CN100518059C - Quadratic region code producing method and signature method - Google Patents

Abstract

The present invention provides a kind of quadratic field password generation method, comprising: to given prime number q, finds quadratic field

, make its class number h (D1) containing prime factor q, and D1 is the quadrat-free number containing the Big prime factor; Selected Big prime p meets gcd (q, p- (D1/p))=1, and (D1/p) indicates Legendre symbol; Obtain non-maximum order quadratic field

, D=D1p2 here;

In establish quadratic field cryptosystem, system only needs open parameter D.

Description

Quadratic field password production method and quadratic field cryptographic signatures method

Technical field

The invention belongs to information security and field of cryptography, relate in particular to quadratic field password production method and quadratic field cryptographic signatures method.

Background technology

Integer resolution problem (IFP) and discrete logarithm problem (DLP) are the important difficult problems of two classes of structure public-key cryptosystem.Tool is represented having based on the RSA Algorithm of IFP with based on the ElGamal algorithm of GF-DLP (DLP in the multiplicative group in Galois territory) of meaning.Be regarded as replacing the elliptic curve cryptography (ECC) of RSA Algorithm to be based on elliptic curve DLP on the Galois territory at present, elliptic curve DLP once was considered to than GF-DLP difficulty.But Menezes, Okamoto and Vanstone utilize Weil pairing to propose famous MOV attack method, and the conclusion that draws is: elliptic curve DLP can reduction arrive GF-DLP.

The quadratic field password is to be proposed by Buchmann and Williams in 1988 the earliest, and their thought is discrete logarithm problem (CL-DLP) the structure Diffie-Hellman cipher key exchange system that utilizes in the quadratic field ideal class group.CL-DLP is difficult as IFP at least, so the quadratic field password is attracting cryptography researcher extensive interest.But,, cause the thought of many existing discrete logarithm password designs to be difficult to use wherein because its particularity is asked very difficulty of its ideal class order of a group (being the class number).Therefore, never obtain development fully based on the cryptographic system of discrete logarithm on the quadratic field monoid and the research of signature system.

2000, Hamdy and

Provided the character that safe quadratic field must satisfy clearly.But be difficult to the compute classes number still is topmost obstacle on the road for development.

In the same year, people such as Hamdy utilize root problem thought, have proposed first real effective signature system based on quadratic field.This system has been avoided the demand of compute classes number fully, but its signature is long.

In this case, the CL-DLP of some non-maximum order imaginary quadratic field (non-maximalimaginary quadratic orders) can be summed up as GF-DLP originally, but people can only study password based on non-maximum order imaginary quadratic field with bigger cost.

Meanwhile, the present inventor has opened up a new road by Diophantine equation, has proposed to provide under the situation of not knowing the class number cryptography scheme of the big prime factor of class number, but demand side is to big CALCULATION OF PARAMETERS problem.

So, the quadratic field cryptographic system of the practical and high level of security of neither one still so far.

A kind of cryptographic system design principal mode based on non-maximum order imaginary quadratic field of prior art is:

Get imaginary quadratic field

In $D=-2^{\mathrm{\δ}}{q}^{2^{{\mathrm{\δ}}_1}}{p}^{2^{{\mathrm{\δ}}_2}},$ Here p, q is two big prime numbers, δ, δ ₁, δ ₂∈ 0,1} and δ ₁+ δ ₂＞0.Work as D=-2p ², when p is a big prime number,, the class of quadratic field K satisfies because counting h (Δ): for Δ＜0, and Δ ≠-3 ,-4,

$h\left({\mathrm{\Δf}}^2\right)=h\left(\mathrm{\Δ}\right)f\underset{p|f}{\mathrm{\Π}}(1-\left(\frac{\mathrm{\Δ}}{p}\right)\frac{1}{p})$

Here f is a positive integer, Be the Kronecker symbol, Δ is the discriminant of K, promptly

So know by h (8)=1, $h(-8p^2)=p-\left(\frac{-8}{p}\right),$ Here

It is the Legendre symbol.H ü hnlein and Takagi have proved that at this moment CL-DLP can be GF (p)-DLP or GF (p by polynomial time reduction ²)-DLP.Henceforth, get D=-qp ²Research quadratic field password is designed to first-selection, p here, and q is two big prime numbers, its fail safe is not less than qp ²Decomposition.

D=-qp is satisfied in utilization ²Non-maximum order imaginary quadratic field The structure password is a password design with high security.But it has the defective of a maximum: because

$h(-q{p}^2)=h(-q)p(1-\left(\frac{-q}{p}\right)\frac{1}{p})=h(-q)(p-\left(\frac{-q}{p}\right))$

Need calculate h (q) so realize cryptographic system.But two prime number p, q needs to obtain very big, calculates h and (q) become difficult when q is very big.Because after reaching the high security requirement, it is very big that q will select, so cause the realization difficulty of prior art one.

Mainly to be the inventor propose based on the method for Diophantine equation another kind of prior art under the situation of not knowing the class number, the cryptography scheme that utilizes the big prime factor of the class number that provides to construct.But this scheme demand side is to big CALCULATION OF PARAMETERS problem, behind the big prime factor q of promptly given class number, and the quadratic field that obtains according to Diophantine equation

In D big especially, this realization to the quadratic field password has brought difficulty.

Summary of the invention

The quadratic field cryptographic system method for designing and the quadratic field cryptographic signatures method that the purpose of this invention is to provide a kind of practicality and high level of security have solved the practicability problem of the quadratic field cryptographic system of high level of security.

According to first aspect, the invention provides a kind of quadratic field cryptographic system method for designing, comprising:,, find quadratic field given not too big prime number q according to the Diophantine equation theory

Make its class count h (D ₁) contain prime factor q, and D ₁It is the quadrat-free number that contains big prime factor; Wherein, the described quadratic field that finds

Step comprise: by cx ²+ 2 ^2mR=y ^qCalculate cx ², m here, x is a positive integer, r is big prime number, positive integer y＞1, c is a quadrat-free number; Get D ₁=-cr;

Selected big prime number p satisfies $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$

Expression is reined in and is allowed call sign;

Obtain non-maximum order quadratic field

Here D=D ₁p ²

Utilize described non-maximum order quadratic field

And formula $h\left(\mathrm{\Δ}{p}^2\right)=h\left(\mathrm{\Δ}\right)(p-\left(\frac{\mathrm{\Δ}}{p}\right))$ Set up the quadratic field cryptographic system; Wherein,

Be the Legendre symbol, Δ=(2/ σ) ²D ₁, work as D ₁During ≡ 2,3 (mod4), the σ value is 1, works as D ₁During ≡ 1 (mod4), the σ value is 2, and system only need disclose parameter D.

According to second aspect, the invention provides a kind of quadratic field cryptographic signatures method, comprising:

Choose k＜L, calculate the desirable R～G of reduction ^kWherein L is big integer, and G is that rank among the quadratic field monoid CK are

Unit, D=D ₁p ², p is big prime number, D ₁Contain big prime factor, and satisfy q|h (D ₁) and $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$ $k=Q\left(\sqrt{D}\right);$ $L<q(p-\left(\frac{D_1}{p}\right));$

Calculate h=H (M||R); Wherein, H represents one-way hash function, and M represents message to be signed;

Calculate y=k+hx, thereby obtain signature for S (M)=(h, y), wherein x＜L is a secret keys.

The present invention constructs the algorithm of safe quadratic field to utilize Diophantine equation, at the existing difficult point of system on computational efficiency, utilize the speciality of quadratic field, merged the situation of non-maximum order quadratic field cleverly, eliminate the necessity of in system parameters, announcing the factor of class number, thereby provided the higher quadratic field cryptographic system of privacy degrees.Owing to the raising of confidentiality, allow to shorten safely the length of system parameters in this system.

Description of drawings

Fig. 1 is a quadratic field according to a preferred embodiment of the invention

Generate method flow diagram.

Embodiment

The present invention will be described in more detail below with reference to accompanying drawings.

(1) notion of quadratic field and monoid

In order to introduce quadratic field cryptographic system of the present invention, the basic conception of at first introducing quadratic field and monoid here (can be referring to Hua Luogeng ^[14]), establish $K=Q\left(\sqrt{D}\right)$ Be quadratic field, D is the integer of the quardratic free factor here.Establish again

$\mathrm{\&omega;}=\frac{\mathrm{\&sigma;}-1+\sqrt{D}}{\mathrm{\&sigma;}},$

The discriminant (discriminant) of then knowing K is Δ=(2/ σ) ²D.If α, β ∈ K represents the conjugation (conjugate) of α in K with α, and represents mould (module) with [α, β], promptly

The mark (trace) and model (norm) of representing α with Tr (α)=α+α and N (α)=α α respectively.If O _K=

O then _K=[1, ω].

Establish α again ₁..., α _m∈ O _KFor appointing m the integer of giving, claim set

{η ₁α ₁+…+η _mα _m|η _i∈O _K(i＝1，…，m)}

For by α ₁..., α _mThe K or the O that generate _KIn ideal, be designated as [α ₁..., α _m].If A=[is α ₁..., α _m], B=[β ₁..., β _k] be two ideals among the K, the product of definition A and B is

AB＝[α ₁β ₁，…，α ₁β _k，α ₂β ₁，…，α ₂β _k，…，α _mβ ₁，…，α _mβ _k]

Because integer item O _KBe the Dedekind domain, so O _KIn desirable unique decomposition theorem set up, promptly arbitraryly be not equal to zero non-unit ideal, as disregard the order of decomposition, then can uniquely resolve into the product of limited prime ideal.If α, β ∈ O _K, if A|[-β], then claim α, β is designated as α ≡ β (modA) to mould A congruence.Can be according to these congruence relations with O _KCarry out equivalence classification, its class number is called the model of ideal A, and (obviously, N (A) is quotient ring O to be designated as N (A) _KThe rank of/A).

Introduce the notion of the class number of K below.If A, B are two ideals on the K, if the principal ideal [α] on the K is arranged, [β] exists makes [α] A=[β] B, claim A and B to belong to an ideal class together so, be designated as A～B.This obviously is an equivalence relation.Concern that thus K can be gone up all ideals carries out equivalence classification, all equivalence classes (being ideal class) are for class C _iWith class C _iMultiplication constitute ideal class group C _K, here

C _iC _j＝{AB|A∈C _i，B∈C _j}

Dirichlet has proved C _KIt is a Finite Abel Group.So C _KRank be limited, be called K or O _KThe ideal class number, be called for short the class number, be designated as h (K) or h (D).This is obvious: to C _KIn any ideal A, α ∈ O is always arranged _KMake A ^{H (K)}=[α], i.e. A ^{H (K)}～[1]; And if A ⁿ=[α], l=(n, h (K)), A so ^l～[1].

In quadratic field K, O _KIntegral ideal can be expressed as

Here a, b ∈ Z, a＞0 and 4a| (b ²-Δ), promptly exist a positive integer c to make Δ=b ²(c)=1 ,-a＜b≤a≤c and when a=c requires b 〉=0 for a, b, and is so desirable if-4ac. is gcd

Being said to be is the reduction ideal.Ideal class group C _KIn, a reduction ideal is just arranged in each ideal class.So, C under the meaning of isomorphism _KCan be expressed as the desirable set of reduction of mutual non-equivalence.

Gross and Zagier have proved following important theorems to imaginary quadratic field:

Gross-Zagier theorem: establish

Be that discriminant is the imaginary quadratic field of D, h (D) is its class number, then has

$h\left(D\right)>\frac{1}{55}\left(\log \right|D\left|\right)\underset{\underset{p\&NotEqual;\left|D\right|}{p|D}}{\mathrm{\&Pi;}}(1-\frac{\left[2\sqrt{p}\right]}{p+1})$

Wherein p is a prime number, and [x] expression is no more than the maximum integer of x.

For real quadratic field, corresponding problem is difficult to.Main difficulty is canonical of real quadratic field.Because the scrambling of canonical has caused the research of real quadratic field class number especially difficult.

(2) new quadratic field cryptographic system designs

To use pushing to, just must make it have acceptable operation efficiency, promptly improve the efficient of the parameter existence of calculating quadratic field class number or utilizing Diophantine equation based on the quadratic field cryptographic system.

The quadratic field cryptographic system of utilizing Diophantine equation that the present invention will propose in recent years based on the inventor merges the advantage of non-maximum order quadratic field, proposes the quadratic field cryptographic system method for designing of an attainable high safety.

Be example explanation the present invention with design quadratic field signature below, that is to say that the quadratic field cryptographic system of other types can be come out with the thought translation of introducing here.

Key breakthrough of the present invention is: at first, according to the Diophantine equation theory, to given not too big prime number q, can find quadratic field Make its class count h (D ₁) contain prime factor q, and D ₁It is the quadrat-free number that contains big prime factor; Then, selected big prime number p satisfies $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$

The expression rein in allow (Legendre) symbol, obtain non-maximum order quadratic field

Here D=D ₁p ²At last, exist

In set up the quadratic field cryptographic system, system only need disclose parameter D.

It is feasible doing like this.Fig. 1 is a quadratic field according to a preferred embodiment of the invention

Generate method flow diagram.At first utilize the divisibility result of quadratic field class number, can obtain quadratic field

Make its class number satisfy q|h (D ₁).For example, after selected not too big prime number q, select big prime number r more at random, positive integer y＞1 is by cx ²+ 2 ^2mR=y ^qCalculate cx ², m here, x is a positive integer, c is a quadrat-free number, if get D ₁=-cr then has q|h (D ₁).

Then, make D=D ₁p ², p is big prime number, utilizes non-maximum order quadratic field

And formula $h\left(\mathrm{\&Delta;}{p}^2\right)=h\left(\mathrm{\&Delta;}\right)(p-\left(\frac{\mathrm{\&Delta;}}{p}\right)),$

Here

Be the Legendre symbol,

Δ＝(2/σ) ²D ₁，

Set up cryptographic system.Because $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$ So be easy to find rank to be

Existence unit.

At last, illustrate and set up the D that quadratic field cryptographic signatures system only need disclose quadratic field.Just disclose and hide q, the information of p in the version in system.

The present invention is similar to the Schnorr signature system, but combines the feature of quadratic field, eliminates and announces big prime factor q, and the needs of p are described below:

System design: establish D=D ₁p ², p is big prime number, D ₁Contain big prime factor, and satisfy q|h (D ₁) and $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$ G is quadratic field monoid C _KIn rank be

Unit.

Choose big integer L, make $L<q(p-\left(\frac{D_1}{p}\right)).$ In order not make the L value too small, suggestion is got $L<q(p-\left(\frac{D_1}{p}\right))<2L.$

Definition one-way hash function H:{0,1} ^*→ (1, L),

The open parameter of system is D, L, G, H.At this moment, q, p no longer needs, and can destroy.

Obviously, hash function does not disclose any information of quadratic field.

Cipher key calculation: user A chooses a random number x＜L wantonly, and calculates the desirable V～G of reduction ^-xSo user A is with the secret keys of x as him,, with the open key of V as him.

Signature: establish user A desire message M is signed,

His picked at random k＜L at first of Step 1. calculates the desirable R～G of reduction ^k

Step 2. calculates h=H (M||R) then;

Step 3. calculates y=k+hx.

So the signature of A be S (M)=(h, y).

Checking: verifier B calculates the desirable R ' of reduction～G ^yV ^h, checking h=H (M||R ').

The most important difference of this programme and Schnorr is the Step 3 of signature process.In the Schnorr system, the signature equation is y=k+hx (modq).And in this system, do not have modulo operation.It should be noted that: in Schnorr algorithm signature equation calculated, modular arithmetic was necessary (modulus can be q, also the factor on the rank that can be divided exactly by q).This is not only in order to shorten signature and to raise the efficiency, and the more important thing is that the signature system that carries out in GF (p) if there is not modular arithmetic, just can be attacked whole system by Chinese remainder theorem, to forge a signature.

A kind of distortion of Schnorr system, having provided to close number is the signature system of mould.In this system, the modular arithmetic in calculating even without the signature equation, above-mentioned attack also can't be carried out.

In the ideal class group of quadratic field, utilize the attack of Chinese remainder theorem not exist equally.And this security feature has just produced very large meaning for the quadratic field signature system.Because characteristic is removed modular arithmetic, thereby has been eliminated announcement q to a great extent, necessity of p in the signature equation in view of the above.

Because announce q, the other partial function of p is given k, the span of x, this demand also has been eliminated by providing big integer L.

So far, can hide q in system's bulletin fully, p promptly hides the important information about quadratic field, even make the shortening parameter q, still can keep fail safe.Because parameter q is shortened, and no matter is in setting up the process of system, still in the process of signature or checking, computational efficiency all obtains obvious improvement, utilizes the applicability of the quadratic field signature system of Diophantine equation to be improved greatly.

Because the discrete logarithm problem CL-DLP on the ideal class group of quadratic field has higher difficulty than common GF-DLP and IFP, thereby also has higher fail safe for the quadratic field cryptographic system.But existing cryptographic system based on quadratic field has operation efficiency respectively and realizes the problem of difficulty, can't satisfy the needs of practical application fully.

The present invention constructs the algorithm of safe quadratic field to utilize Diophantine equation, at the existing difficult point of system on computational efficiency, utilize the speciality of quadratic field, merged the situation of non-maximum order quadratic field cleverly, eliminate the necessity of in system parameters, announcing the factor of class number, thereby provided the higher quadratic field cryptographic system of privacy degrees.Owing to the raising of confidentiality, allow to shorten safely the length of system parameters in this system.

Because the shortening of system parameters is compared with original quadratic field system, the present invention is enhanced on efficient, has overcome the major obstacle of existing quadratic field cryptographic system, has satisfied the demand of safe practical application.

Obviously, the present invention described here can have many variations, and this variation can not be thought and departs from the spirit and scope of the present invention.Therefore, the change that all it will be apparent to those skilled in the art all is included within the covering scope of these claims.

Claims (4)

1. quadratic field cryptographic system method for designing comprises:

Prime number q to given finds quadratic field

Make its class count h (D ₁) contain prime factor q, and D ₁It is the quadrat-free number that contains big prime factor; Wherein, the described quadratic field that finds

Step comprise: by cx ²+ 2 ^2mR=y ^qCalculate cx ², m here, x is a positive integer, r is big prime number, positive integer y＞1, c is a quadrat-free number; Get D ₁=-cr;

Selected big prime number p satisfies $\gcd (q,p-\left(\frac{D_1}{p}\right))=1,$

Expression is reined in and is allowed call sign;

Obtain non-maximum order quadratic field

Here D=D ₁p ²

Utilize described non-maximum order quadratic field

And formula $h\left({\mathrm{\&Delta;p}}^2\right)=h\left(\mathrm{\&Delta;}\right)(p-\left(\frac{\mathrm{\&Delta;}}{p}\right))$ Set up the quadratic field cryptographic system; Wherein,

Be the Legendre symbol, Δ=(2/ σ) ²D ₁, work as D ₁During ≡ 2,3 (mod 4), the σ value is 1, works as D ₁During ≡ 1 (mod 4), the σ value is 2, and system only need disclose parameter D.

2. quadratic field cryptographic signatures method comprises:

Choose k＜L, calculate the desirable R～G of reduction ^kWherein L is big integer, and G is quadratic field monoid C _KIn rank be

Unit, D=D ₁p ², p is big prime number, D ₁Contain big prime factor, and satisfy q|h (D ₁) and $\gcd (q,p-\left(\frac{D_1}{p}\right))=1;$ $k=Q\left(\sqrt{D}\right);$ $L<q(p-\left(\frac{D_1}{p}\right));$

Calculate h=H (M||R); Wherein, H represents one-way hash function, and M represents message to be signed;

Calculate y=k+hx, thereby obtain signature for S (M)=(h, y), wherein x＜L is a secret keys.

3. quadratic field cryptographic signatures method as claimed in claim 2 is characterized in that comprising the desirable R ' of calculating reduction～G ^yV ^h, the step of checking h=H (M||R '), wherein V is the open key corresponding with x.

4. quadratic field cryptographic signatures method as claimed in claim 2 is characterized in that L gets $L<q(p-\left(\frac{D_1}{p}\right))<2L.$

Images