EP1025674A1 - Verification de signature pour systemes elgamal - Google Patents

Verification de signature pour systemes elgamal

Info

Publication number
EP1025674A1
EP1025674A1 EP98952457A EP98952457A EP1025674A1 EP 1025674 A1 EP1025674 A1 EP 1025674A1 EP 98952457 A EP98952457 A EP 98952457A EP 98952457 A EP98952457 A EP 98952457A EP 1025674 A1 EP1025674 A1 EP 1025674A1
Authority
EP
European Patent Office
Prior art keywords
signature
mod
value
calculating
verify
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP98952457A
Other languages
German (de)
English (en)
Inventor
Donald B. Johnson
Scott A. Vanstone
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Certicom Corp
Original Assignee
Certicom Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Certicom Corp filed Critical Certicom Corp
Publication of EP1025674A1 publication Critical patent/EP1025674A1/fr
Withdrawn legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
    • H04L9/3013—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • G06F7/724—Finite field arithmetic
    • G06F7/725—Finite field arithmetic over elliptic curves

Definitions

  • This invention relates to a method of accelerating digital signature verification operations performed in a finite field and in particular to a method for use with processors having limited computing power.
  • One of the functions performed by a cryptosystem is the computation of digital signatures that are used to confirm that a particular party has originated a message and that the contents have not been altered during transmission.
  • a widely used set of signature protocols utilizes the ElGamal public key signature scheme that signs a message with the sender's private key. The recipient may then recover the message with the sender's public key.
  • the ElGamal scheme gets its security from calculating discrete logarithms in a finite field.
  • these cryptosystems can be computationally intensive.
  • a digital signature algorithm DSA is a variant of the ElGamal scheme.
  • a pair of correspondent entities A and B each create a public key and a corresponding private key.
  • the entity A signs a message m of arbitrary length.
  • the entity B can verify this signature by using A's public key.
  • both the sender, entity A, and the recipient, entity B are required to perform a computationally intensive operations to generate and verify the signature respectively.
  • either party has adequate computing power this does not present a particular problem but where one or both the parties have limited computing power, such as in a "Smart card " application, the computations may introduce delays in the signature and verification process.
  • the signor is required to verify its own signature.
  • a public key cryptographic system the distribution of keys is easier than that of a symmetric key system.
  • the integrity of public keys is critical.
  • the entities in such a system may use a trusted third party to certify the public key of each entity.
  • This third party may be a certifying authority (C A), that has a private signing algorithm S ⁇ and a verification algorithm V ⁇ assumed to be-known by all entities.
  • the CA provides a certificate binding the identity of an entity to its public key. This may consist of signing a message consisting of an identifier and the entity's authenticated public key. From time to time however the CA may wish to authenticate or verify its own certificates. Thus in these instances it would be convenient to implement an improved signature verification algorithm to speed up this verification process.
  • This invention seeks to provide a digital signature verification method, which may be implemented relatively efficiently by a signor on a processor with limited processing capability, such as a smart card or where frequent verifications are performed such as a certification authority.
  • a method of verifying a digital signature generated by a signor in a computer system comprising the steps of: a) in the computer system signing a message m by; b) generating a first signature component by combining at least the element g and the signature parameter k according to a first mathematical function; c) generating a second signature component by mathematically combining the first signature component with the private key d, the message m and the signature parameter k; and the signor verifying the signature by: d) recovering a value k' from the signature without using the public key y, and ; e) utilizing the recovered value k' in the first mathematical function to derive a value r' to verify the signature parameter k and k are equivalent.
  • Figure 1 is a schematic representation of a communication system
  • Figure 2 is a flow chart showing a signature algorithm according to the present invention.
  • a data communication system 10 includes a pair of correspondents, designated as a sender A(12), and a recipient B(14), who are connected by a communication channel 16.
  • Each of the correspondents A and B (12,14) includes an encryption unit 18,20 respectively that may process digital information and prepare it for transmission through the channel 16 as will be described below.
  • the sender A assembles a data string, which includes amongst others the public key v of the sender, a message m, the sender's short-term public key k and signature S of the sender A.
  • the data string is sent over the channel 16 to the intended recipient B, who then verifies the signature using A's public key.
  • This public key information may be obtained from a certification authority (CA) 24 or sometimes is set with the message.
  • CA generally has a public file of the entity's public key and identification.
  • each correspondent A and B creates a public key and corresponding private key.
  • the entities A and B select primes p and q such that q divides p-1.
  • a g is selected such that it is an element of order q in F p and the group used is ⁇ g°, g 1 , g 2 ,...g q ⁇ ' ⁇ .
  • the public key information is (p, q, g, y) and the private key is d
  • the public key information is (p, g, y) and the private key is d.
  • the recipient B Normally to verify A's signature (r, s) on the message m, the recipient B should obtain A's authentic public key (p, q, g, y), and verify that 0 ⁇ r ⁇ q and 0 ⁇ s ⁇ q.
  • the verifier in this case the original signor, has knowledge of p, q, g, y, (m), r and s.
  • the verifier need only recover the (secret) per signature value k used and verify this value of k thus obtained in order to verify the signature.
  • the value z ⁇ ' is calculated by inverting z mod q.
  • k' ⁇ ] s(z ⁇ )modq and calculate /c' by inverting k' '1 modq .
  • the signature components are s and e where p is a large public prime, g is a public generator, m is a message, h is a hash function, d is a private key, y - g d mod p is a public key and k is a secret random integer.
  • an advantage of the present invention is where a signor signs data which for example may reside on the signors computer. This can be later verified without use of the correponding public key, instead the signor can use its private key to verify the data. This is also very useful for some applications with limited computational power such as smartcards.
  • the certifying authority or key distribution centre would sign data frequently before it is installed into the various communications systems and then could verify the signatures later.
  • the CA does not require the public key information to verify the signatures but simply uses the private key to verify, as all the other parameters are stored within the secure boundary of the signor.
  • a further application is in the verification of software such in pay-per-use software applications.
  • the present invention is thus generally concerned with an encryption method and system and particularly an elliptic curve encryption method and system in which finite field elements is multiplied in a processor efficient manner.
  • the encryption system can comprise any suitable processor unit such as a suitably programmed general-purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

L'invention concerne un protocole de vérification de signature pour systèmes de signature de type ElGamal. Ce système de vérification de signature numérique permet au signataire du message de vérifier la signature numérique sans utiliser la clé publique. En règle générale, le système informatique du signataire est muni d'une clé secrète d et d'une clé publique y provenant d'un élément g et de la clé secrète d. Le procédé consiste à signer un message m dans le système informatique par génération d'un premier élément de signature combinant l'élément g et le paramètre de signature k suivant une première fonction mathématique, et par génération d'un deuxième élément de signature par combinaison mathématique du premier élément de signature et de la clé secrète d, du message m et du paramètre de signature k. Le signataire vérifie la signature, d'une part en récupérant une valeur k à partir des éléments de signature sans utiliser la clé publique y, d'autre part en utilisant la valeur k' récupérée dans la première fonction mathématique pour générer une valeur r' permettant de vérifier que les paramètres de signature k et k' sont équivalents, et donc de vérifier la signature. La vérification de la signature est applicable aux signatures de type ElGamal et fonctionne dans n'importe quel groupe et, en particulier, dans des groupes de courbe elliptique. La méthode de vérification de la signature convient particulièrement pour des dispositifs ayant une puissance de calcul limitée, tels que les cartes dites 'intelligentes', ou dans les cas où le signataire doit effectuer un grand nombre vérification.
EP98952457A 1997-10-31 1998-11-02 Verification de signature pour systemes elgamal Withdrawn EP1025674A1 (fr)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US96244197A 1997-10-31 1997-10-31
US962441 1997-10-31
PCT/CA1998/001018 WO1999023781A1 (fr) 1997-10-31 1998-11-02 Verification de signature pour systemes elgamal

Publications (1)

Publication Number Publication Date
EP1025674A1 true EP1025674A1 (fr) 2000-08-09

Family

ID=25505878

Family Applications (1)

Application Number Title Priority Date Filing Date
EP98952457A Withdrawn EP1025674A1 (fr) 1997-10-31 1998-11-02 Verification de signature pour systemes elgamal

Country Status (5)

Country Link
EP (1) EP1025674A1 (fr)
JP (2) JP4307589B2 (fr)
AU (1) AU1015499A (fr)
CA (1) CA2306468A1 (fr)
WO (1) WO1999023781A1 (fr)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5348148B2 (ja) * 2003-07-25 2013-11-20 株式会社リコー 通信装置、通信システム、通信方法及びプログラム
JP4712326B2 (ja) * 2003-07-25 2011-06-29 株式会社リコー 通信装置、通信システム、通信方法及びプログラム
JP4611680B2 (ja) * 2003-07-25 2011-01-12 株式会社リコー 通信装置、通信システム、通信方法及びプログラム
US9240884B2 (en) 2003-10-28 2016-01-19 Certicom Corp. Method and apparatus for verifiable generation of public keys
WO2005078986A1 (fr) 2004-02-13 2005-08-25 Certicom Corp. Authentification unidirectionnelle
CN103108325B (zh) * 2011-11-10 2018-05-18 中兴通讯股份有限公司 一种信息安全传输方法及系统及接入服务节点
CN110430044A (zh) * 2019-07-10 2019-11-08 南京工业大学 一种基于ElGamal加密的双层加密方法
CN111262707B (zh) * 2020-01-16 2023-04-14 余志刚 数字签名方法及验证方法、设备、存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5231668A (en) * 1991-07-26 1993-07-27 The United States Of America, As Represented By The Secretary Of Commerce Digital signature algorithm
US5442707A (en) * 1992-09-28 1995-08-15 Matsushita Electric Industrial Co., Ltd. Method for generating and verifying electronic signatures and privacy communication using elliptic curves
US5475763A (en) * 1993-07-01 1995-12-12 Digital Equipment Corp., Patent Law Group Method of deriving a per-message signature for a DSS or El Gamal encryption system
ATE187588T1 (de) * 1993-08-17 1999-12-15 R3 Security Engineering Ag Verfahren zur digitalen unterschrift und verfahren zur schlüsselübereinkunft
CA2228185C (fr) * 1997-01-31 2007-11-06 Certicom Corp. Protocole de verification

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See references of WO9923781A1 *

Also Published As

Publication number Publication date
WO1999023781A1 (fr) 1999-05-14
CA2306468A1 (fr) 1999-05-14
AU1015499A (en) 1999-05-24
JP4307589B2 (ja) 2009-08-05
JP2001522071A (ja) 2001-11-13
JPH11174957A (ja) 1999-07-02

Similar Documents

Publication Publication Date Title
CA2228185C (fr) Protocole de verification
US7996676B2 (en) Masked digital signatures
US10326598B2 (en) Method for generating a message signature from a signature token encrypted by means of a homomorphic encryption function
US5600725A (en) Digital signature method and key agreement method
EP2306670B1 (fr) Procédé de signature numérique hybride
US20140229730A1 (en) Implicit certificate scheme
US9800418B2 (en) Signature protocol
CN100440776C (zh) 椭圆曲线签名和验证签名方法和装置
CN112118111A (zh) 一种适用于门限计算的sm2数字签名方法
US20150006900A1 (en) Signature protocol
Hwang et al. An untraceable blind signature scheme
US6097813A (en) Digital signature protocol with reduced bandwidth
Jeng et al. An ECC-based blind signature scheme
US6499104B1 (en) Digital signature method
EP1025674A1 (fr) Verification de signature pour systemes elgamal
WO2016187689A1 (fr) Protocole de signature
US20090138718A1 (en) Method of generating a signature with "tight" security proof, associated verification method and signature scheme based on the diffie-hellman model
CN115174102A (zh) 一种基于sm2签名的高效批量验证方法及系统
KR100194638B1 (ko) 개인 식별정보를 이용한 부가형 디지털 서명방법
Kwon et al. Randomization enhanced blind signature schemes based on RSA
EP0854603A2 (fr) Génération de paramètres de session pour protocoles du type el-gamal
CA2892318C (fr) Protocole de signature
Lin et al. Self-certified proxy convertible authenticated encryption scheme

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20000420

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): CH DE DK FI FR GB LI SE

17Q First examination report despatched

Effective date: 20020325

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN

18D Application deemed to be withdrawn

Effective date: 20021005