CN101296075A - Identity authentication system based on elliptic curve - Google Patents

Abstract

The invention discloses an identity authentication system based on an elliptic curve. A public key and private key pair, a DH cipher code exchange protocol and hashing functions preset in equipment are used for realizing fast identity authentication, thus preventing the identity authentication by using complicated arithmetic in a public key certificate system, such as a certificate chain and digital signature. The public and private key pair of equipment A are x and xG, and the public and private key pair of equipment B are y and yG; when carrying out the identity authentication, the equipment A and the equipment B exchange x and y (or xG and yG), then both calculate scalar multiplication xyG. The equipment A and the equipment B utilize hashing function H to operate each scalar multiplication result xyF so as to obtain hash value h1 and h1'; if h1=h1', both equipment are legal. The system can be used in software and hardware environments, such as digital content protection interface, e-business, banking system, smart card, and identity authentication, etc.

Description

A kind of identity authorization system based on elliptic curve

Technical field

The present invention is a kind of identity authorization system, specifically is based on elliptic curve cipher system and DH IKE, the method that the legitimacy of communicating pair identity is authenticated.

Background technology

In various message transfer systems,, need authenticate participating in identity of entity for the entity that guarantees to participate in information exchange is legal, effectively.For example in military communication, need to confirm the other side's identity, to prevent the leakage of military information information; In internet environments such as ecommerce, need differentiate the other side's identity; In applied environments such as smart card, need the legal validity of access device be authenticated; In the intellectual property field, need by the intellectual property content is encrypted, means such as signature guarantee illegally not stolen.Usually before communicating pair transmitted ciphered data, carry out authentication to equipment all was real, legal and valid with the identity that guarantees communicating pair.If authentication can not be succeedd, then do not carry out transfer of data or can not carry out correct deciphering, to allow protected data information not be subjected to illegal infringement to ciphered data.

Diffie in 1976 and hellman have proposed the thought of public key cryptography, the new era of having started public key cryptography in " cryptographic new direction ".In cryptographic system, generally issue device certificate and device private for each equipment by authoritative institution trusty based on public key system.The PKI that communicating pair utilizes the root certificate extracts information such as the PKI of method, apparatus and ID with the form of certificate chain.With the device private of oneself some public information data are carried out digital signature by a side then, the opposing party utilizes the other side's PKI that this signing messages is verified, so can verify the legitimacy to method, apparatus.The fail safe of public-key cryptosystem all is based on finds the solution certain mathematics difficult problem, and elliptic curve cryptography wherein has many-sided advantage.The difficulty of finding the solution of elliptic curve is exponential, is higher than any in the past cryptographic algorithm; Elliptic curve has the shortest key length under identical security intensity, so just makes its requirement to memory space few; In digital signature and checking, encryption and decryption scheduling algorithm, the amount of calculation of elliptic curve is little, and processing speed is fast, relatively is suitable in the resource constrained environment.

Multiple Verification System and identifying algorithm are arranged at present, roughly be divided into unilateral authentication system (Fig. 1) and two-way authentication system (Fig. 2).Generally the elliptic curve basic point G based on the Verification System of ECC is disclosed, and they all are that certificate of utility chain and digital signature come equipment is authenticated.The unilateral authentication system can only guarantee the legitimacy of certified equipment, and can not guarantee the legitimacy of authenticating device; Have only two-way authentication could guarantee that the authentication both sides are legitimate device, but the two-way authentication more complicated, and consumed time and resource are all many.The present invention proposes a kind of brand-new authentication thinking, avoided the method that authenticates by certificate chain and digital signature.By the selected elliptic curve parameter of third party authority trust authority, and strictness is maintained secrecy to basic point G, produce to share key xyG by exchange x, y (perhaps xG, yG), according to the whether consistent legitimacy of coming judgment device of xyG that communicating pair calculated, as shown in Figure 3.This method has not only realized the legitimacy check of communicating pair equipment, simplified verification process, and the data of exchange only are x, y (perhaps xG, yG), and the prison hearer at all can't solution point xG, yG (perhaps x, y) and the coordinate of basic point G, thereby makes system have higher security intensity.

Summary of the invention

The purpose of this method is to utilize elliptic curve and DH exchange algorithm in the public-key cryptosystem to produce shared key, judges by the consistency of the contrast shared key that communicating pair produced whether the communication two ends all are legal and valid equipment.This method is as follows:

1, at first selected elliptic curve parameter (p, a, b, G, n, h) etc.;

Wherein need disclosed parameter to be:

P is prime field F _pRank, a, b are Elliptic Curve y ²=x ³The coefficient of+ax+b;

The parameter that need hold in close confidence is:

G is a point on the elliptic curve, and n is the rank of a G, and h is a cofactor.

2, be respectively device A and B and select two parameter: x, y, requirement $x,y\∈[1,\sqrt{n-1}],$ And calculate the elliptic curve scalar and take advantage of xG and yG.X and xG are distributed to device A, y and yG are distributed to equipment B, and hold xG and yG in close confidence.

3, device A sends x to equipment B, and equipment B sends y to device A.

4, device A calculating scalar takes advantage of yxG to obtain sharing key xyG; Equipment B is calculated scalar and is taken advantage of xyG, obtains sharing key xyG.

5, device A and equipment B are shared cryptographic Hash h1 and the h1 ' of key xyG respectively with the digital digest function calculation, and will calculate cryptographic Hash and send to the other side.

6, communicating pair will receive cryptographic Hash and compare with the own cryptographic Hash of calculating, if h1=h1 ', then the communicating pair authentication successfully; Otherwise, returned for the 3rd step to re-execute authentication.

In the above verification process, x, y can be holded in close confidence, and communicating pair exchange xG and yG.Also can basic point G be implanted equipment, select random number x, y, and calculate scalar and take advantage of xG and yG, carry out both sides' authentication by exchange x, y (perhaps xG, yG) then by equipment oneself with the form of maintaining secrecy.In whole authentication process, if parameter x, y ∈ [1, n-1], the value of xy might be more than or equal to the rank n of basic point G, thus communicating pair calculate share key xyG after, need to detect whether it is infinite point.If xyG is an infinite point, then need to return the value of reselecting x or y.If $x,y\∈[1,\sqrt{n-1}],$ Whether then do not need to detect xyG is infinite point.

Third party device can be monitored and steal has only two parameters of x, y (perhaps xG, yG), assailant almost have no idea to calculate with this value of basic point G and xG, yG (perhaps x, y), so this identity authorization system is very safe.

Description of drawings

Fig. 1 is general unilateral authentication process

Fig. 2 is general mutual authentication process

Fig. 3 is an authentication process of the present invention

Embodiment

When concrete operations realized, all parameters of this algorithm were determined by third party trusty authoritative institution.Open a part of parameter, and another part parameter holds in close confidence, and relevant parameters is set in device A and the equipment B goes.For for simplicity, present embodiment has been selected P-192 elliptic curve and some simple parameters on the prime field that NIST recommended for use.

At first by the selected elliptic curve parameter of authoritative trust authority (p, a, b, G, n, h) etc.:

Wherein need disclosed parameter to be:

Elliptic curve equation y ²=x ³-ax-b

P＝2 ¹⁹²-2 ⁶⁴-1

a＝-3(mod?p)＝p-3＝2 ¹⁹²-2 ⁶⁴-2 ²

b＝0x?64210519?E59C80E7?0FA7E9AB?72243049?FEB8DEEC?C146B9B1

The parameter that need hold in close confidence is:

G _x＝0x?188DA80E?B03090F6?7CBF20EB?43A18800?F4FF0AFD?82FF1012

G _y＝0x?07192B95?FFC8DA78?631011ED?6B24CDD5?73F977A1?1E794811

n＝0x?FFFFFFFF?FFFFFFFF?FFFFFFFF?99DEF836?146BC9B1?B4D22831

h＝1

Basic point G should be chosen and be holded in close confidence by authoritative trust authority, chooses the basic point parameter G that NIST recommends herein for the sake of simplicity.

Be that device A and equipment B are chosen two ostensible device private x, y by authoritative trust authority then, and $x,y\∈[1,\sqrt{n-1}],$ X, y value are x=y=1 in order to calculate simply herein.Calculating scalar takes advantage of xG, yG as follows:

xG _x＝0x?188DA80E?B03090F6?7CBF20EB?43A18800?F4FF0AFD?82FF1012

xG _y＝0x?07192B95?FFC8DA78?631011ED?6B24CDD5?73F977A1?1E794811

yG _x＝0x?188DA80E?B03090F6?7CBF20EB?43A18800?F4FF0AFD?82FF1012

yG _y＝0x?07192B95?FFC8DA78?631011ED?6B24CDD5?73F977A1?1E794811

Take advantage of xG and yG as the PKI of equipment scalar, be allocated as follows: public private key pair xG and x distribute to device A, and public private key pair yG and y distribute to equipment B.Wherein, private key x and y hold in close confidence.Mutual authentication process is as follows:

1, device A sends xG to equipment B, and equipment B sends yG to device A.

2, device A calculating scalar takes advantage of xyG to obtain sharing key yxG; Equipment B is calculated scalar and is taken advantage of yxG, obtains sharing key xyG.Result of calculation is as follows:

yxG _x＝0x?188DA80E?B03090F6?7CBF20EB?43A18800?F4FF0AFD?82FF1012

yxG _y＝0x?07192B95?FFC8DA78?631011ED?6B24CDD5?73F977A1?1E794811

xyG _x＝0x?188DA80E?B03090F6?7CBF20EB?43A18800?F4FF0AFD?82FF1012

xyG _y＝0x?07192B95?FFC8DA78?631011ED?6B24CDD5?73F977A1?1E794811

3, device A and equipment B are calculated cryptographic Hash h1 and the h1 ' that shares key xyG with digital digest function S HA-1 respectively, and both sides exchange the Hash Value that calculates.

The equipment both sides will receive cryptographic Hash h1 ' and compare with the local cryptographic Hash h1 that calculates, h1=h1 ', and both sides' authentication is passed through, and communicating pair all is a legitimate device.

Claims (8)

1, a kind of identity authorization system based on elliptic curve utilizes elliptic curve cipher system and DH IKE, and communication equipment both sides' legitimacy is carried out authentication.It is characterized in that: hold parameters such as rank n that elliptic curve basic point G, G order and cofactor h in close confidence, the rank p of open large prime field, elliptic curve parameter (a, parameter such as b); Selection integer x, y also calculate scalar and take advantage of xG, yG, and the authentication both sides exchange x, y (perhaps xG, yG) back calculating scalar and take advantage of xyG and yxG; Can both sides' identity legitimacy be authenticated by the consistency that compares xyG and yxG.

2, a kind of identity authorization system based on elliptic curve according to claim 1 is characterized in that: and public private key pair (x, xG) and (y is through precomputation and being preset in the equipment yG).

3, a kind of identity authorization system according to claim 1 based on elliptic curve, it is characterized in that: basic point G is preset in the equipment with the form of safety, on-the-spot random number x or the y of selecting of authentication both sides, and calculate scalar and take advantage of xG or yG.

4, according to claim 2 or 3 described a kind of identity authorization systems, it is characterized in that: integer based on elliptic curve $x,y\∈[1,\sqrt{n-1}],$ And the bit wide of x, y can be half of the bit wide of the rank n of basic point G, and scalar takes advantage of the bit wide of xG, yG can be consistent with the bit wide of the rank n of basic point G; It is generic point on the elliptic curve that the scalar that generates is taken advantage of xyG as a result.

5, a kind of identity authorization system according to claim 3 based on elliptic curve, it is characterized in that: the random number x of selection, y ∈ [1, n-1], the bit wide of x, y is consistent with the bit wide of the rank n of basic point G, and scalar takes advantage of the bit wide of xG, yG can be consistent with the bit wide of the rank n of basic point G; Whether need to detect it after the generation scalar is taken advantage of xyG is infinite point.

6, according to claim 4 or 5 described a kind of identity authorization systems based on elliptic curve, it is characterized in that: authentication both sides exchange be the PKI of equipment, x, y are during as the equipment PKI, xG, yG are as device private, perhaps xG, yG are as the equipment PKI, and x, y are as device private.

7, a kind of identity authorization system based on elliptic curve according to claim 6 is characterized in that: both sides are when carrying out information exchange in authentication, and the information that interception facility can listen to only has only x, y (perhaps xG, yG) and h1, h1 '.

8, a kind of identity authorization system according to claim 7 based on elliptic curve, it is characterized in that: can use anti-collision hash function H to take advantage of xyG to carry out Hash operation to the scalar that the authentication both sides generate, whether the xyG that generates by the authentication verification both sides is consistent judges whether the identity that authenticates both sides all is legal.

Images