EP1302021A1

EP1302021A1 - Method for generating an electronic key from a prime number contained in a specific interval and device therefor

Info

Publication number: EP1302021A1
Application number: EP01947562A
Authority: EP
Inventors: Marc Joye; Pascal Paillier
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Gemplus SA
Priority date: 2000-07-10
Filing date: 2001-06-21
Publication date: 2003-04-16
Also published as: CN1449609A; JP3833175B2; AU2001269221A1; FR2811442A1; JP2004502984A; WO2002005483A1; US20040114757A1; FR2811442B1

Abstract

The invention concerns a method for generating an electronic key from a prime number q contained in a specific interval of positive integers (Wm, WM). Said method comprises the following operations: a) selecting a positive integer θ, θ being the product of the k first prime numbers, with k as maximum so that there exist two positive integers εm and εM such that εm is the higher roundoff of Wm/θ, and εM is the lower roundoff of (WM-Wm)/θ, calculating Π = εM. θ and ς = εm.θ, generating two positive integers a and c belonging to the multiplicative group Z*Π of integers modulo Π, with prime c with Π, calculating q = c + ς; b) testing primality nature of q; c) if primality is verified, q is stored; d) otherwise: updating c by calculating a.c mod Π, repeating the preceding operations as from b) with the new value q = c+ς. The invention is applicable to cryptography.

Description

METHOD FOR GENERATING AN ELECTRONIC KEY FROM A FIRST NUMBER INCLUDED IN A DETERMINED INTERVAL AND DEVICE FOR IMPLEMENTING THE METHOD

The invention relates to a method for generating an electronic key from a prime number q comprised in a determined interval of positive integers [w _m , w _M ]. The invention also relates to a

5 device for implementing the process.

The invention applies very particularly to. key, public cryptography protocols used for information encryption and / or authentication between two entities and / or electronic signature of messages.

It applies in particular to public key cryptography protocols such as the RSA ^' protocol (Rivest Shamir and Adelman), El Gamal, Schnorr, or Fiat Shamir. In the case of such applications, the generation of large prime numbers (which may for example be greater than or equal to 512 bits) is used to form one or more keys of the protocol.

A first so-called "naive" method of generating a prime number consists in: choosing a candidate from among the odd numbers, testing its primality, ^• if the primality is' verified, this number is stored, otherwise ,. we update the candidate in

25 incrementing by 2, the test is repeated with this new candidate and so on until the primality of a candidate is verified. This method is very slow. Another method is to choose ^j candidates for primality testing among prime numbers with a prime number EL is recalled that two numbers are prime to each other or co-first if and only if the greatest common divisor (gcd) is equal to 1. This other method consists in:

- consider the number El = 2.3.5.7 .... which is- the product of the first k prime numbers (often k = 4) and choose a number p such that p- is prime with Et,

- test the primality of p,

- if the primality of p is verified, this number is memorized, otherwise we update p in 1 'increment of EL This new candidate p is also prime with Et; indeed, we recall that pgcd (p + π, ri) = pgcd (p, El) = 1

- we repeat the test with this new candidate and so on until we have found a candidate that is a prime number. This method is more effective.

But ^'wishes in general generate a first number in a certain range. Indeed, in the case for example of the RSA public key cryptography protocol, we consider the product of 1024 bits of two prime numbers p and q, that is to say ^2,511 .V2 <p, q < ^2,512 . According to another protocol based on the discrete logarithm, one seeks directly to obtain a prime number of 1024 bits, that is to say 2 ¹⁰²³ <p <= 2 ¹⁰² . These protocols prove to be difficult to program on portable devices such as microprocessor (because complex) and poor performance for "usual large numbers, 512 bits, 1024 bits or more.

The object of the invention is, given the interval [w _ra , w _M ], to determine El once and for all and to propose an update of the candidate guaranteeing that the new candidate will be first with El in the interval initially determined while keeping the calculation time of these new candidates within reasonable limits, that is to say by limiting the number of primality tests.

The choice of El is illustrated by FIG. 1 where the set I of the integers included in an interval [ _m , w _M ] is represented, in which is included the set IEI of the integers of this prime interval with El, in which is includes the IP set of prime numbers in this range. The goal is to determine ET so that ^' the intermediate set IEI of prime integers with E, i.e. the set of candidates, is as close as possible to the subset IP of prime numbers of the interval.

The invention more particularly relates to a method of generating an electronic key from a prime number q included in a range of positive integers determined [w _m , w _M ], mainly characterized in that the number first q is obtained by performing the following operations: a) choice of a positive integer η, η being the product of the first k prime numbers, with k maximum so that there are two positive integers ε _m and ε _M such that ε _m is the upper rounding of w _m / η, and ε _M is the lower rounding of (w _M -w _m ) / η, calculation of El = ε _M .η and p = ε _m .η, generation of two positive integers a and c belonging to the group multiplicative Z ^* _π of integers modulo El, with c prime with El calculation of q = c + p

b) test of the primality of q,

c) in the case where the primality is verified, q is stored,

d) in the opposite case: we update c by calculating a.c mod ET, we repeat the previous operations from b) with the new value q = c + p.

According to a characteristic of the invention, a = 2 and El = (ε _M -1). η.

According to another characteristic, a = 2 ¹⁶ + 1. The invention applies to methods of generating cryptographic keys RSA, El Gamal, Schnorr, or. Fiat Shamir.

The invention also relates to a portable electronic device ^' comprising a processor arithmetic and an associated program memory, capable of performing "modular calculations, mainly characterized in that it comprises a program for checking the primality of a positive integer q included in a determined interval of positive integers [w _m , w _M ] which performs the following operations: a) choice of a positive integer η, η being the product of the first k prime numbers, with k maximum -for there to exist- two positive integers ε _m and ε _M such that ε _m is the upper rounding of w _m / η, and ε _M is the lower rounding of (w _M -w _m ) / η, calculation of El = ε _M .η and p - ε _m .η, generation of two positive integers a and c belonging to the multiplicative group Z ^* π of integers modulo ET, with c prime with El calculation of q = c + p

b) test of the primality of q,

c) in the case where the primality is verified, the arithmetic processor stores q,

d) in the opposite case: update of c by the calculation of ac mod El, the arithmetic processor repeats the preceding operations from b) with q = c + p. Advantageously, the portable electronic device consists of a microprocessor smart card.

Other particularities and advantages of the invention will appear clearly on reading the description given by way of nonlimiting example and with reference to the appended drawings in which: FIG. 1 represents the set I of the integers included in an interval [ w _m , w _M ], the set IEI of the integers of this prime interval between them and finally the set IP of the prime numbers of this interval, FIG. 2 represents the flow diagram of the method according to the invention, FIG. 3 represents the block diagram of a portable electronic device such as a smart card implementing the method according to the invention.

The object of the invention therefore consists first of all in determining El so that the set IEI of the prime integers with- El shown in FIG. 1 is as close as possible to the subset IP of the prime numbers of the interval.

According to the invention, the method represented in FIG. 2 is initialized in the following manner, (step I): to generate a prime number q such that q € [ _m , w _M ], a number η of the same form as II is chosen (η is the product of the k 'first prime numbers) where k' is maximum and such that there are two whole numbers positive ε _m and ε _M such that ε _m is the upper rounding of W _m / η, which we denote by G w _m / η D and ε _M is the lower rounding of (w _M -w _m ) / η which we denote by D (w _M -w _m ) / η D.

El is then obtained by setting II = ε _M .η; we also set p = ε _m .η

We notice that L is close to w _M -w _m but lower and that p is close to _m but higher.

It is now necessary to determine the update of the candidates so that the new candidates always belong to IEI.

We consider the ring Zπ of the odulo integers El and

Z ^* π the multiplicative group of Zπ; we notice that the set (p + Z ^* π) is included in and almost ^" identical to IEI, that is to say to the set of candidates.

We then generate two positive integers a and c belonging to this multiplicative group Z ^* π with c prime with El (that is to say pgcd (c, ^" EI) = 1) and we consider the candidate q = c + p (step I) To generate c, we use a co-prime number generation algorithm such as exists in the literature.

Since p is close to w _m and c <EI, we automatically check that w _m <q <w _M. Furthermore, pgcd (q, II) = pgcd (c + p, El) = pgcd (c, El) = 1

We thus verify that q actually belongs to IEI. This initialization phase completed, the primality of the candidate q is tested (step II). If it is verified, q is stored, otherwise: c is updated by calculating ac mod El and the new candidate q = c + p is calculated (step III).

The new candidate belongs to the IEI set: in fact, due to the properties of the multiplicative groups, a and c belonging to Z ^* π, the product ac also belongs to this group Z ^* π as well as ac mod El.

Public key cryptography protocols are often implemented on microprocessor smart cards. For example, in the RSA protocol, the keys are generated from numbers chosen randomly by the microprocessor card to

- the execution of the protocol. To this end, the microprocessor card has a random number generator capable of providing an integer of the desired size. FIG. 3 therefore represents the functional diagram of a microprocessor card capable of implementing the method according to the invention.

Card C includes a main processing unit 1, program memories 3 and 4 and a working memory (not shown), associated with unit 1. The card also includes an arithmetic processor 2 capable of performing modular calculations and a secure memory 6 (not accessible from the outside) in which the candidate will be stored _. q whose primality has been verified. The card has also a generator of random integers 5.

In view of the implementation of the method in particular on a microprocessor card as described, it is desirable to increase the speed of the processing implemented by the method (operations performed by the arithmetic processor 2) and to free up 'location in working memory.

To this end, by choosing a = 2 and excluding 2 from the number El (El = 3.5.7. ...), we avoid modular calculations. Indeed, the update of c becomes 2c mod El. However as c is an element of Z ^* π, 2c mod Et = 2c or 2c - El.

However, the new candidates q can then be even. If this is the case, then we add to the new ^' - candidate a number such that the new candidate becomes odd while still belonging to the set IEL We pose as: π = (ε _M - 1) -η q = c + p if q is even then q becomes q + η.

According to another alternative, we can keep El. As defined initially and choose a particular value of a such that a ^' is prime with Et. We can choose for example a = 2 ¹⁶ + 1.

The method according to the invention has been implemented on a SLE66CX160S smart card platform. from Infineon including an 8-bit central unit and an 1100-bit arithmetic cryptoprocessor. By choosing for η, El and p the following values: η = blβbdle084afβ28fe5089eβdabdlβb5b80f60681dβa092fcb Ie86d8287βed71921000bcfdd063fb90f81dfd07a021af23c735d52 e63bdlcb59c93cbb398afdι ₆ π η = 1729 P = 4180. η is obtained with a = 2, a prime number of 512 bits in less than 4 seconds. We therefore obtain a prime number of 1024 bits on average in less than 8 seconds.

Claims

1. Method for generating an electronic key from a prime number q included in a determined interval of positive integers [w _m , w _M ], characterized in that the prime number q is obtained by carrying out the following operations a) selecting a positive integer η, η being the product of the first k prime numbers with maximum k for that there are two positive integers ε _m and ε _m ε _m is such that the rounded top ^'of _m / η, and ε _M is the lower rounding of (w _M -w _m ) / η, calculation of El = ε _M .η and p = ε _m .η, generation of two positive integers ^' a and c belonging to the multiplicative group Z ^* π of integers modulo El, with c prime with And calculation of q = c + p

b) test of the primacy of q,

c) in the case where the primality is verified, q,.

d) otherwise: on ^'updates c by calculating ac mod El, one reiterates the preceding operations from b) with the new value q = c + p.

2. Method according to the preceding claim, characterized in that a = 2 and II = (ε _M -l) .η.

3. Method according to claim 1, characterized in that a = 2 ¹⁶ + 1.

4. Method for generating RSA, El Gamal, .Schnorr, or Fiat Shamir cryptographic keys, characterized in that it implements the method according to any one of the preceding claims.

5. Portable electronic device comprising an arithmetic processor and an associated program memory, capable of performing modular calculations, characterized in that it comprises a program of

_ verification of the primality of a positive integer q included in a determined interval of positive integers [w _m , _M ] and which performs the following operations: a) choice of a positive integer η, η ^' being the product of k first prime numbers, with k maximum so that there are two positive integers ε _m and ε ^ such that ε _m is the upper rounding of w _m / η, and ε _M is the lower rounding of (w _M - w _m ) / η, calculation of Et = ε _M .η and p = ε _m .η, generation of two positive integers a and c belonging to. multiplicative group Z ^* π of integers modulo Et, with c prime with El calculation of q = c + p b) test of the primality of q,

d) in the contrary case: update of c by the calculation of a.c mod Et, the arithmetic processor repeats the preceding operations starting from b) with q = c + p.

6. Portable electronic device according to claim 5, characterized in that it is constituted by a chip card with microprocessor.