RU2356172C1 - Method for generation and authentication of electronic digital signature that verifies electronic document - Google Patents

Abstract

FIELD: physics, communication.

SUBSTANCE: invention is related to the field of telecommunications, namely to the field of cryptographic devices and methods for verification of electronic digital signature (EDS). Method for generation and verification of EDS includes the following sequence of actions: elliptical curve is generated in the form of combination of points, every of which is set by two multidigit binary numbers (MBN), n>2 private keys are generated in the form of MBN k₁, k₂, …, k_n, private keys are used to generate n open keys in the form of points P₁, P₂, …, P_n of elliptic curve, electronic document is received, being represented MBN H, depending on received electronic document and on value of private key EDS Q is generated in the form of two or more MBN, collective private key is generated in the form of P point in elliptic curve generated depending on points

, where α₁, α₂, …, α_m are natural numbers, 2≤m≤n, α_j≤n and j=1, 2, …, m, the first A and second B verification MBN are generated, at that at least one of verification MBN is generated depending on collective open key P, MBN A and B are compared. If their parametres coincide, conclusion is made on authenticity of electronic digital signature.

EFFECT: reduced size of collective EDS without reduction of its resistance level.

5 cl, 4 ex, 1 app

Description

The invention relates to the field of telecommunications and computer technology, and more particularly to the field of cryptographic authentication methods for electronic messages transmitted over telecommunication networks and computer networks, and can be used in electronic message systems (documents) certified by electronic digital signature (EDS) presented in as a multi-bit binary number (MDC). Hereinafter, MDC means an electromagnetic signal in binary digital form, the parameters of which are the number of bits and the order of their unit and zero values ¹⁾

( ^{1) the} interpretation of the terms used in the description is given in Appendix 1).

A known method of forming and checking the digital signature, proposed in US patent No. 4405829 from 09/20/1983 and described in detail in books [1. M.A. Ivanov. Cryptography. M., KUDITS-IMAGE, 2001; 2. A.G. Rostovtsev, E.B. Makhovenko. Introduction to public key cryptography. St. Petersburg, Peace and Family, 2001. - p. 43]. The known method consists in the following sequence of actions:

form a secret key in the form of three simple MDC p, q and d, form a public key (n, e) in the form of a pair of MDC n and e, where n is a number representing the product of two simple MDC p and q, and e is a MDC, satisfying the condition ed = 1 mod (p-1) (q-1), an electronic document (ED) submitted by MDC H is received;

depending on the value of H and the value of the secret key form an electronic digital signature in the form of MDC Q = S = H ^d mod n;

form the first verification MDC A = N;

form the second verification MDC B, for which MDC S is raised to an integer power e modulo n: B = S ^e mod n;

comparing the generated verification MDC A and B;

when the parameters of the compared MDC A and B coincide, they conclude that the digital signature is authentic.

The disadvantage of this method is the relatively large size of the signature and the need to increase the size of the signature when developing new, more efficient methods for decomposing the number n into factors or with an increase in the productivity of modern computing devices. This is because the value of the signature element S is calculated by performing arithmetic operations modulo n, and the stability of the digital signature is determined by the complexity of the decomposition of the module n into factors p and q.

There is also a known method of forming and verifying the authenticity of the digital signature of El-Gamal, described in the book [Moldovyan A.A., Moldovyan N.A., Sovetov B.Ya. Cryptography. - St. Petersburg, Doe, 2000. - p.156-159], which includes the following actions:

they form a simple MDC p and a binary number G, which is a primitive root modulo p, generate a secret key in the form of MDC x, depending on the secret key form a public key in the form of MDC Y = G ^x mod p, take the ED presented in the form of MDC N , depending on H and the secret key, the EDS Q is formed in the form of two MDC S and R, that is, Q = (S, R);

carry out a digital signature authentication procedure, including calculating two control parameters using the original MDC p, G, Y, H, and S by raising the MDC G, Y, R to a discrete degree modulo p and comparing the calculated control parameters;

when the values of the control parameters coincide, they conclude that the digital signature is authentic.

The disadvantage of this method is also the relatively large size of the EDS. This is because the values of the signature elements S and R are calculated by performing arithmetic operations modulo p-1 and modulo p, respectively.

There is also a known method of forming and verifying EDS, proposed in US patent No. 4995089 of 02.19.1991. The known method consists in the following sequence of actions:

form a simple MDC p, such that p = Nq + 1, where q is a simple MDC;

form a simple MDC a, such that a ≠ 1 and a ^q mod p = 1;

by generating a random equiprobable sequence generate a secret key in the form of MDC x;

form a public key in the form of MDC y according to the formula y = a ^x mod p;

accept ED submitted by MDC M;

form an EDS in the form of a pair of MDC (e, s), for which a random MDC t is generated, form a MDC R according to the formula R = a ^t mod p, form a MDC e = f (M || R), where the sign || denotes the operation of joining two MDCs and f is some specified hash function, the value of which has a fixed length (usually 160 or 256 bits), regardless of the size of the argument, i.e. from the size of the MDC M || R, and then form the MDC s according to the formula s = (t-ex) mod q;

form the first verification MDC A, for which MDC R ′ is generated according to the formula R ′ = a ^s y ^s mod p and form the MDC e ′ = f (M || R ′);

form the second verification MDC In by copying MDC e: B = e;

comparing the generated verification MDC A and B;

when the parameters of the compared MDC A and B coincide, they conclude that the digital signature is authentic.

The disadvantage of the method according to US patent is the relatively high computational complexity of the procedure for the formation and verification of the digital signature, which is due to the fact that to ensure the minimum required level of resistance it is required to use a simple module with a bit capacity of at least 1024 bits.

Closest in technical essence to the claimed one is the well-known method of forming and verifying the authenticity of the digital signature, proposed by the Russian standard GOST R 34.10-2001 and described, for example, in the book [B.Ya. Ryabko, A.N. Fionov. Cryptographic methods of information security. M., Hot line - Telecom, 2005 .-- 229 p. (see p.110-111)], according to which the digital signature is formed as a pair of MDC r and s, for which an elliptic curve (EC) is generated as a set of points, each point being represented by two coordinates in a Cartesian coordinate system as two MDC , called abscissa (x) and ordinate (y), then carry out the operations of generating EC points, adding EC points and multiplying the EC points by a number, as well as arithmetic operations on the MDC, after which MDC r and s are formed as a result of the performed operations. The indicated operations on points are performed as operations on the MDC, which are the coordinates of the points, according to well-known formulas [B.Ya. Ryabko, A.N. Fionov. Cryptographic methods of information security. M., Hot line - Telecom, 2005 .-- 229 p. (see p. 110-111)]. In the prototype, an EC is described by the equation y ² = x ³ + ax + b mod p, therefore, the generation of EC is the generation of numbers a, b and p, which are parameters of the EC and uniquely specify the set of EC points as the set of points whose abscissa and ordinate satisfy the specified equation. The closest analogue (prototype) is to perform the following sequence of actions:

generate an elliptic curve (EC), which is a collection of MDC pairs, called EC points and having certain properties (see Appendix 1, paragraphs 15-19);

by generating a random equiprobable sequence generate secret keys in the form of MDC k ₁ , k ₂ , ..., k _n ;

form public keys in the form of EC points P ₁ , P ₂ , ..., P _n , for which a point G is generated having an order value equal to q (the order of an EC point is the smallest positive integer q such that the result of multiplying this point by q is the so-called infinitely distant point O; the result of multiplying any EC point by zero by definition is the point O [B.Ya. Ryabko, AN Fionov. Cryptographic methods of information protection. M., Hot line - Telecom, 2005. - 229 p. . (see p. 97-130)]; see also Appendix 1, paragraphs 15-19) and generate public keys Uteem G MDCH point multiplication by k _1, k _2, ..., k _n, i.e. form public keys according to the formulas P ₁ = k ₁ G, P ₂ = k ₂ G, ..., P _n = k _n G;

accept ED submitted by MDCH N;

generating a random MDC 0 <t <q, according to which a point R is formed according to the formula R = tG;

form an EDS Q in the form of a pair of MDC (r, s), for which MDC r is generated by the formula r = x _R mod q, where x _R is the abscissa of the point R, and then MDC s is generated by the formula s = (tH + rk _i ) mod q, where 1≤i≤n;

form the first verification MDC A, for which MDC v is generated by the formula v = sH ^-1 mod q and MDC w by the formula w = (q-rH ^-1 ) mod q, then the point R 'is generated by the formula R' = vG + wP _i , after which MDC A is obtained by the formula A = x _{R '} mod q, where x _R' is the abscissa of the point R ';

form the second verification MDC B by copying the MDC r: B = r;

comparing the generated verification MDC A and B;

when the parameters of the compared MDC A and B coincide, they conclude that the digital signature is authentic.

The disadvantage of the closest analogue is the increase in the size of the collective EDS, i.e. EDS establishing the fact of signing a given document by two or more users in proportion to the number of users signing a given ED, which is due to the fact that each user creates an EDS that is independent of the EDS of other users.

The aim of the invention is to develop a method for generating and verifying the authenticity of an electronic digital signature verifying an ED, depending on an arbitrary set of user secret keys and having a fixed size, i.e. a size that does not depend on the number of users who own this collective signature, which reduces the size of the collective digital signature.

,

, …,

, где α₁, α₂, …, α_m - натуральные числа, 2≤m≤n, α_j≤n и j=1, 2, …, m, причем, по крайней мере, одно из проверочных МДЧ формируют в зависимости от коллективного открытого ключа Р.This goal is achieved by the fact that in the known method of forming and verifying the authenticity of an electronic digital signature verifying an ED, which consists in generating an elliptic curve in the form of a set of points, each of which is determined by a pair of MDCs, which are respectively the abscissa and ordinate of a given point of the elliptic curve in the Cartesian system coordinates, form a set of n≥2 secret keys in the form of MDC k ₁ , k ₂ , ..., k _n , secret keys form n public keys in the form of points P ₁ , P ₂ , ..., P _{n of an} elliptic curve, take the ED, presented the established MDC N, depending on the received electronic document and the value of the secret key, generate an EDS Q in the form of two or more MDCs, form the first A and second B verification MDCs, compare them and, if their parameters coincide, make a conclusion about the authenticity of the EDS, the new that additionally form a collective public key in the form of a point P of an elliptic curve generated depending on the points of the elliptic curve

,

, ...,

, where α ₁ , α ₂ , ..., α _m are natural numbers, 2≤m≤n, α _j ≤n and j = 1, 2, ..., m, and at least one of the verification MDCs is formed as a function of from the collective public key R.

,

, …,

, по формуле

Also new is that the collective public key P is formed depending on the points of the elliptic curve

,

, ...,

, according to the formula

where w _j - auxiliary MDC.

…,

генерируют m точек

…,

эллиптической кривой по формуле

где

j=1, 2, …, m, после чего генерируют первое и второе МДЧ электронной цифровой подписи в виде соответственно абсциссы x_R и ординаты y_R точки R эллиптической кривой путем генерации точки R эллиптической кривой по формуле

затем генерируют промежуточное МДЧ е по формуле е=х_RН mod δ, где x_R - абсцисса точки R и δ - вспомогательное МДЧ, генерируют m точек

…,

эллиптической кривой по формуле

после чего генерируют третье и четвертое МДЧ электронной цифровой подписи в виде соответственно абсциссы x_Z и ординаты y_Z точки Z эллиптической кривой путем генерации точки Z эллиптической кривой по формуле

причем первое проверочное МДЧ А формируют по формуле А=x_W, где x_W - абсцисса точки W эллиптической кривой, вычисленной по формуле W=zZ, а второе проверочное МДЧ В формируют по формуле В=х_U, где х_U - абсцисса точки U эллиптической кривой, вычисленной по формуле U=еР+R.Also new is that when generating public keys, points P ₁ , P ₂ , ..., P _{n of an} elliptic curve are generated by the formula P _i = d _i G, where i = 1, 2, ..., n, G is an additionally generated point elliptic curve, ad _i = zk _i mod q, z> 1 is a natural number, q is the order of the point G of the elliptic curve, EDS Q is formed in the form of four MDCs x _R , y _R , x _Z and y _Z , for which m random MDC

...

generate m points

...

elliptic curve according to the formula

Where

j = 1, 2, ..., m, after which the first and second MDC electronic digital signatures are generated in the form of abscissas x _R and ordinates y _{R of the} point R of the elliptic curve by generating the point R of the elliptic curve according to the formula

then an intermediate MDC e is generated by the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary CDM, m points are generated

...

elliptic curve according to the formula

then generate the third and fourth MDC electronic digital signatures in the form of abscissas x _Z and ordinates y _{Z of the} point Z of the elliptic curve by generating the point Z of the elliptic curve according to the formula

moreover, the first verification MDC A is formed by the formula A = x _W , where x _W is the abscissa of the point W of the elliptic curve calculated by the formula W = zZ, and the second verification MDC B is formed by the formula B = x _U , where x _U is the abscissa of the point U elliptic curve calculated by the formula U = eP + R.

…,

генерируют m точек

…,

эллиптической кривой по формуле

где

j=1, 2, …, m, генерируют точку R эллиптической кривой по формуле

после чего формируют первое МДЧ е электронной цифровой подписи по формуле е=х_RН mod δ, где x_R - абсцисса точки R и δ - вспомогательное МДЧ, затем генерируют m точек

…,

эллиптической кривой по формуле

после чего генерируют второе и третье МДЧ электронной цифровой подписи в виде соответственно абсциссы x_Z и ординаты y_Z точки Z эллиптической кривой путем генерации точки Z эллиптической кривой по формуле

причем первое проверочное МДЧ А формируют по формулеAlso new is the fact that when generating public keys, points P ₁ , P ₂ , ..., P _{n of an} elliptic curve are generated by the formula P _i = d _i G, where i = 1, 2, ..., n, G is an additionally generated point elliptic curve, ad _i = zk _i , mod q, z> 1 is a natural number, q is the order of the point G of the elliptic curve, EDS Q is formed in the form of three MDCs e, x _Z and y _Z , for which m random MDCs are generated

...

generate m points

...

elliptic curve according to the formula

Where

j = 1, 2, ..., m, generate a point R of the elliptic curve according to the formula

then form the first MDC e electronic digital signature according to the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary MDC, then m points are generated

...

elliptic curve according to the formula

then generate the second and third MDC electronic digital signatures in the form of abscissas x _Z and ordinates y _{Z of the} point Z of the elliptic curve by generating the point Z of the elliptic curve according to the formula

moreover, the first verification MDC And form according to the formula

A = x _{R '} H mod δ,

where x _{R '} is the abscissa of the point R' of the elliptic curve calculated by the formula R '= zZ-eP, and the second verification MDC B is formed by the formula B = e.

…,

генерируют m точек

…,

эллиптической кривой по формуле

где j=1, 2, …, m, генерируют точку R эллиптической кривой по формуле

после чего формируют первое МДЧ е электронной цифровой подписи по формуле е=х_RН mod δ, где x_R - абсцисса точки R и δ - вспомогательное простое МДЧ, затем генерируют m МДЧ ,

…,

по формуле

после чего генерируют второе МДЧ s электронной цифровой подписи по формуле

Also new is the fact that when generating public keys, points P ₁ , P ₂ , ..., P _{n of an} elliptic curve are generated by the formula P _i = k _i G, where i = 1, 2, ..., n, G is an additionally generated point an elliptic curve of order q, and the EDS is formed as a pair of MDCs e and s, for which m random MDCs are generated

...

generate m points

...

elliptic curve according to the formula

where j = 1, 2, ..., m, generate a point R of the elliptic curve according to the formula

then form the first MDC e of an electronic digital signature according to the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary simple MDC, then m MDCs are generated ,

...

according to the formula

then generate the second MDC s electronic digital signature according to the formula

moreover, the first verification MDC And form according to the formula

A = x _{R '} H mod δ,

where x _{R '} is the abscissa of the point R' of the elliptic curve calculated by the formula R '= eP + sG, and the second verification MDC B is formed by the formula B = e.

…,

представляет собой выборку из множества всех открытых ключей P₁, P₂, …, P_n, а совокупность секретных ключей k_a, где j=1, 2, …, m, представляет собой выборку из множества всех секретных ключей k_i, где i=1, 2, …, n.The proposed method can be used for the number of users equal to n≥2. Users are conventionally indicated by numbers i = 1, 2, ..., n. This number is used as an index indicating which user owns the secret and public keys, or which user generates the MDC or EC points marked with the index. From the set of n users, some of their subset, consisting of m randomly selected users, can be defined by the numbers of users included in this subset, for example, by the numbers α ₁ , α ₂ , ..., α _m , each of which is selected from the set of numbers 1, 2, ... , n. Thus, the numbers α _j , where j = 1, 2, ..., m, are a sample of arbitrary m numbers from the set {1, 2, ..., n}, with m≤n. Accordingly, the set of public keys

...

is a sample of the set of all public keys P ₁ , P ₂ , ..., P _n , and the set of private keys k _a , where j = 1, 2, ..., m, is a sample of the set of all private keys k _i , where i = 1, 2, ..., n.

The correctness of the claimed method is proved theoretically. Consider, for example, an embodiment of the method according to claim 5. A collective public key corresponding to a subset of users with conditional numbers α ₁ , α ₂ , ..., α _m represents a point

которые представляют собой «доли» пользователей в коллективной подписи, генерируются по формуле

поэтомуValues

which represent the "shares" of users in a collective signature, are generated by the formula

so

The value of the point R 'used to form the first verification MDC A is generated by the formula R' = eP + sG, i.e. it is equal

Therefore, A = x _{R '} Hmodδ = x _R Hmodδ = e = В, i.e. A correctly formed collective signature satisfies the signature verification procedure, i.e. the correctness of the procedures for generating and verifying EDS is proved.

Consider examples of the implementation of the claimed technical solution using EC described by the equation (see Appendix 1, paragraphs 15-19):

y ² = x ³ + ax + bmodp,

where specific values of the parameters used are described in the numerical examples given below. The ECs used in the examples were generated using a program developed specifically for generating ECs, generating EC points, including points with a given order, and performing operations on EC points. The MDC given in the example are written for brevity in the form of decimal numbers, which are represented and converted in binary form in computing devices, i.e. as a sequence of high and low potential signals.

Example 1. The implementation of the proposed method according to claim 2 of the claims

This example illustrates claim 2 of the claims. It uses EC with parameters that provide sufficient durability for use in solving real practical problems of information authentication. This example illustrates the real sizes of numbers that are used in practice in the generation and authentication of digital signatures. A feature of this example is that they accept ED (represented by MDC N), which consists of two parts represented by MDC N ₁ and N ₂ . In this case, the first user signs the first part of the document, the second user - the second, and the third user signs the entire document. The possibility of implementing a collective digital signature with such properties is ensured by the fact that when checking the digital signature, a collective public key is used, which is generated depending on the user's public keys according to the formula P = w ₁ P ₁ + w ₂ P ₂ + w ₃ P ₃ , where w ₁ = H ₁ , w ₂ = H ₂ and w ₃ = H ₃ .

Example 1 uses an EC defined by the following parameters:

a = 5521767865737634555390416300599776622347333359784, b = 9717196 and p = 5521767865737634555390416300599776622347333359787.

This EC contains the number of points equal to the prime number N = 5521767865737634555390416228783886913339823841723, i.e. any of its points has order q equal to the value of N, i.e. q = N.

Consider a team of three users. When forming and verifying the authenticity of the digital signature (the signature is a pair of numbers e and s), the following sequence of actions is performed:

1. Generate EC with the parameters specified above.

2. Form the secret keys in the form of random MDC:

k ₁ = 8182108890892890101467333434019 - the key of the first user;

k ₂ = 3952504539403758278808581024791 - the key of the second user;

k ₃ = 9763160941600092631935520658071 - the key of the third user.

3. Form public keys in the form of points EC P ₁ , P ₂ , P ₃ , for which

3.1. Generate a point G of order q:

G = (4058138998817699569976678358233335958495037969465,

768568926336036825718495218916308682494116144160);

3.2. The points P ₁ , P ₂ , P _{3 are} generated by the formula P _i = k _i G, where i = 1, 2, 3:

P ₁ = (2406767665928158899446906165821747218883574602371, 562377648521692290689031507205008060205345636991);

P ₂ = (348708108378027085357389414044825237922683510732, 1402026191996080196399482770468472598076052599809)

P ₃ = (4307166077833519301063322533024162005091025020313, 5280296312549156028148905914215570655514986217509).

4. Accept the ED represented by MDC N and consisting of two parts represented by MDC H ₁ and H ₂ :

H = 8925999026871145131520337612117778680659192576033;

H ₁ = 135708092215597910168314154751917220633712178686;

H ₂ = 3812498990028819155316571350634376652814331770527.

5. Form an EDS Q in the form of two MDCs e and s, for which the following steps are performed.

5.1. The first, second and third users generate random MDC t ₁ , t ₂ and t _3, respectively:

t ₁ = 2090880922625982683584460167862382379;

t ₂ = 5360383526856663700583896205266418341;

t ₃ = 7677118810723142352012317453400887449.

5.2. Then the first, second and third users generate points R ₁ , R ₂ and R _3, respectively, according to the formula R _i = t _i G:

R ₁ = (4533360075292446608850664400364711592205136618460, 1175061337062232179584348686477324762101164050095);

R ₂ = (1958279223827902047379336465285895435330140185477, 8836508908256232955144234242970494318564852573);

R ₃ = (5038616028852959877509554081789667436853794753557, 209613157933044677924551688484534713038841468913).

5.3. The point R is generated by the formula R = R ₁ + R ₂ + R ₃ :

R = (2597097970263610863546069436833994580002105418569, 3304915040104400813802374282473985550015521973383).

5.4. MDC e is formed using the formula e = x _R mod δ, where x _R is the abscissa of the point R and δ is the auxiliary simple MDC (δ = 7118198218659321028989011):

e = 5079008233076932087473789.

5.5. The first, second and third users generate MDC s ₁ , s ₂ and s _3, respectively, according to the formula s _i = (t _i -ew _i k _i ) mod q, where i = 1, 2, 3; w ₁ = H ₁ ; w ₂ = H ₂ ; w ₃ = H and q = N:

s ₁ = 133444963875333388923743187271473122915443205289;

s ₂ = 1887661653203847944710282450835612551620081427016;

s ₃ = 4850696161955991125559318084555021335580302189827.

5.6. MDC s = s ₁ + s ₂ + s ₃ mod q are generated:

s = 1350034913297537903802927493878220096776002980409.

6. Form the first verification MDC A, for which the following sequence of actions is performed.

6.1. A collective public key is formed in the form of a point P according to the formula P = w ₁ P ₁ + w ₂ P ₂ + w ₃ P ₃ :

w ₁ P ₁ = (1386084349002545424511668926945575066838407867380, 4543633731958840101124845818771841004374561021017)

w ₂ P ₂ = (299211431532419026428141393395396288778694972469, 5300327094421154876022064946876206296853312043729)

w ₃ P ₃ = (4523528487954522900878694877895556963796345154180, 4100826103480972798980996909196526199327733122181)

P = (228426539485900338090938878090464611548638254406, 1202278174553095231135389060209649902535727110543).

6.2. The point R '= eP + sG is generated:

eP = (4556848179595887141400726723891321438602307875189, 2883779289574756983177387955618073719731329543379);

sG = (1360352815531577166684912233134001496389816081366, 3543269787247235781900897404104279341644752005600);

R '= (2597097970263610863546069436833994580002105418569, 3304915040104400813802374282473985550015521973383);

6.3. Generate MDC And according to the formula A = x _{R '} Hmod δ, where the additional MDC δ = 7118198218659321028989011:

A = 5079008233076932087473789.

7. Form the second verification MDC In by copying MDC e:

B = e = 5079008233076932087473789.

8. Compare the first A and second B test MDC.

A comparison shows that the parameters of the MDC A and B are the same. The coincidence of the values of A and B means that the collective digital signature is genuine, i.e. refers to the accepted ED presented by MDC H, wherein the first user signed the part of the ED represented by MDC H ₁ , the second user signed the part of the ED represented by MDC H ₂ , and the third user signed the whole ED.

Example 2. The implementation of the proposed method according to claim 3 of the claims

This example relates to the implementation of the claimed technical solution with artificially reduced bit depth of the numbers used and explains the implementation of the proposed method according to claim 3 of the claims. In this example, the value z = 13917 is set and during the formation and authentication of the digital signature (the signature is a pair of EC points indicated by the letters R and Z), the following sequence of actions is performed:

1. Generate EC with parameters:

p = 1449024649,

a = 1449024646;

b = 1507;

N = q = 1449049321.

2. Generate secret keys in the form of random MDC

k ₁ = 35132631 - secret key of the first user;

k ₂ = 567916337 - secret key of the second user;

k ₃ = 132552971 - the secret key of the third user.

3. Form the public keys in the form of points P ₁ , P ₂ and P ₃ , for which they perform the following steps:

3.1. Generate a point G of order q:

G = (1080340158, 754837262).

3.2. Form the auxiliary MDC d ₁ , d ₂ and d ₃ according to the formula d _i = zk _i mod q, where i = 1, 2, 3:

d ₁ = 13917 · 35132631 mod q = 611204450;

d ₂ = 13917 · 567916337 mod q = 576665295;

d ₃ = 13917132552971 mod q = 99911774.

3.3. The points P ₁ , P ₂ and P _{3 are} generated according to the formula P _i = z (k _i G) = (zk _i ) G = d _i G:

P ₁ = (1329656100, 292197808) - the public key of the first user;

P ₂ = (1051928635, 239761167) - the public key of the second user;

P ₃ = (1359744381, 928409442) - the public key of the third user.

4. Accept the ED represented by the MDC N = 171315687.

5. Form the EDS Q in the form of four MDC x _R , y _R , x _Z and y _z , which are the coordinates of the points R and Z EC, for which the following steps are performed.

5.1. The first, second and third users generate random MDC t ₁ , t ₂ and t ₃ , respectively:

t ₁ = 172637431;

t ₂ = 36716173;

t ₃ = 71259291.

5.2. Then the first, second and third users generate the MDC b ₁ , b ₂ , and b _3, respectively, according to the formula b _i = zt _i mod q:

b ₁ = 13917 172637431 mod q = 71353009;

b ₂ = 13917 · 36716173 mod q = 913618649;

b ₃ = 13917.71259291 mod q = 565817283.

5.3. Then the first, second and third users generate points R ₁ , R ₂ and R _3, respectively, according to the formula R _i = b _i G:

R ₁ = (281198047, 813455618);

R ₂ = (1260148915, 294769180);

R ₃ = (1391070805, 541095949).

5.4. The point R is generated by the formula R = R ₁ + R ₂ + R ₃ :

R = (x _R , y _R ) = (337223575, 1350626111).

5.5. An auxiliary MDC e is formed by the formula e = x _R Hmod δ, where x _R is the abscissa of the point R and δ is the auxiliary MDC (δ = 348743991):

e = 337223575171315687 mod δ = 54524994.

5.6. Points Z _{i are} generated by the formula Z _i = e (k _i G) + t _i G = (ek _i + t _i ) G:

ek ₁ + t ₁ = 5452499435132631 + 172637431modq = 1140036991;

ek ₂ + t ₂ = 54524994 567916337 + 36716173modq = 104065810;

ek ₃ + t ₃ = 54524994132552971 + 71259291modq = 638476987:

Z ₁ = (502331244, 1026983590);

Z ₂ = (1362556964, 156518973);

Z ₃ = (697927304, 886677154).

5.7. The point Z is generated by the formula Z = Z ₁ + Z ₂ + Z ₃ :

Z = (x _Z , y _Z ) = (714524287, 1037968014).

6. Form the first verification MDC A, for which point V = zZ = (1001319513, 191443386) is generated and A is formed by copying the abscissas of point V:

A = 1001319513.

7. Form the second verification MDC In, for which the following steps are performed.

7.1. A collective public key is formed in the form of a point P according to the formula P = P ₁ + P ₂ + P ₃ :

P = (672831345, 705469329);

7.2. The point W = eP + R is generated:

EP = (1146914821, 380461506);

W = (1001319513, 191443386).

7.3. Generate MDC B by copying the abscissas of point W:

B = 1001319513.

8. Compare the first and second verification MDC. They match, so the signature is recognized as genuine.

Note that, as a result of performing paragraph 5 of Example 1, an EDS is formed in the form of four MDC 337223575, 1350626111, 714524287 and 1037968014, which can be represented by points R = (337223575, 1350626111) and S = (714524287, 1037968014). These two options for representing EDS are identical.

Example 3. The implementation of the proposed method according to claim 4 of the claims

This example relates to the implementation of the claimed technical solution with artificially reduced bit depth of the numbers used and explains the implementation of the proposed method according to claim 4. Example 3 also sets the value z = 13917 and uses the same values of the EC parameters, secret and public keys, as well as the rest of the MDC used, as in Example 2. The difference between Example 3 and Example 2 is that in Example 3, as EDS Q forms a triple of MDCs e, x _Z and y _Z , of which the second and third MDCs represent the coordinates of some point of EC. EDS can be identically represented in the form of a pair (e, Z), where e is the MDC and Z is the EC point. Using an EDS of the form (e, Z) reduces the signature size by about 25% compared to Example 2. When forming and verifying the authenticity of an EDS (the signature is a pair of EC points denoted by the letters R and Z) in Example 3, the following sequence of operations is performed.

1. Perform the sequence of steps prescribed by paragraphs 1, 2, 3 and 4 of example 1.

2. Form the digital signature Q in the form of three MDCs e, x _Z and y _Z , where x _Z and y _Z are the coordinates of some point Z EC, which is generated depending on the secret keys of users involved in the formation of a collective digital signature, for which the following steps are performed .

2.1. The first, second and third users generate random MDC t ₁ , t ₂ and t _3, respectively:

t ₁ = 172637431;

t ₂ = 36716173;

t ₃ = 71259291.

2.2. Then, the first, second and third users generate MDC b ₁ , b ₂ and b _3, respectively, according to the formula b _i = zt _i mod q:

b ₁ = 13917 172637431 mod q = 71353009;

b ₂ = 13917 · 36716173 mod q = 913618649;

b ₃ = 13917.71259291 mod q = 565817283.

2.3. Then the first, second and third users generate points R ₁ , R ₂ and R _3, respectively, according to the formula R _i = b _i G:

R ₁ = (281198047, 813455618);

R ₂ = (1260148915, 294769180);

R ₃ = (1391070805, 541095949).

2.4. The point R is generated by the formula R = R ₁ + R ₂ + R ₃ :

R = (337223575, 1350626111).

2.5. The first MDC e electronic digital signature is formed according to the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary MDC (δ = 348743991):

e = 337223575171315687 mod δ = 54524994.

2.6. Points Z _{i are} generated by the formula Z _i = e (k _i G) + t _i G = (ek _i + t _i ) G:

ek ₁ + t ₁ = 5452499435132631 + 172637431 mod q = 1140036991;

ek ₂ + t ₂ = 54524994 567916337 + 36716173 mod q = 104065810;

ek ₃ + t ₃ = 54524994132552971 + 71259291 mod q = 638476987:

Z ₁ = (502331244, 1026983590);

Z ₂ = (1362556964, 156518973);

Z ₃ = (697927304, 886677154).

2.7. Generate the second and third MDC e electronic digital signature in the form of coordinates of the point Z EC calculated by the formula Z = Z ₁ + Z ₂ + Z ₃ :

Z = (x _Z , y _Z ) = (714524287, 1037968014).

3. Form the first verification MDC A, for which the following sequence of actions is performed.

3.1. A collective public key is formed in the form of a point P according to the formula P = P ₁ + P ₂ + P ₃ :

P = (672831345, 705469329);

3.2. The point R '= zS-eP = zS + (q-e) P is generated:

zS = (1001319513, 191443386);

(q-e) P = 1394524327 · (672831345, 705469329) = (1146914821, 1068563143);

R '= (1001319513, 191443386) + (1146914821, 1068563143) = (337223575, 1350626111);

3.3. Generate MDC And according to the formula A = x _{R '} Hmod δ, where the additional MDC δ = 348743991:

A = 337223575171315687 mod δ = 54524994.

4. Form the second verification MDC In by copying MDC e:

B = e = 54524994.

5. Compare the first A and second B test MDC. They match, so the signature is recognized as genuine.

Example 4. The implementation of the proposed method according to claim 5 of the claims

In this example, an EC is used, the secret and public keys of users are the same as in example 1. The example uses an EC defined by the following parameters:

a = 5521767865737634555390416300599776622347333359784, b = 9717196 and p = 5521767865737634555390416300599776622347333359787.

This EC contains the number of points equal to the prime number N = 5521767865737634555390416228783886913339823841723, i.e. any of its points has order q equal to the value of N, i.e. q = N.

Consider a team of three users. When forming and verifying the authenticity of the digital signature (the signature is a pair of MDCs e and s.), The following sequence of actions is performed.

1. Generate EC with the parameters specified above.

2. Generate secret keys in the form of random MDC

k ₁ = 8182108890892890101467333434019 - the key of the first user;

k ₂ = 3952504539403758278808581024791 - the key of the second user;

k ₃ = 9763160941600092631935520658071 - the key of the third user.

3. Form public keys in the form of points EC P ₁ , P ₂ , P ₃ , for which they perform the following steps.

3.1. Generate point G:

G = (4058138998817699569976678358233335958495037969465,

768568926336036825718495218916308682494116144160);

3.2. The points P ₁ , P ₂ , P _{3 are} generated according to the formula P _i = k _i G, where i = 1, 2, 3:

P ₁ = (2406767665928158899446906165821747218883574602371, 562377648521692290689031507205008060205345636991);

P ₂ = (348708108378027085357389414044825237922683510732, 1402026191996080196399482770468472598076052599809)

P ₃ = (4307166077833519301063322533024162005091025020313, 5280296312549156028148905914215570655514986217509).

4. Accept the ED represented, for example, by the following MDC N (which can be taken, in particular, the hash function of the ED):

H = 8925999026871145131520337612117778680659192576033.

5. Form the digital signature Q in the form of a pair of MDC e and s, for which the following steps are performed.

5.1. The first, second and third users generate random MDC t ₁ , t ₂ and t _3, respectively:

t ₁ = 2090880922625982683584460167862382379;

t ₂ = 5360383526856663700583896205266418341;

t ₃ = 7677118810723142352012317453400887449.

5.2. Then the first, second and third users generate points R ₁ , R ₂ and R _3, respectively, according to the formula R _i = t _i G:

R ₁ = (4533360075292446608850664400364711592205136618460, 1175061337062232179584348686477324762101164050095);

R ₂ = (1958279223827902047379336465285895435330140185477, 8836508908256232955144234242970494318564852573);

R ₃ = (5038616028852959877509554081789667436853794753557, 209613157933044677924551688484534713038841468913).

5.3. The point R is generated by the formula R = R ₁ + R ₂ + R ₃ :

R = (2597097970263610863546069436833994580002105418569, 3304915040104400813802374282473985550015521973383).

5.4. Form the first MDC e of an electronic digital signature according to the formula e = x _R Hmod δ, where x _R is the abscissa of the point R and δ is the auxiliary simple MDC (δ = 7118198218659321028989011):

e = 4927124871592959793329711.

5.5. The first, second and third users generate MDC s ₁ , s ₂ and s _3, respectively, according to the formula s _i = (t _i -ek _i ) mod q, where q '= N and i = 1, 2, 3:

s ₁ = 359849983424274307716254877984953159149283598626;

s ₂ = 2228471503399271451844174588034195792013686207551;

s ₃ = 3321295738385055881020248326363803564813773402448.

5.6. The second MDC s of the electronic digital signature is generated by the formula s = s ₁ + s ₂ + s ₃ mod q:

s = 387849359470967085190261563599065602636919366902.

6. Form the first verification MDC A, for which the following sequence of actions is performed.

6.1. A collective public key is formed in the form of a point P according to the formula P = P ₁ + P ₂ + P ₃ :

P = (2597097970263610863546069436833994580002105418569, 3304915040104400813802374282473985550015521973383).

6.2. The point R '= eP + sG is generated:

EP = (146955471348564375364922408624400975297984578370, 5067487498889971752716283347516092217397817107870);

sG = (2925357468651177964466813642233631538174971712513, 599550386022153150210626227063281723596625174740);

R '= (2597097970263610863546069436833994580002105418569, 3304915040104400813802374282473985550015521973383).

6.3. Generate MDC A according to the formula A = x _{R '} Hmod δ, where the additional MDC δ = 7118198218659321028989011:

A = 4927124871592959793329711.

7. Form the second verification MDC In by copying MDC e:

B = e = 4927124871592959793329711.

8. Compare the first A and second B test MDC.

A comparison shows that the parameters of the MDC A and B are the same. The coincidence of the values of A and B means that the collective digital signature is genuine, i.e. refers to the accepted ED presented by MDCH N, and is generated by three users whose public keys have generated the collective public key used to verify the signature authenticity.

Examples 1, 2, 3 and 4 experimentally confirm the correctness of the implementation of the proposed method, which complements the mathematical proof of correctness given above.

Thus, it is shown that the inventive method can be the basis of persistent systems of EDS, providing a reduction in the size of the collective EDS.

The above examples and mathematical justification show that the proposed method for generating and verifying the authenticity of the digital signature works correctly, is technically feasible and allows to achieve the formulated technical result.

Annex 1

Interpretation of the terms used in the description of the application

1. Binary digital electromagnetic signal - a sequence of bits in the form of zeros and ones.

2. Parameters of a binary digital electromagnetic signal: bit depth and order of single and zero bits.

3. The bit depth of a binary digital electromagnetic signal is the total number of its single and zero bits, for example, the number 10011 is 5-bit.

4. Electronic digital signature (EDS) - a binary digital electromagnetic signal, the parameters of which depend on the signed electronic document and on the secret key. EDS authentication is carried out using a public key, which depends on the secret key.

5. An electronic document (ED) is a binary digital electromagnetic signal, the parameters of which depend on the original document and how it is converted to electronic form.

6. Secret key - a binary digital electromagnetic signal used to generate a signature for a given electronic document. The secret key is represented, for example, in binary form as a sequence of digits "0" and "1".

7. Public key - a binary digital electromagnetic signal, the parameters of which depend on the secret key and which is designed to verify the authenticity of a digital electronic signature.

8. A hash function of an electronic document is a binary digital electromagnetic signal, the parameters of which depend on the electronic document and the chosen method of its calculation.

9. A multi-bit binary number (MDC) is a binary digital electromagnetic signal, interpreted as a binary number and represented as a sequence of digits "0" and "1".

10. The operation of raising a number S to a discrete power A modulo n is an operation performed on a finite set of natural numbers

{0, 1, 2, ..., n-1}, including n numbers that are the remainders of dividing all kinds of integers by the number n; the result of the operations of addition, subtraction and multiplication modulo n is a number from the same set [Vinogradov IM Fundamentals of number theory. - M .: Nauka, 1972. - 167 p.]; the operation of raising a number S to a discrete power Z modulo n is defined as a Z-fold sequential multiplication modulo n of the number S by itself, i.e. as a result of this operation, the number W is also obtained that is less than or equal to the number n-1; even for very large numbers S, Z, and n, there are effective algorithms for performing the operation of raising a discrete power modulo [see Moldovyan A.A., Moldovyan N.A., Guts N.D., Izotov B.V. Cryptography: high-speed ciphers. - SPb, BHV-Petersburg, 2002. - p. 58-61 or B. Schneier. Applied cryptography. - M., Triumph Publishing House, 2002. - p.278-280] and electronic devices that carry out this operation at high speed [W. Diffie. The first ten years of public-key cryptography // TIIER. 1988.V. 76. No. 5. p. 67-68]; the operation of raising the number S to a discrete power of Z modulo n is denoted as W = S ^Z mod n, where W is the number resulting from the operation.

11. The Euler function of a natural number n is the number of numbers that are coprime with n and not exceeding n [Vinogradov IM Fundamentals of number theory. - M .: Nauka, 1972. - 167 p .; Buchstab A.A. Number theory - M .: Education, 1966. - 384 s].

12. The exponent q modulo n of the number a, which is coprime with n, is the minimum of the numbers γ for which the condition a ^γ mod n = 1 is satisfied, that is, q = min {γ ₁ , γ ₂ , ...} [I. Vinogradov Fundamentals of number theory. - M .: Nauka, 1972. - 167 p.].

13. The operation of dividing the integer A by an integer B modulo n is performed as the operation of multiplying modulo n the number A by an integer B ^-1 , which is the inverse of B modulo n.

14. The order of q modulo n of a is the exponent q modulo n of a.

15. An elliptic curve (EC) is a collection of pairs of MDCs that satisfy a relation of the form

y ² = x ³ + ax + b mod p,

where the coefficients a and b and the module p determine a specific variant of EC. The operation of addition of MDC pairs and the operation of multiplying the MDC pair by an arbitrary integer are defined over EC. The indicated MDC pairs are written in the form (x, y), where x is called the abscissa of the point, and y is the ordinate. Operations defined on EC points are performed as operations on the coordinates of EC points. As a result, the MDC pair is calculated, which is the coordinates of the new point that is the result of the operation. EC points are called equal if both x and y coordinates are equal. A detailed description of EC can be found in widely available books: [B.Ya. Ryabko, A.N. Fionov. Cryptographic methods of information security. M., Hot line - Telecom, 2005 .-- 229 p. (see p. 97-130)]

16. The operation of adding two points A and B with the coordinates (x _A , y _A ) and (x _B , y _B ), respectively, is performed according to the formulas:

x _C = k ² -x _A -x _B mod p and y _C = k (x _A -x _C ) -y _A mod p,

если точки А и В не равны, и

если точки А и В равны.Where

if points A and B are not equal, and

if points A and B are equal.

17. The operation of multiplying point A by a natural number n is defined as multiple additions of currents A:

nA = A + A + ... + A (n times).

The result of multiplying any EC point by zero determines a point called an infinitely distant point and denoted by the letter O. Two points A = (x, y) and -A = (x, -y) are called opposite. Multiplication by a negative integer -n is defined as follows: (-n) A = n (-A). By definition, it is assumed that the sum of two opposite points is equal to the infinitely distant point O [B.Ya. Ryabko, A.N. Fionov. Cryptographic methods of information security. M., Hot line - Telecom, 2005 .-- 229 p. (see p. 97-130)].

18. Operations on EC points are carried out in computing devices as actions on binary digital electromagnetic signals, carried out according to certain rules defined through operations on MDC.

19. The order of the point A EC is the smallest positive integer q such that qA = O, i.e. such that the result of multiplying point A by q is an infinitely distant point.

Claims (5)

1. A method for generating and authenticating an electronic digital signature certifying an electronic document, which consists in generating an elliptic curve in the form of a set of points, each of which is determined by a pair of multi-bit binary numbers, which are respectively the abscissa and ordinate of this point of the elliptic curve in the Cartesian coordinate system , form a set of n≥2 secret keys in the form of multi-bit binary numbers k ₁ , k ₂ , ..., k _n , for secret keys form n public keys in the form of points P ₁ , P ₂ , ..., P _{n of the} elliptic curve, an electronic document, represented by a multi-bit binary number H, is received, depending on the received electronic document and the value of the secret key, an electronic digital signature Q is formed in the form of two or more multi-bit binary numbers, the first A and second B test multi-bit binary numbers are formed , compare them and, if their parameters coincide, make a conclusion about the authenticity of the electronic digital signature, characterized in that they additionally form a collective public key in the form of ki P of an elliptic curve generated depending on the elliptic curve points

, where α ₁ , α ₂ , ..., α _m are natural numbers, 2≤m≤n, α _j ≤n and j = 1, 2, ..., m, and at least one of the multi-bit binary numbers depending on the collective public key R. 2. The method according to claim 1, characterized in that the collective public key P is formed depending on the points of the elliptic curve

according to the formula

,
where w _j are auxiliary multidigit binary numbers. 3. The method according to claim 1, characterized in that when generating public keys, points P ₁ , P ₂ , ..., P _{n of an} elliptic curve are generated by the formula P _i = d _i G, where i = 1, 2, ..., n, G is the additionally generated point of the elliptic curve, ad _i = zk _i mod q, z> 1 is a natural number, q is the order of the point G of the elliptic curve, the electronic digital signature Q is formed in the form of four multi-bit binary numbers x _R , y _R , x _Z and y _Z , for which m random multi-bit binary numbers are generated

generate m points

elliptic curve according to the formula

Where

j = 1, 2, ..., m, after which the first and second multi-digit binary numbers of the electronic digital signature are generated in the form of abscissas x _R and ordinates y _{R of the} point R of the elliptic curve by generating the point R of the elliptic curve according to the formula

then an intermediate multi-bit binary number e is generated by the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is an auxiliary multi-bit binary number, m points are generated

elliptic curve according to the formula

and then the third and fourth multi-digit binary numbers of the electronic digital signature are generated in the form of abscissas x _Z and ordinates y _{Z of the} point Z of the elliptic curve by generating the point Z of the elliptic curve according to the formula

moreover, the first test multi-bit binary number A is formed by the formula A = x _W , where x _W is the abscissa of the point W of the elliptic curve calculated by the formula W = zZ, and the second test multi-bit binary number B is formed by the formula B = x _U , where x _U - the abscissa of the point U of the elliptic curve calculated by the formula U = eP + R. 4. The method according to claim 1, characterized in that when generating public keys, points P ₁ , P ₂ , ..., P _{n of the} elliptic curve are generated by the formula P _i = d _i G, where i = 1, 2, ..., n, G is the additionally generated point of the elliptic curve, ad _i = zk _i mod q, z> 1 is a natural number, q is the order of the point G of the elliptic curve, the electronic digital signature Q is formed in the form of three multi-bit binary numbers e, x _z and y _z , why m random multi-bit binary numbers are generated

generate m points

elliptic curve according to the formula

Where

, j = 1, 2, ..., m, generate a point R of the elliptic curve according to the formula

after which the first multi-bit binary number e of the electronic digital signature is formed according to the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary multi-bit binary number, then m points are generated

elliptic curve according to the formula

then generate the second and third multi-digit binary numbers of the electronic digital signature in the form of abscissas x _Z and ordinates y _{Z of the} point Z of the elliptic curve by generating the point Z of the elliptic curve according to the formula

moreover, the first test multi-bit binary number A is formed by the formula A = x _{R '} H mod δ, where x _R' is the abscissa of the point R 'of the elliptic curve calculated by the formula R' = zZ-eP, and the second test multi-bit binary number B is formed by formula B = e. 5. The method according to claim 1, characterized in that when generating public keys, points P ₁ , P ₂ , ..., P _{n of the} elliptic curve are generated according to the formula P _i = k _i G, where i = 1, 2, ..., n, G is an additionally generated point of the elliptic curve of order q, and an electronic digital signature is formed as a pair of multi-bit binary numbers e and s, for which t random multi-bit binary numbers are generated

generate m points

elliptic curve according to the formula

where j = 1, 2, ..., m, generate a point R of the elliptic curve according to the formula

after which the first multi-bit binary number e of the electronic digital signature is formed by the formula e = x _R H mod δ, where x _R is the abscissa of the point R and δ is the auxiliary simple multi-bit binary number, then m multi-bit binary numbers are generated

according to the formula

then generate a second multi-bit binary number s of electronic digital signature according to the formula

moreover, the first test multi-bit binary number A is formed by the formula A = x _{R '} H mod δ, where x _R' is the abscissa of the point R 'of the elliptic curve calculated by the formula R' = eP + sG, and the second test multi-bit binary number B is formed by formula B = e.