EP1222527A1

EP1222527A1 - Method for generating pseudo random numbers and method for electronic signatures

Info

Publication number: EP1222527A1
Application number: EP00958257A
Authority: EP
Inventors: Erwin Hess; Pascale Serf
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 1999-08-18
Filing date: 2000-08-16
Publication date: 2002-07-17
Also published as: CA2381937A1; JP2003507761A; WO2001013218A1

Abstract

The invention relates to a method for generating pseudo random numbers and a method for electronic signatures. According to the inventive method for generating pseudo random numbers, points are determined on at least two different elliptical curves. A pseudo random number is produced respectively by linking the points. The linking of points of different elliptical curves to generate a pseudo random number makes it impossible to deduce the individual elliptical curves on the basis of the pseudo random numbers. The cryptographic security of the inventive method is thus tremendously increased because the computation of discrete logarithms is made impossible.

Description

description

Method of generating pseudo random numbers and method for electronic signature

The invention relates to a method for generating pseudo random numbers and a method for electronic signature.

Random numbers are required in cryptography to encrypt or sign messages. In the article "From diplomatic code to trap door function" by Otto Leiberich, Spectrum of Science, June 1999, pages 26 to 34, an overview of the development of cryptography in Germany is given. This describes a previously used worm or stream encryption method, in which a very long character string, which has no internal structure, a so-called character worm or character stream, character by character is added to a message to be encrypted, the plain text .. If they are letters, they are first written according to the scheme a = 0, b = 1,. .., z = 25 m numbers transformed.

An addition modulo 26 is carried out so that no numbers greater than 25 arise. In the age of computers, texts are converted into binary numbers and zeros and ones are added modulo 2. The recipient subtracts the character stream - modulo 26 or 2 - from the received ciphertext and thereby recovers the plaintext.

The character stream is generated with the help of random number generators. These used to be based on high-frequency voltage fluctuations in certain pipes, so-called thyratrons, and later on radioactive decay events.

However, since the character streams have to be securely transmitted in parallel from the sender to the receiver, a considerable throughput of secure data transfer is necessary. Methods have therefore been developed for generating pseudo random numbers, so-called pseudo random number generators, which, depending on a key, can generate a sequence of pseudo random numbers that is essentially of any length. As a result, only one key had to be transmitted between the communication partners in the above coding method, which is much easier to handle than transmitting a complete character stream in each case.

For today's open networks, especially the Internet, engineers have been developed in which two communication partners who want to communicate with each other for the first time can send encrypted messages. These methods are so-called asymmetrical key methods, which are also referred to as public key methods, in which the recipient publishes his key, the so-called public key.

One of the best known methods of this type is the so-called RSA method, in which parts of the key, the so-called key modules, are products of two large prime numbers. The sender of the message only knows the key module, ie the product, and can use it to encrypt the message according to a certain mathematical function. However, it is not sufficient to decrypt the message

Knowledge of the product, but you need the two prime numbers. With the help of these prime numbers and a corresponding inverse function, only the correct recipient who generated the key can decrypt the encrypted message.

The breakdown of the key module into its divisors, the two prime numbers, is practically not possible with large modules with normal computing effort. In "Factoring Large Numbers" by Johannes Buchmann, Spectrum of Science, September

1996, pages 80 - 88 the problem of the decomposition of large numbers m their prime numbers is described in detail and the problem wall for the disassembly of a 129 figure. This number was broken down into the individual prime numbers with the help of 600 volunteers who made their computers available.

A disadvantage of the RSA method is that it is too slow for message encryption, since very large numbers - approximately 1000 binary or 300 decimal places - have to be used to ensure adequate security. Such large numbers must be exponentiated with others of the same order of magnitude, which cannot be done quickly enough to encrypt data to be transmitted. The RSA method is therefore only used for the encrypted transmission of keys to be kept secret for a conventional method, which then carries out the actual encryption.

As an alternative to the RSA method, methods based on elliptic curves have been developed. Only elliptic curves over finite bodies are relevant for cryptography. These elliptic curves over finite fields form point groups, which define an addition and a multiplication, which have nothing in common with the common addition and multiplication but the calculation rules. Multiplication on an elliptic curve over a finite field is a one-way function, which means that the inverse - the calculation of so-called discrete logarithms - is normally not technically feasible, whereas the multiplication can be carried out very easily and quickly. This fact is exploited in the cryptographic methods based on elliptic curves, in that the receiver selects a random number t and, based on this random number t and a multiplication by t on the elliptical curve, determines a curve point T. The curve point T is published as a key, whereas the random number t is kept secret by the recipient. A transmitter can use the curve point T encrypt his message, which only the recipient, who knows the random number on which the curve point T is based, can then decrypt it.

Such methods based on elliptic curves require considerably less computing power with the same security as the RSA method. Such methods can be implemented in small computers, e.g. m chip cards. Siemens AG sells a chip card with the brand name SLE44CR80S, which implements a signature process based on elliptical curves.

Random numbers are again required to generate the keys, the public key that the recipient publishes, and its corresponding private key.

The invention is therefore based on the object of creating, on the basis of elliptical curves, a method for generating pseudorandom numbers which can be carried out simply and quickly and with which a large amount of high-quality random numbers can be generated.

This object is achieved by a method with the features of claim 1.

The invention is also based on the object of creating a method for electronic signature based on elliptical curves and a corresponding device which require less storage space than known methods and devices for electronic signature based on elliptical curves and which are implemented on small computer systems, in particular chip cards can.

The object is achieved by a method with the features of claim 11 and a device with the features of claim 12. Advantageous embodiments of the invention are specified in the subclaims.

In the method according to the invention for generating pseudo random numbers, pairs of points are determined which lie on at least two different elliptical curves over a finite body, and a random number is determined as a function of such a pair of points.

Since two different elliptical curves are used according to the invention, and the pseudo-random number is derived from a pair of points, the two points of the pair lying on different elliptical curves, it is impossible to draw conclusions about the curve points from the pseudo-random numbers determined in this way. When using only a single elliptic curve to derive pseudorandom numbers, it was possible to draw conclusions about the curve points by calculating discrete logarithms from the pseudorandom numbers. This would make it possible for third parties to determine the calculation rule of the pseudo random numbers and to predict the further pseudo random numbers. This would pose a significant security risk that is avoided with the present invention.

The method according to the invention for electronic signature combines a known signature method with the method according to the invention for generating pseudo random numbers. The same routines or devices can be used both in the signature method and in the generation of the random numbers, as a result of which program code and memory space can be saved considerably. In addition, an optimization of the EC (= ellιptιc curve) arithmetic has an advantageous effect both in the generation of the pseudo-random numbers and in the direct execution of the signature process. Through this double use of the Routines and facilities based on elliptic curves thus achieve synergy effects.

Furthermore, the pseudorandom numbers generated according to the invention cannot be distinguished from random numbers of a real random generator and can be generated with relatively little computation effort.

The invention is explained in more detail below by way of example using the drawings. In which schematically show:

1 shows an elliptic curve over the real numbers,

2 shows an elliptic curve over a finite body,

3 shows the addition of two points of an elliptic curve over the real numbers,

4 shows the points of the elliptic curve y = x ³ + 2x + 9 above the body mod 13, which is a cyclic group with 17

Form dots,

5 shows the process flow of an exemplary embodiment of the invention, a flow chart,

6 shows the basic principle of the method according to the invention for generating pseudo random numbers in a flow chart, and

7 shows the structure of a program for executing a signature method according to the invention.

First, the mathematical basics for calculating on elliptic curves are briefly explained. An elliptic curve E over a body K is a curve formed by a cubic equation of the form: y ^~ = x ³ + ax + b,

can be described with a and b from K, 4a ^~ + 27b "≠ 0. Pairs (x, y) from K x K, which fulfill the equation, and the formal pair (∞, °°) are called points of curve E about K.

An elliptic curve over the real numbers is shown in FIG. 1. Note that elliptic curves are not ellipses.

Fig. 2 shows an elliptic curve over a finite body. The algebraic term Korper defines a "range of numbers" in which one can add, subtract, multiply and divide according to the formal calculation rules known from the rational numbers. There are infinite bodies, such as the rational numbers, the real numbers, the complex numbers, and finite bodies. Finite bodies are, for example, the body GF (p) of the numbers mod p, where p is a prime number, or the body GF (2 ⁿ ) of the binary vectors of length n. ("GF" stands for "Galois field", which is a synonym for "finite body".) Only elliptic curves over finite bodies are relevant for cryptography.

FIG. 3 shows the addition of two points P P_ on an elliptic curve over the real numbers, the

Point P ₃ results. With this addition, the connecting line of the points Pi and P _{^ is} formed and their 3rd intersection is determined with the elliptic curve. This point of intersection is mirrored on the x-axis and gives the result P αer addition of P _: and P_.

This addition of the points on elliptic curves can be printed out using the following formulas:

r = (y ₂ -yι) / (x ₂ -xι) if xι ≠ x ₂ r = (3xι + a) / 2y if P. = P_ where x _^ , y _{^ are} the coordinates of the point P (ι = l, 2,3) s α.

These formulas are also valid for elliptic curves over endl _^ - CNEN Korpern.

Iteration of the point addition defines a multiplication of curve points by integers k:

k-P = P + P + ... + P (k times the sum).

This multiplication of curve points by integers can be carried out easily and quickly, whereas the inverse task, the calculation of so-called discrete logarithms, can usually only be solved with extraordinary computational effort. There is no algorithm for this with a sub-exponential runtime. This point multiplication thus represents a one-way function, which is why it is used in procedures with public keys, the so-called public key procedure.

The method according to the invention for generating pseudo random numbers is explained below on the basis of an exemplary embodiment shown in FIG. 5.

A first elliptic curve E over the body GF (p) is given by the following equation:

(y) mod p = (x ^~ + 6x +

605067903441846547388214966045455206952938406771) mod p, where p = 2 ¹⁶⁰ -47 =

1461501637330902918203684832716283019655932542929. p is a prime number with 160 bits.

The elliptic curve E over GF (p) has a group order q = 208785948190128988314812461240940947434505754881. q is again a prime number with 128 bits. The group order of an elliptic curve is the number of elements of the point group, i.e. the number of solutions of the defining equation of the elliptic curve E via GF (p). The larger the maximum prime divisor of the group order, the more difficult it is to calculate discrete logarithms. The size of the group orders and their maximum prime divisors thus represents a quality feature of the method according to the invention, the group orders preferably being at least 2 ¹⁰⁰ or better 2 ¹³⁰ .

A second elliptic curve E 'over GF (p) is given by the following equation:

(y ^:) mod p = (x "+ 3x +

168756385740498547400152923318200148712149363991) mod p.

The curve E 'is isogenic to the curve E, that is, when the course

y ² = x ³ + ax + b

has, the curve E 'has the shape

y ^~ = x ³ + ac ^~ x + bc ³ ,

with a, b, c from GF (p), where c is a quadratic non-residue modulo p. In the present case, the following applies to c:

c = 503145425704462245322517599589013227703324936803.

Using two isogenic curves instead of any two curves offers significant advantages. The order of the elliptic curve E 'over GF (p) can easily be derived from the group order of E, since the sum of the two orders is 2p + 2, which gives the following equation: #E '(GF (p)) = 2p + 2 - #E (GF (p))

In the present case, for the group order of E ':

#E '(GF (p)) = 2p + 2 - #E (GF (p)) = 11 * 19 * q ¹ with q' = 4581509834893112596249788202965452687367789347.

q 'is a prime number with a length of 152 bits.

Now choose two points P, P 'of the curves E, E', such as:

P = (27, 1199480719563308855489368355308026541006624847440) P '= (318.767790262932904318810390534329377261151321453045), and two start values s, s', e.g. s = s' =. 2

Step S1 from FIG. 5 is completed by determining the elliptic curves E, E ', the points P, P' and the starting values s, s'. The procedure now goes to step S2, in which the points P, P 'are multiplied by s or s', the result being referred to as PA or PA'. The multiplication is carried out as an s-fold or s-fold addition according to FIG. 3.

Points PA and PA 'are passed to the rule for determining random bits (step S3). In the present case, the x coordinates of the two points PA and PA 'are linked to XOR and divided by c.

For isogenic elliptic curves E and E ^'it holds that for any x from GF (p) x is either x-coordinate of two different points on E, or x is the x-coordinate of a point on E and ex is x -Coordinate of a point on E ', or x is not x-coordinate of a point on E, but ex is x-coordinate of two points on E '. So if you divide the x coordinates on E 'by c, then any x from GF (p) occurs exactly 2x as the x coordinate. This means that if you link an x coordinate on E with an x coordinate on E 'divided by c, it is equivalent to linking any two random values between 0 and p-1. The pseudorandom bits derived in this way therefore behave like real random bits.

From step S2, the points PA and PA 'are also sent to the

Pass step S4, in which the points P, P 'remain unchanged and s or s' is increased by one.

From step S4, the process flow goes back to step S2, at which new points PA and PA 'are again formed, which are then passed back to step S3 for calculating further random bits and to step S4. This process sequence can be repeated many times, with new random bits being generated again and again.

The inventors of the present invention have generated 20 x one million random bits using the above-described method for generating random numbers and have subjected these random bits to various statistical tests. With αen tests no deviations from real random bits could be determined.

It is essential for the invention that in step S3 the random number Z is determined from the two points PA and PA ', which originate from different elliptic curves E and E'. Linking these two points PA and PA 'ensures that the pseudorandom numbers generated cannot be used to determine the points P and P on which the calculation of the points PA and PA' is based by means of discrete logarithms. From the result from S3 it is therefore not possible to refer to the method for generating the points PA, PA ' steps S1, S2 and S4 are closed, which is shown by the dashed line in FIG. 5.

The invention is not restricted to the exemplary embodiment shown in FIG. 5. In the context of the invention it is e.g. possible to choose a different combination of the x coordinates in step S3. For example, the two x coordinates are linked by an addition modulo p. Or you link the y-coordinates. Or x and y coordinates. In the context of the invention it is also possible that instead of fixed elliptic curves E, E 'with points P, P' after each calculation of PA and PA 'new curves E *, E *' and points P *, P * ' be determined, which are used to calculate the next points PA * and PA * '. The values s, s' can also be changed as desired. It is only essential for the invention that the values s, s' are integers. At the beginning of the method, they can be generated, for example, with a simple random generator that does not have to meet high standards. 6 shows the basic principle of the present invention, which has a loop consisting of steps S5 and S6, wherein in step S5 two elliptic curves E, E ', two points P, P' on the two curves and two starting values s, s' can be selected. In step S6, the points P, P 'are multiplied by s and s', respectively, resulting in PA and PA'. Each time the loop S5, S6 is repeated, at least one of the pairs E, E 'or P, P' or s, s' is changed. It is also possible to change two or all 3 pairs according to a rule to be defined.

Each time the loop is repeated, a new pair of numbers PA, PA 'is generated and transferred to method step S7, in which the two points PA and PA' are each linked to form a pseudo random number Z.

Methods based on elliptic curves use multiplication on elliptical curves as an out-of-bound function, which is why Devices for performing such methods are provided with routines and facilities for arithmetic on elliptic curves. Such methods also require random numbers to generate the private and public keys. By using the method according to the invention for generating these random numbers, on the one hand high-quality pseudo random numbers can be generated and on the other hand the program code can be kept small, since the existing routines can be used twice. This saves considerable resources and at the same time significantly increases the security of the process.

7 schematically shows the structure of a program for executing the method according to the invention in a block diagram. The program consists of a part P1 for carrying out the signature method, which uses a program part P2 with which multiplications on elliptic curves over finite bodies are carried out. The program part P1 is supplied with a random number by a further program part P3, the program part P3 again using the program part P2 for multiplying on elliptic curves. A data input stream I and a data output stream 0 are shown on the program part P1, the data input stream being a message to be signed and the data output stream being the signature. Furthermore, the program part P1 can output its private and public key at the data output stream 0. These functions of the program part P1 correspond to the signature methods and devices known per se based on elliptical curves. The method according to the invention can be used in particular in computing devices with a lower computing capacity, such as Chip cards are used because the corresponding program code is extremely compact and the length of the numbers to be processed is significantly shorter than with an RSA procedure of the same security level. However, it is also possible to distribute the programs on electronically readable data carriers.

Claims

claims

1. Method for generating pseudo-random numbers, in which at least two points (P, P ^' ) of at least two different elliptic curves (E, E') are determined over a finite field (GF) and a pseudo-random number by linking these points ( P, P ') is generated.

2. A method for generating pseudo random numbers according to claim 1, characterized in that a pair of points (P, P ^' ) is determined in each case for determining the pseudo random number, the same two elliptical curves (E, E') being used in each case for determining the individual pairs become.

3. A method for generating pseudorandom numbers according to claim 2, so that the two elliptic curves (E, E ') are isogenic to one another.

4. A method for generating pseudo random numbers according to one of claims 1 to 3, characterized in that the points (P, P ^' ) of a first pair are determined as a function of two starting values (s, s').

5. A method for generating pseudo random numbers according to claim 4, characterized in that the points (P, P ^' ) of the further pairs are determined by varying the starting values according to a predetermined rule.

6. A method for generating pseudo random numbers according to one of claims 1 to 4, characterized in that the further pairs of points (P, P ^' ) by varying the elliptical Curves and / or the points (P, P ") can be determined according to a predetermined rule.

7. A method for generating pseudo random numbers according to one of claims 1 to 6, d a d u r c h g e k e n n z e i c h n e t that the coordinates of the two points (P, P ') are linked together to determine a random number.

8. A method for generating pseudorandom numbers according to claim 7, so that the x-coordinate of the two points (P, P ") are linked to one another, the two elliptic curves (E, E ') being isogenic.

9. A method for generating pseudo random numbers according to one of claims 1 to 8, characterized in that the point groups (E (GF (p)), E ^' (GF (p))) of the elliptic curves (E, E') over a finite body GF (p) have group orders (q or q ^' ) of at least 2 ¹⁰⁰ and preferably at least 2 ¹³⁰ .

10. A method for generating pseudorandom numbers according to one of claims 1 to 9, d a d u r c h g e k e n n z e i c h n e t that the elliptic curves are defined over the finite field GF (p), where p is a prime number that is greater than 3.

11. A method for electronic signature based on elliptic curves, in which the keys are generated on the basis of random numbers, characterized in that the random numbers are determined according to a method of claims 1 to 10.

12. An apparatus for performing the method for electronic signature based on elliptic curves according to claim 11, with a device for performing multiplications in the point group of an elliptical curve (E, E ') over a finite body (GF (p)), a device for signing, which uses the means for performing the multiplication, and a means for generating pseudorandom numbers according to the method according to one of claims 1 to 9, which means also uses the means for performing the multiplication.