EP1221223A1

EP1221223A1 - Method for generating/regenerating a cipher key for a cryptographic method

Info

Publication number: EP1221223A1
Application number: EP00953018A
Authority: EP
Inventors: Jörg Schwenk
Original assignee: Deutsche Telekom AG
Current assignee: Deutsche Telekom AG
Priority date: 1999-07-27
Filing date: 2000-07-06
Publication date: 2002-07-10
Also published as: DE19935285A1; CA2378729C; CA2378729A1; US7162037B1; WO2001008347A1; AU2482801A; DE19935285B4

Abstract

The invention relates to a method for generating/regenerating a cipher key for a cryptographic method, whereby a cipher key and a public key are created from a random number (seed) according to a predetermined deterministic method. According to said method, the seed is created only on the user side through the use of values which are only known to the user. Regeneration information appropriate to the seed regeneration, which allows for the seed to be derived in a deterministic manner from the confidence station through a combination with information known only to said confidence station, is created on the user side and stored in a lossproof manner. In the event of loss of the cipher key, the seed is reproduced on the confidence station side by combining the regeneration information with secrete information.

Description

Process for generating / regenerating an encryption key for a cryptographic process

The invention relates to a method for generating / regenerating an encryption key for a cryptography method, the encryption key and a public key being generated from a large random number (seed) by means of a predetermined deterministic method.

The cryptographic technique of encryption is increasingly being used to secure communication data and stored data. The data is encrypted under the control of a cryptographic key. The data can also be decrypted using the same key. Marketable products and software libraries are available.

A so-called hybrid method is usually used for encryption. With these methods, the actual message is encrypted with a randomly selected symmetrical key (session key) and a predetermined symmetrical encryption method (e.g. DES, IDEA). The session key is always associated with the recipient's public key (there are several

Recipient possible) and a predetermined asymmetrical or public key procedure (e.g. RSA, EIGamal). The session key encrypted in this way is added to the encrypted message for each recipient. A description of this procedure and the algorithms used can be found e.g. in William Stallings: "Cryptography and Network Security: Principles and Practice", Prentice Hall, Upper Saddle River, New Jersey, 1998.

In order to decrypt a received message, the recipient must first decrypt the session key with his private key belonging to his public key and the specified public key algorithm and then decrypt the message with this session key. In addition to encrypting messages, cryptographic methods are also used to encrypt stored data, for example on one's own personal computer. Here, too, a hybrid method is generally used, in which the user initially encrypts the data with a randomly chosen symmetrical key (session key) and a predetermined symmetrical encryption method (e.g. DES, IDEA). The session key is then in turn encrypted with the user's public key and a predetermined asymmetrical or public key method (eg RSA, EIGamal).

The user first decrypts the session key using his private key belonging to his public key and the specified public key algorithm, and then the stored data using this session key.

The private key of the user or of the recipient is referred to below as the encryption key.

The encryption key is either stored on a chip card, whereby access to the chip card is protected by a secret number (PIN) known only to the user, or it is stored on another storage medium (e.g. hard disk or floppy disk), using a password that is as long as possible is protected.

The encryption key can be lost. For example, if that

If the storage medium on which it was located was destroyed, or if the user has forgotten the PIN or the password with which the encryption key was secured, access to encrypted data is no longer possible.

In order to make encrypted data accessible again if the encryption key is lost, mechanisms are required to open the encryption key to be able to regenerate safely. For this purpose, the encryption key is usually generated at a central trust and kept safe. The encryption key is usually generated by first generating a large random number (seed) using a statistically good random process. The key pair of public keys / private keys is then generated from this random number using a deterministic method. The seed is then deleted. The user receives a copy of his encryption key for use.

The user has no influence on the generation and storage of his encryption key. Furthermore, it is complex to securely transport the encryption key generated to the user. Today, for example, the above-mentioned chip card, which is sent to the user, serves as the transport medium. Misuse of the stored key by the trust or knowledge of one's own key due to a malfunction of the trust in the described procedure cannot be ruled out.

The object of the present invention is to provide a method of the type mentioned at the outset which solves the problems mentioned above. In particular, the method is intended to leave the user alone to decide whether a key should be restored.

The method proposed here for solving the task is based on the idea that a deposit of the encryption key for security purposes at the trust point can be omitted if the seed (S) is only generated by the user by adding known quantities (u) that a regeneration information (R) suitable for regeneration of the seed, from which the trust can determine the seed deterministically by linking it with only information known to it, is generated by the user and stored in a loss-proof manner and that in the event of a loss of the

Encryption key (C) by linking the regeneration information (R) with the secret information (v) the seed (S) is restored by the trust.

In a first embodiment of the invention, this can be achieved by providing a mathematical mapping (key agreement mapping) k: k (x, y) = z, for which the following applies: a) k (k (u, v), w) = k (k (u, w), v) for all u, v, w, b) from knowledge of u and k (u, v) cannot in practice be concluded from v, c) from knowledge of u In practice, k (u, v) and k (u, w) cannot be concluded from k (k (u, w), v) that a public parameter g known to the trust office and a secret key available on the part of the trust office v are linked to a public key V = k (g, v) of the trust agency, that the public key V and a random number u selected on the user side are linked on the user side to the seed S = k (V, u) that from the seed S user side the key pair is derived from the encryption key C and the public user key U by the predetermined deterministic method and that to enable the W Restoring this key pair U and C the regeneration information R = k (g, u) is generated by the user and stored in a loss-proof manner.

The random number u and the seed S are to be destroyed again for safety after the generation of the regeneration information R. The regeneration information R is generated under bug-proof conditions, for example within the user-side computer terminal, so that neither the random number u nor the seed S can reach the public. Without knowing the secret key v, the regeneration information R alone is unsuitable for decrypting messages and data and therefore need not be kept secret. The regeneration information R can be stored at any location (for example on paper) and, if necessary, can be sent to the trust office in any audible way (post, email, WWW, ftp ...). Examples of suitable key agreement maps k are known from number theory. For example, it can be provided that the key agreement mapping k is a discrete exponential function modulo of a large prime number p: k (x, y): = x ^y modulo p and that the public parameter g is an element of a mathematical body GF (p) of large multiplicative order or that the key agreement map k is the multiplication on an elliptic curve. In practice, the order of magnitude of the numbers used must be chosen so that even with the use of modern technical means it is not possible to calculate the value y from the values x and k (x, y), which, given the current deciphering technology, is of the order of magnitude used primes between 500 and 1000 bits is guaranteed.

A description of such functions can be found in William Stallings: "Cryptography and Network Security: Principles and Practice", Prentice Hall, Upper Saddle River, New Jersey, 1998. The present invention uses the principle of the Diffie-Hellman key exchange, which is also described in the mentioned work is described. In the method according to the invention, however, as described above, a point of trust is required which, if necessary, can restore the encryption key C using the regeneration information R.

For a further embodiment of the invention, it can be provided that the seed S = k (R, v) is calculated from the regeneration information R to restore the encryption key C in the event of loss on the part of the trust center. The lost encryption key C itself can then be calculated from the seed S thus reconstructed using the deterministic method. Due to the nature of the mapping k used, k (R, v) = k (k (g, u), v) = k (k (g, v), u) = k (V, u) = S, which is true again corresponds to the original Seed S. Since the deterministic method is also known to the trust center, the encryption key C can be very easily restored by the trust center using the regeneration information R even without knowledge of the random number u. The regenerated encryption key C must then be delivered to the user in a way that is secure against eavesdropping.

In order to prevent misuse of the method according to the invention for obtaining foreign private encryption keys C, it can further be provided that the trust after checking the seed S and after deriving the new public user key U of the user and the new encryption key C because of a key loss checks whether the new one calculated public key U is identical to the original public key U of the user, and only delivers the reconstructed encryption key C to the user if this is the case. A method for securely linking the identity of the user to his public key U is known from the ITU standard X.509.

Another version of the method provides that there are several trust offices that use the key agreement mapping k and the public parameter g. When the encryption key C is generated, one or more of these trust points are selected, with each of the selected trust points being used to create a different partial value Sv of the seed on the user side as described and the partial seeds Sv are linked to the seed S on the user side. In order to regenerate the encryption key C in the event of loss, the selected trust offices calculate their respective partial value Sv of the seed S using the regeneration information R. The reconstructed partial values Sv are linked together to form the seed S in order to reconstruct the encryption key C. This procedure can misuse the Prevent the procedure from being carried out by a trust agency, since each trust agency can only create one part of Sv that is unusable by itself.

In a further embodiment of the method it is provided that the different trust offices use different functions kv and / or different public parameters gv and that a separate regeneration information Rv is created for each of the selected trust offices. In this case, the user must carry out the method according to the invention for each trust point, and each trust point must generate its respective part Sv with its specific regeneration information Rv.

Exemplary embodiments of the invention are shown in the drawing using several figures and are explained in more detail in the following description. It shows:

Fig. 1 is a flowchart of the generation of a user's own key pair and

Fig. 2 is a flow diagram of the reconstruction of the encryption key after loss.

Identical parts are provided with the same reference symbols in the figures.

1 shows a time flow diagram of the processes which are necessary for generating a reconstructable user-specific encryption key C and a public user key U according to the inventive method. In the column labeled N, the successive user-side data are listed from top to bottom. Ü denotes the data transmission path to a trust point V. The trust point V and the user N have the public parameter g and the large one Prime number p. The public key V = g ^v modulo p is generated by the trust point V and transmitted to the user N in a simple manner. The user then generates a seed S and regeneration information R with a random number u chosen by him and deletes the random number u again for security reasons. The regeneration information G is transmitted to the trust point V. A public user key U and a private, also user-specific encryption key C are generated from the seed S by using a predetermined deterministic method known to the user and the trust. The encryption key C is used here to decrypt messages or data from the user.

In the event of a loss of the encryption key, the trust center, as shown in FIG. 2, generates the seed S and the encryption key C from the regeneration information R transmitted by the user to the trust center by linking them with the secret key v and transmits them in a secure manner to the users.

Claims

claims

1. A method for generating / regenerating an encryption key for a cryptography method, the encryption key and a public key being generated from a large random number (seed) by means of a predetermined deterministic method, characterized in that the seed (S) is only used by the user by using only Variables known to the user (u) are generated such that regeneration information (R) suitable for regenerating the seed, from which the trust can determine the seed deterministically by linking it with only information known to it, is generated by the user and stored in a loss-proof manner and that in the event of loss of the encryption key (C) by linking the regeneration information (R) with the secret information (v) the seed (S) is restored by the trust center.

2. The method according to claim 1, characterized in that a mathematical mapping (key agreement mapping) k: k (x, y) = z is provided, for which the following applies: a) k (k (u, v), w) = k (k (u, w), v) for all u, v, w, b) from knowledge of u and k (u, v) cannot in practice be concluded from v, c) from knowledge of u, k ( In practice, u, v) and k (u, w) cannot be concluded from k (k (u, w), v) that a public parameter g known to the trust office and a secret key v available on the part of the trust office to one Public key V = k (g, v) of the trust center are linked, that the public key V and a random number u selected on the user side are linked on the user side to form the seed S = k (V, u), that from the seed S on the user side by the predetermined one deterministic method the key pair is derived from encryption key C and public user key U and that to enable the recovery of this Key pair U and C the regeneration information R = k (g, u) is generated by the user and stored in a loss-proof manner.

3. The method according to any one of the preceding claims, characterized in that the key agreement mapping k is a discrete exponential function modulo a large prime number p: k (x, y): = x ^y modulo p and that the public parameter g is an element of a mathematical body GF (p) is of great multiplicative order.

4. The method according to any one of claims 1 or 2, characterized in that the key agreement mapping k is the multiplication on an elliptic curve.

5. The method according to any one of the preceding claims, characterized in that to restore the encryption key C in the event of loss on the part of the trust center from the regeneration information R the seed S = k (R, v) is calculated.

6. The method according to any one of the preceding claims, characterized in that the trust after checking the seed S and after deriving the new public user key U of the user and the new encryption key C due to a key loss checks whether the newly calculated public key U with the original public key U of the user is identical, and only hands over the reconstructed encryption key C to the user if this is the case.

7. The method according to any one of the preceding claims, characterized in that there are several trust offices that use the key agreement mapping k and the public parameter g. When generating the encryption key C, one or more of these trust points are selected, with the help of each of the selected trust points, another partial value Sv of the seed is created on the user side as described and the partial seeds Sv are linked on the user side to form the seed S. In order to regenerate the encryption key C in the event of loss, the selected trust offices calculate their respective partial value Sv of the seed S using the regeneration information R. The reconstructed partial values Sv are linked together to form the seed S in order to reconstruct the encryption key C.

8. The method according to claim 7, characterized in that the different trust offices use different functions kv and / or different public parameters gv and that a separate regeneration information Rv is created for each of the selected trust offices.