KR20010000047A - Method for the provably secure elliptic curve public key cryptosystem - Google Patents

Abstract

PURPOSE: A system for ciphering an elliptic curve opening key is provided to minimize an extension of a message length and to be able to prove the security for an ACCA(Adaptive Chosen Ciphertext Attack). CONSTITUTION: A partial elliptic curve is selected on a finite field to define the elliptic curve. A pair of an individual key and an opening key is generated on the selected elliptic curve. A common sentence is ciphered by expressing as dots on the elliptic curve with the opening key. A finiteness of the ciphered sentence is verified. The verified ciphered sentence is decoded to the common sentence with the individual key.

Description

Safety-proven elliptic curve public key cryptosystem {METHOD FOR THE PROVABLY SECURE ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEM}

The present invention relates to a public key cryptosystem, and more particularly, to the design of an elliptic curve cryptosystem that is secure against active ciphertext selection attacks.

With the development of information and communication network, various information is exchanged through network. When a sender wants to deliver a valuable message through an e-mail or electronic document delivery system, the sender needs to check whether the right recipient has received the right information, and from the recipient's point of view, the message creator is the right sender. Mechanism is needed. One of the methods for effectively providing such a function includes a public key cryptosystem where each user has a secret key and a public key as two key information.

Public key cryptography systems are also referred to as asymmetric cryptography methods, which use a pair of keys, a key for encryption and a key for decryption. In a public key encryption system, information encrypted with any arbitrary key can be decrypted only by a corresponding key, and thus it is widely used because it proves the identity of the document creator and secures the confidentiality and integrity of the message.

1, a block diagram of a general public key cryptosystem is shown. As shown, the sender side encryption apparatus 10 and the receiver side decryption apparatus 20 use a generally known RSA public key cryptographic algorithm to ensure encryption and digital signature services. The decryption apparatus 20 on the receiver side calculates the public key and the private key (or secret key) by mathematical inverse transformation, and announces the public key to the public bulletin board 22 that everyone can know, and the private key is the receiver. It is kept secret by the decryption apparatus 20 on the side.

The sender's encryption apparatus 10 encrypts the plain text message 14 to be encrypted using the public key stored in the public bulletin board 12, and then encrypts the encrypted cipher text 16 through the communication channel 24. It transmits to the decoding device 20 of the side. The decryption apparatus 20 on the receiver side decrypts the ciphertext 16 provided from the sender 10 with the secret key corresponding to the public key disclosed on the public bulletin board 12, and transmits it to the encryption apparatus 10 on the sender side. Restore the original plain text message 14.

However, when the ciphertext 16 is transmitted between the encryption apparatus 10 on the sender side and the decryption apparatus 20 on the receiver side, the ciphertext 16 passes through the transmission path 24 where security is not guaranteed. Content sent to a person may be disclosed and may also be intentionally attacked by an impure attacker. Such attacks include passive attacks in which the attacker simply intercepts the contents of the password and extracts plain text or key information from the cipher text, and active attacks in which the attacker inserts and decrypts information that is easy to attack.

In a situation where a manual attack is allowed, the attacker is able to decrypt some information about the ciphertext (eg, the least significant bit value of the plaintext), so that the public key cryptosystem responds with semantic security. Shall be ensured.

Because some public key cryptosystems have algebraic properties, for example, because the product of two ciphertexts is equal to the sum of two plaintexts, an attacker may attempt to attack with selective ciphertext among active attack methods. do. Active Chosen Ciphertext Attack (ACCA) means that an attacker To obtain information about the ciphertext (plain text corresponding to the key or ciphertext). , But different from the ciphertext ( Ciphertext associated with) It is an attack made by decrypting them. At this time, the attacker can ) Cannot be decoded directly. The construction of a public key cryptosystem that guarantees the security of ACCA has been classified as difficult.

ACCA is actually one of the very powerful attacks that can be made against a public key cryptosystem. In the past, when designing public key cryptosystems, the design mainly focused on effectively hiding the contents of plain text, but recently the design of public key cryptosystems has been focused on whether they are safe for ACCA. However, depending on the level of safety provided to the ACCA, it also increases the amount of computation and increases the length of the message.

One of the secure public key cryptosystems in the ACCA was proposed in 1991 by Rackoff and Simon using a non-interactive zero knowledge proof. These techniques provided a mathematical proof of the security of public key cryptosystems, but they were not considered practical.

In 1993, Bellare and Rogaway proposed a public key cryptosystem with practical and verifiable security assuming an ideal hash function. This technique has attracted much attention in terms of practicality and safety, but its weak assumption is that the assumption of a hash function is ideal.

A public key cryptosystem that proves secure against ACCA that has no additional ideal assumptions and is of practical value was first proposed by Cramer and Shoup at 98 cryptos.

FIG. 2 is a configuration diagram adopted by the Cramer-Shoup public key cryptographic system, wherein the sender-side encryption device 30 is generated by the receiver-side decryption device 40 and is displayed on the public bulletin board 42. FIG. When encrypting using a public key, the plaintext 34 or the encrypted ciphertext 36 to be encrypted is given a specific structure that guarantees authenticity. The decryption apparatus 40 that receives the ciphertext 36 transmitted from the encryption apparatus 30 through the communication channel 35 deciphers the specific structure contained in the ciphertext 36 before or after decrypting the ciphertext 36. Later, a verification procedure is performed, and the plain text 34 is finally accepted when it is determined to be a valid structure. The Kramer-Shauf public key cryptographic system described above is based on the safety of the Diffie-Hellman decision problem on integer primes.

The above-described configuration of the Kramer-Sharp system is a typical configuration method of a public key cryptosystem secured to ACCA, which is proposed in recent years. It further includes procedures and validation of plain text. However, the Kramer-Shauf public key cryptosystem has the advantage of being able to prove mathematically secure and more efficient than the existing verifiable public key cryptosystem, but the length of the ciphertext is longer than that of the plaintext. And the problem of Defi Hellman's decision underlying the Kramer-Sharp public key cryptosystem is that it is more secure when defined on an elliptic curve than on a finite body. In terms of safety, it may be more desirable.

Therefore, the present invention has been made to solve the above-described problem, and the present invention applies an elliptic curve public key cryptography method to a public key cryptosystem capable of proving the security of the prior art, while minimizing the extension of the message length, It is an object of the present invention to provide a public key cryptographic system whose security can be proved.

An implementation method of a public key cryptosystem that is secure against an active ciphertext selection attack on an elliptic curve according to the present invention for achieving the above object is: a receiver that defines an elliptic curve ( or )(here, Is an elliptic curve (some of which is characteristic of non-two) Selecting); On the transmitting side, the selected elliptic curve ( ) On the private key ( ) And public key (here, Is the elliptic curve ( Is any point selected on Is a variable, Is a hash function); At the transmitting side, a public key generated at the receiver side Plain text to be transmitted using Representing and encrypting the points as points on the elliptic curve; On the receiving side, the cipher text transmitted from the transmitting side ( ) ( Validating against; On the receiving side, the encrypted cipher text ( ) ( Is the private key of the receiving party ( It is characterized in that it comprises the step of decoding to plain text using).

1 is a block diagram of a general public key cryptosystem,

2 is a block diagram of an elliptic curve public key cryptosystem that is secure against an ACA (Acaptive Chosen Ciphertext Attack) of the prior art;

3 is a block diagram of an elliptic curve public key cryptosystem secure against an active ciphertext selection attack according to the present invention;

4 is a flowchart illustrating the operation of the elliptic curve public key cryptographic system shown in FIG.

<Explanation of symbols for main parts of drawing>

10, 30, 100: encryption device 20, 40, 200: decryption device

210: certification inspection unit 22, 42, 300: public bulletin board

24, 44, 350: communication channel

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

3 is a schematic block diagram of a public key cryptosystem according to the present invention, which includes an encryption apparatus 100 on the sender side, a decryption apparatus 200 on the receiver side, and an authentication check unit 210.

The structure of the elliptic curve public key cryptographic system of the present invention is a message authenticity check part 210 that can check whether or not the tampering is performed by an attacker during transmission of a ciphertext to the public key cryptographic system of the prior art illustrated in FIG. ) Is added. It is a technical feature of the present invention that the public key cryptosystem of this type is designed using an elliptic curve cryptographic technique based on the difficulty of the discrete algebra problem on the elliptic curve. Also, as a method for representing a message as a point on an elliptic curve, a message insertion method is used to extend the message or improve the plain text constraints when the ElGamal public key cryptography is extended to the elliptic curve. The elliptic curve used in the present invention uses a non-supersingular elliptic curve in order to prevent a special decoding method called MOV reduction in a super singular elliptic curve. Super-specific elliptic curves are elliptic curves that are common in GF (p) (finite, p is prime). "The number of points above is # (only, ) end It is referred to as a case of dividing by, otherwise it is referred to as non-superspecific curve. In addition, the finite field in which the elliptic curve is defined ( , )(here, (Characteristic is a prime number, not 2). The hash function, on the other hand, uses public cryptographic hash functions such as MD5 and SHA.

The decoding apparatus 200 on the receiver side selects an elliptic curve parameter, that is, a finite field in which the elliptic curve is defined, and selects an elliptic curve according to the selected definition. A public key and a private key pair are generated by randomly generating a private key and generating a public key using an arbitrary point on an elliptic curve. The public key is posted on the public bulletin board 300, and the private key is kept as a secret key. The public key generated by the decryption apparatus 200 on the receiver side is used to encrypt the plain text message in the encryption apparatus 100 on the sender side, and the private key is used to decrypt the encrypted plain text message.

The sender's encryption apparatus 100 selects a random number r and transmits the ciphertext S generated by encrypting the plain text message to the receiver through the communication channel 350. The receiver's authentication checker 210 determines whether the ciphertext is valid using the private key before decrypting the ciphertext of the encrypted plaintext message transmitted from the sender's encryption apparatus 100 at the decryption apparatus 200, and transmits the Only when the cipher text is valid, the decryption apparatus 200 causes the decryption described above. In this regard, although the authentication checker 210 on the receiver side is described and illustrated as being placed in front of the decryption apparatus 200 to authenticate the validity of the cipher text, the authentication checker 210 on the receiver side decryption apparatus 200. It may be arranged at the rear end of the to be configured to validate the plain text decrypted by the decoding apparatus 200.

Hereinafter, the operation of the elliptic curve public key cryptographic system of the present invention having the above-described configuration will be described in more detail with reference to the flowchart of FIG. 4.

First, in step 500, the decoding apparatus 200 on the receiver side has an elliptic curve parameter, that is, a finite body or definition body on which the elliptic curve is defined ( or Select).

Next, in operation 510, the decoding apparatus 200 extracts a part of the definition from an elliptic curve ( We choose as). In this case, the elliptic curve ( Elliptic curve ( ) Has a large decimal number ( To be divided by). Depending on the definition, the elliptic curve ( The points on the dot are represented using a polynomial basis or an optimal normal basis.

In operation 520, the decoding apparatus 200 performs an elliptic curve ( ), Elliptic curve ( ), Which divides the power of ), And an elliptic curve ( ) Is defined All variables, including) are disclosed in the public bulletin board 300.

In operation 530, the decoding apparatus 200 performs an elliptic curve ( Two random points above , ) Randomly, and the secret key ( )(here, Is satisfied).

Subsequently, in step 540, the decryption apparatus 200 performs each variable (the role of an authentication code) to withstand the cryptographic system against an attack on the ACCA. ) Is calculated as in Equations 1, 2, and 3, and the one-way hash function ( Select).

Here, input means that the function has a one-way property. Function value for Is easy to calculate, Function value from It is almost impossible to calculate quantitatively. In other words, the one-way hash function To satisfy It is almost impossible to find. This one-way hash function provides a very important property in providing integrity for a message.

Next, the decoding apparatus 200 performs an elliptic curve selected in steps 530 and 540. Two points selected on , ) And private key ( Are created using Public key in combination Create The public key generated in this way is posted on the public bulletin board 300, the private key Is stored as a secret key (step 550).

In a subsequent step 560, the sender-side encryption apparatus 100 uses a random number ( )(here, ) Is randomly selected, and a variable ( Calculate

Where random number ( ) Is a variable that allows the sender to encrypt at random. ) Is a variable used when decrypting ciphertext on the receiver side.

In a next step 570, the sender side encryption apparatus 100 is plain text. (here, Satisfies the encryption coefficient as shown in Equation 6 below. Is calculated, and the calculated encryption coefficient Using plain text ( ) Is encrypted by calculating and encrypting the following equation (7). ).

Next, in step 580, a value α of calculating a one-way hash of the public key is calculated according to Equation 8 below, and the calculated values ( ) Is used to verify the ciphertext at the receiver side, i.e., to determine whether the public key parameters have been modulated during transmission. ) And combine them into a ciphertext ( ) ( Create The cipher text S thus generated is transmitted to the receiver through the communication channel 350.

( Is concatenated)

The authentication checker 210 on the receiver side transmits the cipher text transmitted from the encryption apparatus 100 on the sender side. To validate the ciphertext, ) In ( ) And hash function ( After calculating the variable (α) as shown in Equation 10 below, the secret key generated on the receiver side It is determined whether Equation 11 is satisfied by using (step 590).

If the above Equation 11 does not hold, it is determined that the cipher text transmitted from the sender's encryption apparatus 100 is invalid, and outputs a message "reject" and requests retransmission of the cipher text in order to discard the cipher text.

However, the ciphertext ( ), When the validity of the receiver is determined, the decryption apparatus 200 at the receiver side may use the cipher text ( ) And use this to calculate the plain text ( (Step 600).

To help the understanding of the present invention described above will be described the operation principle and operation method of the present invention through one embodiment as follows.

(1) First, an elliptic curve parameter selected by the decoding apparatus 200 on the receiver side is ( , , Assume that

(2) In the decoding device 200 on the receiver side, an elliptic curve ( Two points , Select the private key ( Select).

(3) In the encryption apparatus 200 on the receiver side, from Equations 1, 2, and 3 , , Calculate

(4) Then hash function Select.

(5) Then, the public key Is generated as Is generated as:

(6) The encryption apparatus 100 on the sender side randomly selects the variable about , Calculate

(7) After calculating, plain text, (This is Although not the above, encryption is possible in the manner described below. That is, it is not necessary to map the plain text to points on the elliptic curve in order to encrypt the plain text). Calculate

(8) then, Speaking of to be. Therefore, the ciphertext ( ) Is ( Is transmitted through the communication channel 350 to the receiver side.

(9) The cipher text transmitted from the encryption apparatus 100 on the sender side in the authentication checker 210 of the receiver 200. For Equation 10, in order to perform validation, Is calculated, and the receiver's private key From Equation 11 described above using Calculate the validity of ciphertext. However, the verification result of the cipher text validity by the authentication checker 210 on the receiver side is If not, and discards the cipher text and sends a command to the sender 100 to send a new cipher text.

(10) The decryption apparatus 200 on the receiver side is obtained from Equation 12 according to the result of authenticating the validity in the authentication checker 210. ego, Is calculated from equation (13). To calculate the plain text ( Restore).

Therefore, in the present invention according to the present invention, the length of the cipher text can be shortened by using an elliptic curve cryptographic system. More specifically, in order for the cryptographic system based on the discrete algebra problem in the finite field to be secure, the number of decimals defining the finite field must be 1024 bits. However, in the cryptographic system based on the discrete algebra problem on the elliptic curve, it is known that the number of fractions defining the elliptic curve group is 160 bits long. Therefore, the length of a ciphertext in the Kramer-Sharp public key cryptosystem is approximately Bit, but the length of the ciphertext in the present invention is about As a bit, about five times the length of the ciphertext can be used to guarantee the same degree of safety.

Secondly, the problem of Defihelman's decision underlying the Kramer-Shauf public key cryptosystem (finally, Is a fixed finite element, Is a random integer from Wow It is more computationally impossible to find out) that the discrete algebraic problem on the elliptic curve is classified as a problem of exponential time, so that the present invention can provide a higher strength of safety.

Claims (6)

A method for implementing a public key cryptosystem that is secure against an active ciphertext selection attack on an elliptic curve, On the receiving side, a finite field defining an elliptic curve ( or )(here, Is an elliptic curve (some of which is characteristic of non-two) Selecting); On the transmitting side, the selected elliptic curve ( ) On the private key ( ) And public key (here, Is the elliptic curve ( Is any point selected on Is a variable, Is a one-way hash function; At the transmitting side, a public key generated at the receiver side Plain text to be transmitted using Representing and encrypting the points as points on the elliptic curve; On the receiving side, the cipher text transmitted from the transmitting side ( ) ( Validating against; On the receiving side, the encrypted cipher text ( ) ( Is the private key of the receiving party ( A method of implementing a public key cryptographic system secured against an active ciphertext selection attack on an elliptic curve, comprising: decrypting the plaintext using a). The method of claim 1, wherein the public and private key generation step at the receiver side: The elliptic curve ( Any two points on) , Randomly selecting; The private key ( Generating randomly; The elliptic curve ( Two points selected on , ) And the private key ( Variables using (here, , , Calculating; Said variable Combining the public key Generating a; The public key Implementing a public key cryptographic system secured against an active ciphertext selection attack on an elliptic curve, characterized in that it comprises a step of releasing. 3. The method of claim 2, wherein encrypting the plain text on the sender side comprises: Any random number ( )(here, Is randomly selected so that the variable ( , And )(here, , Calculating; Plain text Encryption coefficient (here, Plain text encrypted by encrypting using (here, Generating c); The encrypted plain text Passphrases containing ) ( (here, , ( And concatenating)), wherein the public key cryptosystem is secure against an active ciphertext selection attack on an elliptic curve. 4. The method of claim 3, wherein validating the ciphertext on the receiver side: The ciphertext ( ) ( Against variables ( Calculating; The recipient's private key ( ) Using And determining whether this is true, wherein the public key cryptosystem is secure against an active ciphertext selection attack on an elliptic curve. 5. The method of claim 4, wherein decrypting the cipher text at the receiver side: The ciphertext ( ) ( Encryption coefficient from (here, Generating c); The generated encryption coefficient Sender's plain text using (here, And a public key cryptographic system secured against an active ciphertext selection attack on an elliptic curve. The method of claim 1, wherein the elliptic curve is a non-supersingular elliptic curve.