that of the starting string, and this starting from logical functions executed on groups of bits of the starting chain.

Simple hash functions are used, noted SHA (ch) for hashing a string ch. These functions can be conventional hash functions, such as those published in the recent American standard SHA (Secure Hash Algorithm - FIPS PUB XX, from February 1, 1993, in "Digital Signature Standard"). These functions can be the MDA or MD5 function or a hash based on the DES (Data Encryption Standard) algorithm. Other functions, called complex hashing, will also be used. Their characteristic used here is not so much to be a hash function as to be a slowing function imposed during certain signal processing, and also to be a compression function reducing the length of the signature coupons that we want to save in the smart card.

This slowing and compression function is denoted below H (ch) for the processing of a chain ch. All kinds of deceleration and compression functions could be used in the invention. By way of example, the following function was taken as a function H (ch), where SHA (ch) denotes a conventional hash function: H (ch) = SHA [SHA {SHA (ch)} ^S ch) _{mod p] mod 2} ^e , where e is the desired length for the coupons, for example 16 to 40 bits or a few bytes.

In all that follows, we will use an algorithm directly inspired by the DSA algorithm, to show how the original features of the invention are implemented. The parameters p, q, g, x, y used are those defined previously with respect to the DSA algorithm.

LOADING COUPONS INTO THE CARD

This is the preliminary step, but of course only if we calculate in advance, outside the map, the first part r of the signature {r, s} and where we load several possible values ri into the card.

1. The card resets a counter in non-volatile memory (EPROM or EEPROM), generates a random J (from 10 to 20 bytes for example), saves it in non-volatile memory, and sends it to the authority control which knows the secret x of the card and which calculates, for i = 1 to n, several values ki and several values ri:

ki "{l / (SHA (x, J, i)} mod q

and ri = H (g ^x mod p); H is the function of deceleration and compression.

We could also consider that the card calculates for each i the value SHA (x, J, i) and sends it to the control authority; this calculates the numbers τ ^.

2. The authority sends the ri numbers to the card which stores them in memory, keeping the link with the reference i. The ki numbers are not kept.

If we refer to the DSA algorithm, ki represents the random number k, modified with each new signature. But instead of being issued by the verifying terminal at the time of a signature, it will be recalculated at the appropriate time by the card. As it depends on i and that an index coupon i is used only once, ki is renewed each time.

USING A COUPON TO SIGN A MESSAGE

When the card wishes to sign a message, the following protocol is used after transmission of the message m (preferably in the form of a hashed function of the real message, according to a hash function known to the terminal receiving the message):

1. The card - extracts state i from the counter

(representing the current index of the signature that will be produced),

- extract from the non-volatile memory the hazard J, the secret x, the coupon ri corresponding to the index i;

- calculate I = SHA (x, J, i); this value I is none other than the modular inverse of ki which was used to calculate the coupon ri;

- calculates A = xSHA (ri) mod q - increments i (for a next signature)

- sends laugh to the checking terminal; this shipment represents the first part of the signature.

2. The terminal then generates a hazard a, to trigger the generation of the second signature part s; this sending constitutes in a way the launching of an à la carte challenge because the verifying terminal simultaneously starts a stopwatch to measure the response time of the card to this challenge.

The signature s that the card must send, taking into account the verification formula f (r, m, s, a) = ri which is provided in the verifier is s = [xSHA (ri) mod q + SHA (m, a )] / ki mod q

This formula involves the coupon ri, the secret x of the card, the message m sent, the number ki, and the hazard sent by the verifier as a challenge. This formula is different from the one given for the DSA algorithm: s = (m + xr) / k for several reasons: it must involve the hazard sent as a challenge, so that the verifier is sure that the timed signature calculation s does not start until the hazard has reached the card. This is why we use a hash of m and the hazard a, SHA (m, a), instead of m. On the other hand, SHA (ri) is preferably used rather than r to use a coupon value in the form of a longer chain than ri which is a very short chain. This enhances security. But of course, if we use xSHA (ri) instead of xri and SHA (m, a) instead of m, the verification formula must take this into account, and we will see later that this is what is done. Other variants of signature calculation can be provided, provided that the verification formula takes this into account.

3. The card calculates the signature s as quickly as possible. But as it has already calculated, before starting the stopwatch, A ≈ xSHA (ri) mod q and I = 1 / i = SHA (x, J, i) it only has to calculate s = I. (SHA ( m, a) + A) mod q This calculation can be quick even for a simple and inexpensive 8-bit microcontroller, for example type 8051 from Intel or 6805 from Motorola. As soon as the calculation is complete, the card returns the signature s.

4. Upon receipt of s, the terminal stops the stopwatch and performs the calculations for verifying the authenticity of the signature. If the signature has been correctly calculated according to the above formula, then we can verify that we must have the following equality:

_[y (SHA (ri) / s) mod q _g (SHA (m, a) / s) mod q _{mod p]}

= g ¹ mod p The verifier does not have ki. It has ri = H (g ¹ mod p); H is the function of deceleration and compression.

Equality must therefore be transformed into:

_{H [y} (SHA (ri) / s) mod q _g (SHA (m, a) / s) mod q _{moά p]}

≈ H (g ^ki mod p) = ri

The checker has ri, s, q, p, g, m, a, the simple hash function SHA, and the deceleration and compression function H. It therefore checks the equality ci -above.

If equality is obtained and if the signature has been returned within a time limit below a determined threshold, the signature is accepted by the verifier. If one of the two conditions is not met, it is not accepted.

As an example for the evaluation of the duration, we can give the following indications: let's call T the time necessary to evaluate H (ch) on an extremely powerful computer, even the most powerful one we know today. We can consider that the deceleration function H, leading to chains of length e (H also having a compression functionality) is sufficiently complex, and in any case must be chosen sufficiently complex, so that for any value z and any existing computer , the search for a new value ch 'such that z = H (ch') requires a time T.2 ^e . Since someone who ignores the secret of the card can only search for s by trial and error using the verification formula (exhaustive search), he cannot, even with a single try, find a correct value of s if we choose to set a signature return duration threshold much lower than this value T.2 ^e , for example l millionth of this value.

This gives an indication of the methodology to follow to choose the deceleration function H and the threshold duration.

In general, the principles which have been explained above and illustrated by an example are applicable to other signature protocols. In particular, they are applicable to other protocols in which a precalculation of signature coupons is possible, in particular the following protocols:

- Rueppel-Nyberg: "New signature schemes based on the discrete logarithm proble" published in the proceedings of the Eurocrypt 94 conference.

Schnorr: "Efficient identification and signatures for smart-cards", published in the proceedings of the Crypto'89 conference.

- El-Gamal: "A public-key cryptosystem and a signature scheme based on discrète logarithms" published in the journal IEEE Transactions on Information Theory, vol IT30, n ° 4, pages 469-472.

Guillou-Quisquater: "A practical zero-knowledge protocol fitted to security microprocessors minimizing both transmission and memory", published in the proceedings of the Eurocrypt'88 conference and "A paradoxical identity-based signature scheme resulting from zero-knowledge", published in Crypto'88 conference proceedings.

- other public key systems based on the discrete logarithm, where the equation (m + xr) / k mod q is replaced by another equality involving m, x, r, and k (as explained in the article "Meta Message Recovery and Meta Blind Signature schemes based on the discrete logarithm problem and their applications", published by Horster et al. In the conference proceedings Asiacrypt'94) or by using several distinct hazards k or several distinct secrets x in the same signature.

The invention is applicable to the signature of electronic checks and then makes it possible to make such checks with smart cards at low cost (resulting from the use of an 8-bit microprocessor and a non-volatile memory of limited size. ).

Indeed, the message m can represent a transaction carried out by the card with the terminal which is for example the payment terminal of a merchant. This message is signed. The terminal checks the signature to accept the message, therefore the transaction, but this terminal is also connected to a central management authority (a bank for example) which must itself be able to check the message and the authenticity of the signature before debit the signatory's account on the one hand and / or credit the merchant's account on the other. Thus, after having executed all the signature and signature verification procedure described in detail above, the terminal sends the electronic check {i, ri, a, s, m} to the control authority, and the authority s 'ensures that the signature s is the correct signature, that is to say that: s = SHA (x, J, i) [SHA (m, a) + xSHA (ri)] mod q and the authority credited the terminal account for the amount of the transaction defined in the message m.

Note that in calculating the signature by the card, we can use the expression SHA (m, i, a) instead of SHA (m, a). In which case, of course, the terminal verification formula must take this into account and therefore be:

H _[y (SHA (ri) / s) mod q _g (SHA (m, i, a) / s) mod q _{mod p] = r} . and that the signature verification formula by the authority also takes this into account and either: s = SHA (x, J, i) [SHA (m, i, a) + xSHA (ri)] mod q

Referring to the figures, each smart card consists of a processing unit (CPU) 11, a communication interface 10, a random access memory 13 (RAM) and / or a non-writable memory (ROM) 14 and / or a writable or rewritable non-volatile memory (EPROM OR EEPROM) 15.

The processing unit 11 and / or the ROM 14 of the smart card contain calculation programs or resources corresponding to the execution of the calculation steps carried out by the card when loading the coupons and when signing a message or the issuance of an electronic check. These programs include in particular the calculation rules for generating s and the rules for using the SHA hash function. The calculation unit and the programs in ROM also include the resources necessary for modular multiplications, additions and reductions. Some of these operations can be grouped together (for example, the modular reduction can be directly integrated into the multiplication).

As for the DSA algorithm, the RAM of the card contains the message M and the hazard a to which the hash function SHA (m, a) or SHA (m, i, a) applies for example. The non-volatile memory 15 typically contains the parameters q, x, J and the set of coupons

(ri) precalculated. The index i is in a non-volatile counter incremented with each new generation of signature and reset to zero when loading coupons.

The processing unit of the control card, via address and data buses 16 and the interface of communication 10, read and write operations in memory 13, 14, and 15.

Each smart card is protected from the outside world by physical protections 17. These protections should be sufficient to prevent any unauthorized entity from obtaining the secret key x. The techniques most used today in this area are the integration of the chip into a security module and the equipment of the chips of devices capable of detecting variations in temperature, light, as well as voltages and frequencies of abnormal clock. Particular design techniques such as scrambling of memory access are also used. The terminal itself consists of at least one processing unit (CPU) 30 and memory resources 32, 33, 34.

The CPU 30 controls, via the address and data buses 35 and the communication interface 31, the read and write operations in the memories 32, 33, 34.

The authority's CPU 30 and / or ROM 34 contain calculation programs or resources making it possible to implement the calculation rules and hash functions, deceleration and compression, multiplication, addition, modular inversion, modular exponentiation and reduction, necessary to calculate coupons and verify signature. Some of these operations can be grouped together (modular multiplication and reduction for example).

The whole of the invention has been described with regard to smart cards, but it will be understood that it is applicable when the signatory body is another object, and in particular a portable object such as PCMCIA cards which are kinds from smart cards to parallel and non-serial transmission protocols, or badges, contactless cards, etc. Communication can take place between the card and the terminal either directly by electronic signals, or by remote, wireless or infrared transmission.

Claims

1. Electronic signature process, comprising the generation of a digital signature (s) by a signatory body which calculates this signature using random data (a) sent by a verifier body, and the verification of the signature by the verifier which verifies if a mathematical condition involving the signature sent and the random data is fulfilled, characterized in that the verification of the signature sent by the signatory to the verifier also uses a step of timing the duration elapsing between an instant when the random data is sent by the verifier to the signatory and the moment when the signature using this data returns to the verifier after calculation by the signatory body, the signature being accepted if the elapsed time is less than a determined threshold and if the mathematical condition is checked.

2. Method according to claim 1, characterized in that the calculation of the signature and the verification are carried out using an algorithm of the type in which the generation of signature produces two values

{r, s}, s being calculated by the signatory from r and a secret key x, and in which the verification of the signature {r, s} consists in the verification of an equality v = f (r , s) = r between r and a function f of r and s, and in that the function f is chosen to be sufficiently complex that the search time for a value s from this equality in the absence of knowledge of the secret key x is much greater, even if it is done by a powerful calculator, than the duration of calculation and transmission by the card of the value s from of r and the secret key, even if the card uses a weak microprocessor.

3. Method according to claim 2, characterized in that the function f (r, s) also involves a message m to be signed.

4. Method according to one of claims 2 and 3, characterized in that the function f comprises mathematical calculations followed by a complex hash function (H) performing both a slowdown in obtaining a result of computation and a compression of length of this result.

5. Method according to claim 4, characterized in that the first signature part r is established by other mathematical calculations, followed by the same complex hash function (H).

6. A signature generation and verification method according to one of claims l to 5, characterized in that the signature sent by the signatory comprises at least one signature coupon ri and one additional signature s which is calculated from coupon ri and a secret key x of the card, the method allowing signature verification by the verifier using a verification formula of the type v = f (ri, s) = ri, this method being characterized in that a. the signature coupon is established in advance by a certified authority, in two stages:

- calculation of a number represented by a long binary string, using a mathematical formula involving large binary numbers; - and modification of the result by a complex compression function greatly reducing the length of this result, b. a series of different short coupons are thus prepared in advance and stored in the signatory body, c. the generation of signature involves the sending of a coupon ri and a complement of signature s calculated from ri, and x, d. the signature verification comprises a mathematical calculation followed by the same complex compression function as that which was used to prepare the coupon, and the result is compared to the coupon for the signature verification.

7. A method of generating an electronic signature that can use a timing step according to claim 1, this method comprising the generation of a signature by a signatory body and the verification of the signature by a verifying body, characterized in that the signature sent by the signatory comprises at least one signature coupon ri and an additional signature s which is calculated from the coupon ri and a secret key x of the card, the signature verification by the verifier being carried out using 'a verification formula of the type v = f (ri, s) = ri, and in that: a. the signature coupon is established in advance by a certified authority, in two stages: - calculation of a number represented by a long binary string, using a mathematical formula involving large binary numbers; - and modification of the result by a complex compression function greatly reducing the length of this result, b. a series of different short coupons are thus prepared in advance and stored in the signatory body, c. the generation of signature involves the sending of a coupon ri and of a complement of signature s calculated from at least ri and x, d. the signature verification comprises a mathematical calculation followed by the same complex compression function as that which was used to prepare the coupon, and the result is compared to the coupon for the signature verification.

8. Method according to claim 7, characterized in that the compression function is a complex hash function.

9. Method according to one of claims 7 and 8, characterized in that the calculation of the coupon is made from a hazard (J) generated at the start by the card and stored in the card to be reused when the coupon is used for establishing a signature.

10. Method according to one of claims 7 to 9, characterized in that, to trigger the generation of signature by the card, the verifier sends a random a to the card, then triggers a stopwatch, measures the time taken by the card to return the additional signature s calculated from at least the hazard a and the secret key x of the card, performs a signature verification calculation from at least the signature s and the hazard a , and accepts the signature if the calculation satisfies a predetermined condition and if the time put by the card to return the signature s using the hazard a is less than a predetermined threshold.

11. Method according to one of claims 7 to 10, characterized in that the signature complement s is established from a hash function SHA (m, a) of a message m to be signed and the hazard a, and in that the same hash function is used for signature verification.

12. Method according to one of claims 7 to 11, characterized in that the additional signature is established by a calculation involving a hazard (J) stored in the card and having served to establish the signature coupon.

13. Method according to claim 12, characterized in that this calculation involving the hazard (J) stored in the card also involves a hash function SHA (x, J, i) relating at least to this hazard (J) and on an index i representing a number of the coupon used, this same hash function SHA (x, J, i) having been previously used during the calculation of the long binary chain provided for in the calculation of the corresponding coupon.

14. Method according to one of claims 7 to 13, characterized in that the signature complement is established by a calculation involving a hash function of the coupon, the same hash function of the coupon being used for signature verification.

15. Method for generating digital signatures of messages by a signing device and verifying these signatures by a device verifier, the signatory device comprising means for calculating, communicating and retaining data comprising at least one electrically programmable non-volatile memory, method according to which encrypted data are prepared constituting signature coupons ri which are loaded into the memory non-volatile and that the signatory device uses to sign messages, mainly characterized in that:

- the coupons are compressed by application of a compression function (H), also called hashing function, by a certified authority before being loaded into the memory, and in that it comprises the following exchanges:

- a message m is transmitted and this message must be certified by a signature; the signatory sends a laugh coupon to the verifier,

- the verifier sends a random number a to the signatory and starts a stopwatch, - the signatory calculates the signature s of the message and sends it to the verifier,

- the verifier stops the chronometer and verifies that the signature has been obtained by the secret held in the card and the coupon received ri; this check is made by checking the following equality: v = f (ri, s, m) = ^r i

- the verifier accepts the signature if the verification condition v = r is met and if the timed time does not exceed a predetermined duration.