JP2000013367A - Digital signature system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prove the genuineness of a public key by applying unidirectional homorphoic image dependent on a signed message and a signer ID to the secret algorithm which is previously distributed to every entity and using the algorithm to be newly generated as the signature information. SOLUTION: A center generates a center algorithm that is known only by the center and then generates a secret algorithm A3 that is inherent to an entity from every center algorithm and the entity ID. The algorithm A3 is distributed to every entity by a method whose safety is assured. The entity which acquires the algorithm A3 inputs the ID of an opposite party of communication to every algorithm A3 to easily share a common key corresponding to every center algorithm. Thus, an optional authentication requester can authenticate the signature by using the algorithm A3 that is used for sharing a key and without performing any preliminary communication with the signer.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital signature in an ID-based encryption system using a tamper-resistant module.

[0002]

2. Description of the Related Art In digital signatures based on public key cryptography,
The problem is that a mechanism for proving the authenticity of the public key used for signature authentication is required. On the other hand, KPS (Key Predistribution Sy
The problem with digital signatures using cryptosystems based on IDs, such as stems, is that the certifier must be specified in advance when the signature is generated.

[0003]

SUMMARY OF THE INVENTION An object of the present invention is to provide a digital signature system which solves the above-mentioned problems.

[0004]

In order to achieve the above object, the signature system of the present invention is an ID-based encryption system.
KPS uses a newly generated algorithm as signature information by applying a one-way homomorphic mapping that depends on the signed message and the signer ID to a secret algorithm that is distributed in advance to each entity. . At the time of signature authentication, the certifier performs signature authentication using the secret algorithm held by the certifier and the ID of the signer and the certifier itself. It is characterized in that an arbitrary requester holding a secret algorithm can authenticate without performing any preliminary communication with the signer.

[0005]

According to the digital signature system of the present invention, since a secret algorithm is used at the time of signature and authentication, the authenticity of the secret information held by each entity is ensured by the ID-based encryption system KPS, and the public key and public key authentication are performed. The mechanism of is unnecessary. By using a one-way homomorphic mapping that depends on the message and the signer ID, the signature information inherits the property that the signer can share the secret information with other secret algorithms of the signer's own secret algorithm. Therefore, signature authentication can be executed by the authentication requester holding an arbitrary secret algorithm without performing any preliminary communication with the signer. The KPS in the present invention is described in JP-A-63-63463 and JP-A-63-107107.
This is one of the common key generation methods using an ID (identifier) represented by Japanese Patent Publication No. 667, but is not limited to this, and any key sharing method using a public ID input can be used. In that sense, the secret algorithm and ID are not limited to those of KPS.

[0006]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention relates to an entity having a key for use in cryptographic communication on a network, and
A center for key management is assumed. The center generates a center algorithm known only to the center (FIG. 1), and generates an entity-specific secret algorithm from each center algorithm and the ID of the entity. The generated secret algorithm is used in a secure manner.
Distribute to each entity (Fig. 2). Note that this secret algorithm is enclosed in a tamper-resistant module such as an IC card, and is desirably designed to respond only to a predetermined operation. The entity that obtained the secret algorithm is the ID of the communication partner
Is input to each secret algorithm, it is possible to easily realize key sharing of a common key corresponding to each center algorithm. According to the present invention, the signature authentication can be performed without any preliminary communication between the arbitrary requester and the signer using the secret algorithm provided for the key sharing. The signer applies a one-way homomorphic mapping dependent on the signed algorithm held by the signer to the message to be signed and the signer ID, and publishes the generated algorithm as a signature of the message. The certifier compares the authenticator generated by inputting his / her ID into the signature with the message, the secret algorithm held by the user, and the authenticator generated separately from the signer's ID. The authenticity of the signature can be authenticated (FIG. 3). In FIG. 3, A is a signature generation means,
B is a signature authentication unit. Each means is composed of a terminal capable of performing arithmetic processing, which has an interface with a communication terminal, a personal computer, and an IC card as described below, and is capable of holding, reading, and writing data. , And a device for displaying or transmitting the result. A1
Indicates a tamper-resistant module, and indicates that data and processing within the frame have tamper-resistance. A
Reference numeral 2 is added to indicate that the signature generation means A can take in an algorithm from the outside and execute the algorithm. A3 indicates a secret algorithm possessed by the signature generation means A so that the signature generation means A can read and use it secretly when necessary on various recording media. A4
Is a part that performs arithmetic processing based on a built-in hash function. A5 is a part that performs arithmetic processing based on the one-way homomorphic mapping. A6 indicates its own identifier data. C indicates that the data described at the root is input as an algorithm to the means at the end of the arrow, and specifically, the digital signature algorithm is the signature generation means A
Is transmitted to the signature authenticating means B and inputted. B1 indicates a tamper-resistant module similar to A1, and B2 indicates a secret algorithm that the signature authentication unit B keeps secret and a unit that executes the algorithm.
B3 is a part that performs arithmetic processing based on a built-in hash function. B4 is a part that performs arithmetic processing based on the one-way homomorphic mapping. B5 is a part for storing a digital signature algorithm and executing the algorithm. B6 is a portion indicating comparison and collation, and is means for comparing and collating at least two inputs and outputting an OK signal if the results match and outputting an NG signal if they do not match. In the present invention, the present invention is suitably used for a bidirectional network such as the Internet, an intranet, an extranet, etc., which is performed via various media such as electric, optical, or wireless, or a unidirectional network such as a television radio. In this case, the secret algorithm is digitally recorded as a program or data on a memory, a floppy disk, a hard disk, a CD-ROM, a removable disk such as an MO, an IC card, a magneto-optical card, a magnetic card, or a magnetic tape. It is preferable that the data is read out as an application or at the OS level and executed by a personal computer, a portable terminal, or the like. The entity according to the present invention at least directly or indirectly executes a secret algorithm, and includes a communication terminal, a main program, another entity that performs communication, or a subprogram, an accessory device such as a peripheral device of a personal computer, or the like. Attached objects attached to the subject, whose purpose is mainly to perform plaintext conversion, and indicate the subject of information exchange or the one accompanying it.

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The details of a digital signature according to the present invention will be described below. In this embodiment, a mapping based on the difficulty of the discrete logarithm problem is given as an example of the one-way homomorphic mapping depending on the message and the signer ID, but the content of the present invention is not limited to this. . 0. The center is a prime number

(Equation 1) And prime numbers

(Equation 2) Generate At this time,

(Equation 3) Prime factors other than 2 are prime numbers

(Equation 4) Choose prime numbers that are as large as or larger than. These are disclosed to all entities as system parameters. 1. Center is the center algorithm

(Equation 5) And keep it secret. (See Fig. 1) This center algorithm is subscript

(Equation 6) About

(Equation 7) Is symmetric.

[0008] 2. I of entity A in the network
D

(Equation 8) Is determined. The center uses the ID-vector corresponding to this ID.

(Equation 9) To

(Equation 10) ID and predefined one-way mapping, such as

[Equation 11] Generated using Next, the center is a secret algorithm

(Equation 12) To

(Equation 13) Create using the center algorithm and ID-vector. Here, the term where the superscript and the subscript overlap overlaps with Einstein's contraction. The secret algorithm generated in this way is distributed to an entity having a corresponding ID. Each entity keeps the secret algorithm received secretly. (See Figure 2)

3. Entity

[Equation 14] Is the key

(Equation 15) If you want to share

(Equation 16) Is

[Equation 17] From the other party's ID and their secret algorithm

(Equation 18) Generate entity

[Equation 19] Is

(Equation 20) From the other party's ID and their secret algorithm

(Equation 21) Generate

4. Entity

(Equation 22) Is the message

(Equation 23) When digitally signing a message, first, the hash value is calculated using the message and the ID of the signer according to the following algorithm.

(Equation 24) Generate The hash value generation algorithm is shown below. Step 1.

(Equation 25) Step 2.

(Equation 26) here

[Equation 27] Is a predefined hash function. Step 3.

[Equation 28] To inspect. If OK, output this hash value. NG
If so, repeat Steps 2 and 3 until it is OK. Digital signature using the hash value generated in this way and the secret algorithm held by the signer himself

(Equation 29) To

[Equation 30] Is generated as follows. The above operation is desirably performed in a tamper-resistant module such as an IC card. However, digital signature

(Equation 31) Is open to the public and can be authenticated by a claimant holding any secret algorithm.

5. Any entity

(Equation 32) Is the signer

[Equation 33] Message by

(Equation 34) Signature

(Equation 35) If you authenticate, the signature and your ID

[Equation 36] Authenticator 1 using

(37) To

(38) Is generated as follows. On the other hand, the secret algorithm

[Equation 39] And message

(Equation 40) And signer ID

[Equation 41] Authenticator 2 using

(Equation 42) Is generated as follows. First, like the signer,
Hash value using message and signer ID

[Equation 43] Generate Next, my own secret algorithm

[Equation 44] And signer ID

[Equation 45] Shared key using

[Equation 46] To

[Equation 47] Is generated as follows. Using the hash value thus generated and the shared key, the authenticator 2

[Equation 48] Is generated as follows. In the above operation, the generation of the shared key and the authenticator 2 is desirably executed in a tamper-resistant module such as an IC card.
If the two authenticators 1 and 2 obtained in this way match, the signature is

[Equation 49] Is the signer

[Equation 50] Message

(Equation 51) Is authenticated as a signature. If the two authenticators do not match, the authenticity of the signature is denied.

[0012]

According to the digital signature system of the present invention, the authenticity of the signature is guaranteed based on the authenticity of the secret algorithm secretly distributed to each entity, so that a public key and a public key authentication mechanism are unnecessary. Simpler system construction becomes possible. The signature information inherits the property that the secret information can be shared with the secret algorithm of each entity's secret algorithm by the homomorphic one-way mapping, and the signature based on the signature information and any other secret algorithm can be used. Since the authenticity of the signature is authenticated by the information sharing possibility, any entity having a secret algorithm can perform signature authentication independently without performing preliminary communication with the signer or another entity.

[Brief description of the drawings]

FIG. 1 shows a center algorithm in a center according to an embodiment of the present invention.

(Equation 52) The figure for demonstrating the preparation process of FIG.

FIG. 2 shows an ID at a center in an embodiment of the present invention.

(Equation 53) Secret algorithm using

(Equation 54) FIG. 7 is a diagram for explaining the creation of a file and its delivery process.

FIG. 3 illustrates an embodiment of the present invention.

[Equation 55] Your own ID

[Equation 56] And the secret algorithm that it holds

[Equation 57] Message using

[Equation 58] Digital signature of

[Equation 59] Creation and certifier

[Equation 60] ID by

[Equation 61] And the secret algorithm of the certifier

(Equation 62) FIG. 6 is a diagram for explaining the signature authentication process using the signature.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 9/00 621A

Claims (4)

[Claims] A secret algorithm which is generated by inputting a publicly usable identifier of an entity corresponding to the algorithm to an algorithm which is commonly used; Prepares the state of possessing the secret algorithm,
By inputting the identifier of the other party's entity into its own secret algorithm, the encryption key management system KPS forms a state where key information is shared with the other party's entity. A digital signature scheme using, as signature information, an algorithm newly generated by applying a one-way homomorphic mapping depending on the signer's identifier (ID). 2. The digital signature system according to claim 1, wherein at the time of signature authentication, the authenticator performs signature authentication using a secret algorithm held by the authenticator, an identifier of the signer and the authenticator itself. 3. The digital signature scheme according to claim 1, wherein any certificate requester holding a secret algorithm can authenticate without performing any preliminary communication with the signer or another entity. 4. An algorithm commonly used, comprising means for creating a secret algorithm generated by inputting a publicly usable identifier of an entity corresponding to the algorithm to the algorithm. Prepares the state of possessing the secret algorithm,
By inputting the identifier of the other party's entity into its own secret algorithm to create a state in which key information is shared with the other party's entity, in the KPS, the entity on the signing side creates its own entity based on its own identifier and message information. Means for creating public signature information by converting the secret algorithm of (a) to (c), wherein the entity that authenticates the signature obtains the public signature information, inputs its own identifier into the public signature information, and Means for creating two authenticators, means for creating another authenticator from the other party identifier and the shared key information and message information obtained from the other party's secret algorithm, and comparison authentication between the one authenticator and the other authenticator Digital signature scheme.