EP1461898A1

EP1461898A1 - Method and device for anonymous signature with a shared private key

Info

Publication number: EP1461898A1
Application number: EP02801132A
Authority: EP
Inventors: Sébastien CANARD; Marc Girault; Jacques Traore
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2002-01-04
Filing date: 2002-12-13
Publication date: 2004-09-29
Also published as: US7571324B2; JP4082717B2; FR2834598A1; JP2005525721A; WO2003061193A1; AU2002364839A1; FR2834598B1; US20050169461A1

Abstract

The invention concerns a method and a system for anonymous cryptographic signature of a message. The method consists in completing the anonymous signature which is calculated (13) with a private key common to the set of members of a group authorized to sign and unknown to all revoked members. Said private key is updated (8, 11) at group level upon each revocation within the group and at member level only upon anonymous signature of a message by said member. The system consists of as many cards as there are members in a group and a device comprising a first calculating means.

Description

METHOD AND DEVICE FOR ANONYMOUS SIGNATURE USING A SHARED PRIVATE KEY

Field of the invention

The present invention relates to the field of telecommunications and more particularly to the securing of transmissions, in particular for services, which uses cryptography.

State of the art

To authenticate the origin of a document transmitted by telecommunication means, electronic signature mechanisms have been developed. It should be noted that the terms transmission in electronic form are commonly used to qualify a transmission of a document by telecommunication means. The documents in question in the context of the invention must be presented in digital form as opposed to a presentation in paper form; the term message is used later in the request to designate this type of document. The most common electronic signature mechanisms are based on so-called public key cryptography techniques which involve an entity called a trusted authority. Usually, this trusted authority generates certificates on behalf of users of common public key processes; these certificates establish a link between a public key and the identity of the owner of this key. To implement such a process, the individual signing the message must first obtain certification from the trusted authority by communicating at least their public key and identity. During its implementation, the signature process calculates an electronic signature of the message by taking into account on the one hand the content of the message and on the other hand the private key of the individual. The signatory transmits the message, the signature and his certificate to the recipient. The recipient of the message verifies the electronic signature of the message using at least the public key and the content of the message.

For specific applications, such as electronic voting, electronic auctions or anonymous electronic payment, it is necessary to have an electronic signature known as anonymous. An anonymous electronic signature has the same characteristics as an electronic signature except that the recipient cannot determine the identity of the signatory; the signatory remains anonymous. However, the addressee can address himself to the trusted authority which has, via the certificate, a means to lift anonymity. Prior art

Among the different types of anonymous signature, there is a special type called anonymous group signature. An anonymous group signature process allows each member of a group to produce an electronic signature that is characteristic of the group. The recipient of a message accompanied by an anonymous group signature can verify that the signature was produced by one of the group members. However, he cannot determine, among the various members of the group, the member in question.

In the context of the invention, a group is a set of individuals who declare themselves to an authority as belonging to the same group. During this declaration, each individual interacts with the trusted authority according to a determined protocol at the end of which the individual obtains a private key, associated with a group public key previously determined by the trusted authority, and the authority and the individual obtain an identifier of the individual associated with this private key. Each of these individuals is in the continuation of the request designated by the term of member. An example of such a protocol is described in the article by J. Camenisch and M. Michels which has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS, pages 410 to 424, Springer-Verlag, 1997. The same interaction occurs when a new member arrives. The existence of a group translates on the side of the authority of trust by the attribution to the group of a public key known as of group and by the attribution to each member of a private key associated with the public key, different for each member, and an identifier. Using their private key, a member can produce an anonymous group signature of a message of their choice. Any recipient can verify that this signature has been produced by one of the members of the group, provided that the group public key is used. At the end of the verification, the recipient is certain that the signature has been produced, or not, by a member of the group, but he does not obtain any information on the identifier of this member, the signatory communicates to the recipient only its identifier encrypted using a public key of the trusted authority; the signature is anonymous. However, the recipient has the option of contacting the trusted authority, which can determine the identity of the signatory from the encrypted identifier accompanying the anonymous group signature. The trusted authority can therefore lift anonymity at any time. After constitution with the trusted authority, a group can evolve. According to a first type of evolution, new individuals can become members of the group. According to a second type of evolution, members can disappear, either by the departure of an individual from the group, or by the exclusion of an individual from the group; for this type of development, we speak of revocation. Each time the group changes, the trusted authority is faced with the problem of giving or withdrawing a member of the group the means to produce an anonymous signature of the group. The first problem posed, which lies in allocating the means to produce an anonymous signature of the group to a new member, is resolved by using one of the known public key / private key generation algorithms which make it possible to associate with the same key. public as many private keys as necessary. An example of such an algorithm is described in the article by J. Camenisch and M. Michels which has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS, pages 410 to 424, Springer-Nerlag, 1997.

The second problem posed, which resides in the fact of withdrawing from an individual these means, presents various known solutions which are methods of revocation.

A first of these methods is described in the following article by E. Bresson and J. Stern, "Efficient Revocation in group Signatures", in K. Kim, editor, Public Key Cryptography - PKC 2001, volume 1992 of LΝCS, pages 190- 206, Springer-Verlag, 2001. This process is based on the fact that each member of a group has its own identifier. Since the signature must remain anonymous, it is not possible to reveal this identifier. However, according to the process, the signatory's identifier is divided by that of each revoked member; the result of the division is always different from 1 if and only if the signatory is not himself a revoked member. Then, the method encrypts, with an encryption algorithm, each of the results of these divisions and transmits to the recipient these encrypted results accompanied by determined elements. The recipient uses the determined elements and the quantified results to verify on the one hand that the divisions were correctly carried out and on the other hand that all the results are different from 1; that is, to ensure that the signature was produced by an unrevoked member.

The disadvantage of this method is that it generates an anonymous group signature, the length and time of calculation of which increases in proportion to the number of dismissed members, given that there are as many quantified results and determined elements as there are dismissed members. A second of these revocation procedures is described in the article by HJ Kim, JI Lim and DH Lee which has for reference "Efficient and Secure Member Deletion in Group Signature Schemes", In D. Won, editor. Information Security and Cryptology - ICISC 2000, volume 2015 of LNCS, pages 150 et seq. Springer-Verlag 2000. This process consists in using three additional keys in addition to the keys necessary for the success of the group signature: a private property key for each member, a public property key to allow each member to check the validity of his key and a public renewal key allowing each member to modify his private ownership key each time a member joins or leaves the group. For each new member and for each revocation of a member, the trusted authority modifies the public ownership key and the renewal key. Each remaining member of the group modifies their own private ownership key using the renewal key and checks its validity using the public ownership key. When signing a message electronically, the signatory member uses their private property key. Thus, the recipient can verify the electronic signature using the public ownership key. This process has the disadvantage of being of particular application because it is proven safe only in a particular group signature scheme which corresponds to that presented in the article by J. Camenisch, M. Michels, having for reference "A group Signature Scheme with Improved Efficiency ”, In K. Ohta and D. Pei, editors, Advances in Cryptology - ASIACRYPT'98, volume 1514 of LNCS, pages 160-174. Springler-Verlag, 1998. Furthermore, this method is disadvantageous in that it imposes calculations on each member each time a member joins or leaves the group; however, these calculations can become frequent if the group dynamics are important.

One of the objectives of the invention is to remedy the drawbacks of the known and previously described methods.

Statement of the invention

To this end, the subject of the invention is a cryptographic method of anonymous signature of a message intended to be implemented by a member of a group, this group being composed of n members each equipped with a means of calculation and an associated storage means. This process comprises initial steps which consist in the constitution of the group: in a first step, to calculate by a first means of calculation of a trusted authority, a pair of asymmetric keys common to the members of the group, this pair of keys consisting of a public key and a common private key, in a second step, to be calculated by the first means of calculation a group public key associated with the group, in a third step, for each member, during an interaction between the means of calculating the trusted authority and the means of calculating the member, calculating a private group key and storing this private group key in the member memorizing means, each group private key being associated with the group public key and being different for each member of the group,

- in a fourth step, to determine by the first means of calculation as many symmetric secret keys as there are members of the group, in a fifth step, to encrypt by the first means of calculation the common private key with each of the secret keys to obtain as many of encrypted forms of the common private key than of unrevoked members.

And each revocation within the group, the method comprises steps which consist: in a sixth step, by modifying by the first means of calculation the pair of common asymmetric keys to determine a public key and a private key up to date common, in a seventh step, to encrypt by the first means of calculation the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as non-revoked members.

And with each anonymous signature of a message by the member of the group, this message having to be transmitted to a recipient, the method comprises steps which consist:

- in an eighth step, updating the common private key memorized by the member memorization means only if one of the encrypted values of the common private key is decipherable using the symmetric secret key memorized by the memorizing means of the member,

- in a ninth step, to be calculated by the member's calculation means, a so-called anonymous signature of the message using his private group key,

- In a tenth step, to calculate by the member's calculation means a so-called additional signature of the set composed of the message and the anonymous signature, using the member's common private key. The method according to the invention consists in supplementing the anonymous signature of a message made by a member with an additional signature. This additional signature is calculated using a copy, held by the member, of a private signature key identical for all the members authorized to sign and unknown to all the dismissed members. This so-called common private key is updated by the trusted authority each time a member of the group is dismissed. The update of the copy held by the member is triggered only during an anonymous signature phase of a message by this member and the update is only possible for an unrevoked member.

Thus, a revoked member is always detected because the additional signature that it provides is necessarily false since it does not have the updated common private key.

According to another object, a method according to the invention is such that the group is set up on a date that is such that the steps also consist of:

- during the first step, to associate by the first means of calculation the common private key with an update date equal to tl,

- during the third stage, to memorize by the memorization means of each member the date of updating of the common private key, and is such that at each revocation within the group at a date t2, the stages consist of outraged :

- during the sixth step, to modify by the first means of calculation the update date to determine an update date equal to the date t2, and is such that on each anonymous signature of a message by the member of the group, this message having to be transmitted to a recipient, the steps also consist of:

- during the eighth step, updating the common private key stored by the member storage means only if in addition the update date stored by the member storage means is different from the update date of the common private key updated by the first means of calculation.

According to another object, a method according to the invention is such that the steps also consist of:

- during the third step, to further calculate by the first calculation means, for each member of the group, an identifier of the member and to additionally memorize by the means of memorizing each member the identifier of the member, and is such that upon each dismissal within the group the steps also consist of:

- to calculate by the first calculation means for each new member of the group an identifier.

- during the third step, to memorize by a memorization means connected to the first means of calculation the symmetric secret key of each member, the pair of asymmetric keys common to the members of the group and the public group key, and is such that for each modification of the composition of the group which corresponds to a revocation within the group, the method further comprises the step which consists in: deleting the secret key of the revoked member, from the storage means connected to the first calculation means, and is such as for updating the common private key stored by the member storage means, the method further comprises the steps which consist:

- to read by the member's calculation means, the different encrypted forms of the common private key which are stored in the storage means connected to the first calculation means,

- to decrypt by the member calculation means and using the secret key memorized by the member memorization means, the different encrypted forms of the common private key.

The subject of the invention is also a cryptographic device for anonymous signature of a digital message which comprises:

a first calculation means for calculating on the one hand at least one pair of asymmetric keys common to the members of the group composed of n members and on the other hand a public group key associated with the group, to calculate for each member, during '' an interaction with the member's calculation means, a group private key, each group private key being associated with the group public key and being different for each member of the group, to determine as many symmetric secret keys as members of the group group and to encrypt the common private key with each of the symmetric secret keys to obtain as many encrypted forms of the common private key as there are unrevoked members. According to another object, a device according to the invention further comprises: - a storage means connected to the first calculation means via a communication network for storing at least the symmetric secret key of each member of the group, the group public key , the public key common to the members of the group and each of the different encrypted forms of the common private key. The invention further relates to a smart card intended for a member of a group consisting of n members and intended to interact with a previous device. This card includes:

a means of memorizing a private key common to the members of the group, a private group key of the member and a symmetric secret key allocated to the member,

a means for updating the common private key stored by the member storage means for updating the common private key only if one of the encrypted values of the common private key, calculated by the first means of calculating the device, is decipherable using the symmetric secret key memorized by the member memorization means,

a calculation means for calculating an anonymous signature of a message using its private group key and for calculating an additional signature of the set composed of the message and the anonymous signature using the private key common of the member.

According to another object, a card according to the invention is such that the updating means comprises a decryption means for decrypting one of the encrypted values of the common private key, calculated by the first calculation means of the device, at the using the common private key memorized by the member memorization means.

Brief description of the figures

Other characteristics and advantages of the invention will appear during the description which follows and which is given with reference to the appended figures of particular embodiments given by way of nonlimiting examples. These figures represent:

Figure 1 is a flow diagram of a method according to the invention.

FIG. 2 is a flow diagram of a particular embodiment of a method according to the invention.

Figure 3 is a diagram of a particular embodiment of a method according to the invention.

Detailed description of embodiments of the invention FIG. 1 represents a flow diagram of a cryptographic method of anonymous signature of a message according to the invention. The method is intended to be implemented by a member of a group composed of n members. Each member has a means of calculation associated with a means of memorization. The process takes place in different steps which include initial steps and non-initial steps. The initial stages occur during the creation of the group and are listed below.

A first step consists in calculating 1 by a first means of calculating a trusted authority, a pair of asymmetric keys common to the members of the group; this key pair consists of a common public key and a common private key. The algorithm used for the first step is a public key signature algorithm which may be the RSA algorithm, for R.L. Rivest, Shamir and L. Adleman who are the authors.

A second step consists in calculating 2 by the first means of calculating a group public key associated with the group. The calculation is performed using a particular algorithm. This algorithm can be that described in the article by J. Camemsch and M.Michels which has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS , pages 410 to 424, Springer-Verlag, 1997.

A third step consists in calculating 3 during an interaction between the trusted authority and each member of the group taken successively, a group private key associated with the group public key, each group private key being different for each member of the group. group. During the interaction, the member's private group key is stored 4 by the member's storage means, the trusted authority is not aware of this key. The calculation is performed using a particular algorithm. This algorithm can be that described in the article by J.Camenisch and M.Michels which has for reference "Efficient group signature signature schemes for large groups", In B.Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS , pages 410 to 424, Springer-Verlag, 1997.

A fourth step consists in determining 5 by the first means of calculation as many symmetric secret keys as there are members of the group. This determination may consist of randomly drawing numbers and letters to form a key. Alternatively, the symmetric secret keys can verify a certain distribution. Such a distribution is described in the article by CKWong, MGGouda and SSLam entitled "Secure Group Communications Using Key Graph" - Technical Report TR-97-23, July 28, 1997. A fifth step consists in encrypting 6 by the first means of calculating the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as there are non-revoked members. The encryption is performed using an encryption algorithm such as the AES algorithm.

According to the previous variant, the symmetric secret keys verify a certain distribution which makes it possible not to encrypt the common private key with each of the secret keys but with only some of them.

After constitution, the composition of the group can change. 7. A modification consists either of a dismissal within the group, or of the entry of a new member in the group. At each dismissal within the group and optionally upon the arrival of a new member, the process includes the following steps.

A sixth step consists in modifying 8 by the first means of calculation the pair of common asymmetric keys to determine a public key and a common private key up to date with the composition of the group. This modification is carried out using typically the same algorithm as that used during the first step.

A seventh step consists in encrypting 9 by the first means of calculating the common private key with each of the secret keys to obtain as many encrypted forms of the common private key as there are non-revoked members. This encryption is performed using typically the same algorithm as that used during the fifth step.

At any given time, a group member can undertake to sign a message before forwarding it to a recipient. With each anonymous signature of a message by the member, the process comprises the following steps.

An eighth step consists in updating 11 the common private key memorized by the member memorization means only if one of the encrypted values of the common private key is decipherable using the symmetric secret key memorized by the memorization means. member. The decryption is carried out using the same algorithm as that used during the seventh step, that is to say during the encryption. The update is performed if the decryption algorithm makes it possible to decrypt one of the encrypted values of the common private key.

A ninth step consists in calculating 12 by the calculation means associated with the member memorization means, a so-called anonymous signature of the message using his group private key. The calculation is performed using an anonymous signature algorithm. Such an algorithm is described in the article by J. Camenisch and M.Stadler who has for reference "Efficient group signature signature schemes for large groups", In B. Kaliski, editor, Advances in Cryptology - CRYPTO97, volume 1296 of LNCS, pages 410 to 424, Springer-Verlag, 1997. Another description is given in the article by J.Camenisch and M.Michels which has for reference "A group signature scheme with improved efficiency. In K.Ohta and D.Pei, editors, Advances in cryptology- ASIACRYPT'98, volume 1514 of LNCS , pages 160-174, Springer-Verlag, 1998.

A tenth step consists in calculating 13 by the member calculation means a so-called additional signature of the set composed of the message and the anonymous signature, using the member's private common key. The algorithm used for the tenth step is a public key signature algorithm which may be the RSA algorithm.

FIG. 2 is a flow diagram of a particular embodiment of the method according to the invention. The elements already described with reference to FIG. 1 are not re-described. The specific elements are described below.

The first step further consists in associating 14 an update date equal to tl with the common private key, by considering that tl is the date of constitution of the group.

The third step further consists in storing 15 by the storing means of each member the date of updating of the common private key.

At each modification of the private key common to a date t2 during the sixth step, the method furthermore consists in modifying 16 by the first means of calculating the update date to determine an update date equal to the date t2.

With each anonymous signature of a message by a member of the group, this message having to be transmitted to a recipient, the eighth step consists in updating the common private key memorized by the means of memorization of the member if, in addition, the date update date stored by the member storage means is different from the update date of the common private key updated by the first calculation means. On the other hand, if the date memorized by the member memorization means is equal to the date of updating of the updated group private key, there is no update by the member memorization means .

As long as there is neither revocation nor entry of a new member, there is no update of the pair of common asymmetric keys and of the date of update by the first means of calculation . Consequently and advantageously, the member's calculation means does not update his common private key, he uses the private key common which is stored in the member storage means for calculating the additional signature.

FIG. 3 is a diagram of an embodiment of a method according to the invention by means of a system.

The system includes at least one calculation means and as many smart cards 211 as there are members in the group.

A trusted authority, such as a natural person, a legal person, a national or international administration, has a computing means 20 represented by a server in FIG. 3. This computing means 20 is connected by a first communication link 22 to a communication network 23 which may as well be a public network such as the Internet, as a private network such as a LAN network, short for Anglo-Saxon terms Local Area Network.

Each member of a group has a 21 card! a chip which comprises in the chip a means 24 for storage and a means 25 for calculation. Each member also holds, or has access to, a reader 26 of this card rehé by a second communication link 27 to a personal computer 28, or any equivalent computer. The personal computer 28 is rehé by a third communication link 29 to the communication network 23.

The constitution of the group with the trusted authority results in an interaction between the trusted authority and each member of the group. Before this interaction, the server 20 of the trusted authority calculates a pair of asymmetric keys 30, 31 common to the members of the group and a group public key 32 associated with the group. During each interaction, the server 20 of the trusted authority and the means 25 for calculating the member calculate a key 33 _! private group. The group private key 33ι is stored in the means 24 for storing the member's smart card. After interacting with the trusted authority, the member has his own group private key which is different from the group private key of all the other members. The pair 30, 31 of common asymmetric keys consists of a common public key 30 and a common private key 31. This pair 30, 31 can be associated with an update date D which is initialized on the date tl of calculation of this pair. The group private keys are different for each member of the group and are associated with the group public key 32.

During each interaction, the server 20 of the trusted authority determines a key 34 _! symmetrical secret. The server 20 then encrypts the common private key 31 with each of the secret keys 34i to obtain as many encrypted forms of the common private key 31 as of non-revoked members.

Generally during each interaction, the server 20 of the trusted authority and the means 25 for calculating the member also calculate an identifier 35i of the member.

During the interaction between the trusted authority and a member, the chip card 211 stores in its storage means 24 the common private key 31, the member's private group key 33 ₁ and the secret key 341 assigned to the member. The keys are transferred to a smart card during interaction using conventional methods.

The trusted authority keeps a copy of each of the symmetrical and identifying secret keys 34j 35i of each member in a memory space which can be a memory zone of the server 20 or an associated storage means 36. The different public keys and the encrypted values of the common private key 31 are stored in a directory which is stored in a public part of the memory space 20, 36; that is to say directly accessible, in particular, by each member of the group or, in particular, by each recipient of a message and this via the network 23.

After constitution with the trusted authority, the group can evolve, either by the entry of a new member in the group, or by the dismissal of a member of the group.

At each revocation within the group, the server 20 modifies the pair of common asymmetric keys 30, 31 to determine a pair of asymmetric keys up to date with the composition of the group. This update is performed on a given date known as the update. It can also be carried out when a new member enters the group.

After determining this pair of up-to-date common asymmetric keys, the server 20 makes available in encrypted form the private key 31 of this pair of asymmetric keys for each of the smart cards 211 of the non-revoked members of the group. The server 20 calculates as many encrypted forms as there are non-revoked members by using the key 34; personal secret to each of these members. At each evolution of the group, the server 20 encrypts the private key 31 of the pair of up-to-date common asymmetric keys 30, 31.

Each of the personal secret keys 34ι introduced as an input argument of the encryption algorithm used corresponds to a result which is the value encrypted of the common private key 31 of the pair of asymmetric keys up to date. The different results and, generally, the date of update are stored in the directory.

When a member of the group wants to sign a message stored in a personal computer 28, he introduces his card 21 _! chip in the card reader 26 connected to this computer 28. The means 25 for calculating the card 21 _! smart connects to the memory space 20, 36 in which the directory is stored, via the personal computer 28 and the network 23.

The smart card 21 ι reads in the directory the date D to update the common private key. The means 25 for calculating the chip card 211 compares this update date D with that Oι which it holds in its storage means 24. Either these dates are different, or these dates are identical.

If the dates are different, card 21! chip can, for example, copy into its storage means 24 the various encrypted forms of the common private key 31. The means 25 for calculating the smart card 21. r can then undertake to decrypt each of the encrypted forms of the common private key 31 using the decryption algorithm which is associated with the encryption algorithm previously used. The input arguments include on the one hand, the personal secret key 341 stored in the card 21 _! on the other hand, taken successively, the encrypted forms of the common private key 31. At the first correct decryption result, card 21! smart updates on the one hand the common private key 31 which it holds in its storage means 24 with the decrypted value of the common encrypted private key 31 and on the other hand the date Dj; update it holds in its storage means 24 with the update date D associated with the decrypted value of the common encrypted private key 31.

Another method consists in placing before each encrypted form of the common private key 31 an identifier of the member concerned. The means 25 for calculating the smart card 21 i can then undertake to test each of the encrypted forms of the common private key 31 using the identifier. When it arrives at a valid test, it then undertakes to decrypt the encrypted form of the common private key 31 which corresponds to it using the decryption algorithm which is associated with the previously used encryption algorithm. The input arguments include on the one hand, the personal secret key 34χ stored in the card 21 _! on the other hand, the encrypted form of the common private key 31. Card 21! on the one hand updates the common private key 31 which it holds in its storage means 24 with the decrypted value of the common encrypted private key 31 and on the other hand the date Oι of updating day it holds in its storage means 24 with the update date D associated with the decrypted value of the common encrypted private key 31.

If the dates are identical, the smart card does not make a copy in its means 24 of memorizing the different encrypted forms of the common private key 31. This situation arises when no change in the group has taken place since the member's entry into the group; card 21 _! chip holds the latest update of the common private key 31.

After this updating phase, the means 25 for calculating the smart card 21 ₁ retrieves the message stored in the computer 28. The means 25 for calculating the smart card 21 ₁ calculates an anonymous signature of this message to using the signature algorithm. The input arguments comprise on the one hand the message and on the other hand the group private key 33 ₁ stored in the chip storage means 24.

At the end of this calculation, the means 25 for calculating the chip card 211 calculates a second so-called additional signature of the assembly formed of the message and the anonymous signature using the previous signature algorithm. The input arguments comprise on the one hand the assembly formed of the anonymous message and signature and on the other hand the common private key 31 stored in the member storage means.

Finally, card 21 _! smart transmits to the recipient chosen by the member, the additional signature, the anonymous signature and the message.

The recipient can in these conditions verify that the member who signed the message is a non-revoked member. To this end, the recipient verifies each of the two signatures, the additional signature and the anonymous signature, using the common public key, respectively the group public key. To verify, the recipient uses a verification algorithm available for example on a personal computer. The input arguments comprise on the one hand the message and on the other hand the common public key, respectively the group public key.

A first application of a method according to the invention is electronic voting. Electronic voting takes place in two phases:

- registration on an electoral list with an administrative authority,

- a voting operation with a ballot box connected via a communication network to a server of a voting administration.

During registration, the voter obtains a private group key according to a method according to the invention. In this implementation of the process, the anonymous signature that the voter can produce from his group private key is said to be "correlable". This means that, in the event that the voter attempts to anonymously sign a second ballot by producing an anonymous signature, that ballot will be rejected by the ballot box. Indeed, the anonymous signature being correlable, the ballot box is able to verify that it is a second anonymous signature.

A malicious voter cannot claim to have lost their group private key, receive another, and be able to vote twice. Indeed, the implementation of a method according to the invention makes it possible to prohibit the use of the first group private key; this group private key is updated when he declares having lost the first group private key. This loss is managed by the implementation of a process according to the invention such as a revocation of the member.

A second application of a method according to the invention is an electronic auction service. The auctions involve three protagonists: an auction server, a trusted authority and a client. All of the clients form a group called the client group. A user wishing to register with the group of clients must contact the trusted authority which provides him with his group private key. He thus obtains the right to produce an anonymous group signature. Armed with this right, he can sign each of his auctions anonymously. When bidding on a certain product, each member of the client group can bid by signing a message containing in particular the product put up for sale and the amount of their bid. The auction server can verify group membership and therefore the validity of the auction by verifying the anonymous group signature. The winner is the one who gives the last bid before the auction. The last message received by the auction server is therefore that of the winner. The server then addresses this message and the corresponding anonymous group signature to the trusted authority, which is the only one capable of lifting anonymity and therefore of determining the physical identity of the buyer of the product being auctioned.

The auctions involve dynamic groups: new people can join the group every day, a member can leave the group or be excluded for fraud at any time. It is therefore essential to set up a revocation system to prevent a revoked member from being able to use their signature fraudulently. Indeed, the revoked member could continue to use his private group key to participate in the auctions and distort the smooth running of the latter, for example by increasing the amount. And, if he takes care to withdraw early enough from the process so as not to win the auction in question, then this fraud is not detected since only the identity of the winner is finally revealed. The implementation of a method according to the invention makes it possible to solve the problem of revocation of one or of member (s) of the group.

A third application of a method according to the invention is electronic payment. It involves four protagonists: a customer, a merchant, a bank and a trusted authority. Each client must be identified by the system and obtain a group private key before being able to make their first transaction. To make a payment, the customer must withdraw electronic documents from his bank. The pieces he removes are anonymous thanks to the use of a mechanism called blind signature. The expenditure of a C piece at a merchant is done as follows: the chent generates a group signature relating to C pieces and transmits the signature and C pieces set to the merchant. The merchant verifies the signature of the bank attached to each piece C and verifies the group signature. If each of the two signatures is valid, the merchant accepts the transaction. At a given time of the day, the merchant forwards to his bank the signatures and the documents received in payment for transfer to his account. In the event of fraud, for example by the reuse of the same coin in several transactions, the bank sends the group signature relating to the disputed document to the trusted authority so that it identifies the indelicate price and sanctions the offender.

A reliable mechanism for revoking compromised group private keys is necessary in order to avoid fraud of the following type: a dishonest client reports the loss of his group private key to the trusted authority and therefore declines all responsibility for fraud that could be committed with s. The chent gives his key to his accomplice, who can then use s to sign the coins c he has legitimately withdrawn from the bank, and then spend them as many times as he wishes. A method according to the invention solves the problem of revoking group private keys.

Claims

1. Cryptographic method of anonymous signature of a message intended to be implemented by a member of a group, this group being composed of n members each equipped with a means (25) of calculation and a means (24 ) associated memorization, characterized in that it comprises initial stages which consist in the constitution of the group:

- in a first step, to be calculated (1) by a first means of calculating a trusted authority, a pair of asymmetric keys (30,31) common to the members of the group, this pair of keys consisting of a key (30) public and of a common private key (31), in a second step, to calculate (2) by the first means of calculation a group public key (32) associated with the group,

- in a third step, for each member, during an interaction between the means of calculating the trusted authority and the means of calculating the member, to calculate (3) a group private key (33 ₁ ) and to memorize (4) this private group key (331) in the member memorization means (24), each private group key (33ι) being associated with the public group key (32) and being different for each member of the group ,

- in a fourth step, to be determined (5) by the first means of calculation as many symmetrical secret keys (34i) as there are members of the group, in a fifth step, to be encrypted (6) by the first means (20) of calculation the common private key (31) with each of the secret keys (34;) to obtain as many encrypted forms of the common private key (31) as there are non-revoked members, and in that on each revocation within the group, the method comprises steps which consist: in a sixth step, of modifying (8) by the first means (20) of calculation the pair of common asymmetric keys (30, 31) to determine a public key (30) and a key (31 ) private common up to date, in a seventh step, to encrypt (9) by the first means (20) of calculation the private key (31) common with each of the secret keys (34j) to obtain as many encrypted forms of the key ( 31) private common only of non-revoked members, and in that on each anonymous signature (10) of a message by the group member, this message having to be transmitted to a recipient, the method comprises steps which consist of:

- In an eighth step, updating (11) the common private key (31) stored by the member memorization means (24) only if one of the encrypted values of the common private key (31) is decryptable using the key (34 ^ symmetrical secret memorized by the member memorization means (24),

in a ninth step, to be calculated (12) by the means (25) of calculating the member, a so-called anonymous signature of the message using its private group key (331),

in a tenth step, to calculate (13) by the means (24) of calculating the member a so-called additional signature of the set composed of the message and the anonymous signature, using the common private key (31) of the member.

The cryptographic anonymous signature method according to claim 1, in which the constitution of the group took place on a date tl and in which the steps further consist:

- during the first step, to associate (14) by the first calculation means the common private key (31) with an update date equal to tl,

- during the third step, to memorize (15) by the means (24) of memorizing each member the date of update of the common private key (31), and in which at each revocation within the group at a date t2, the steps also consist of:

- during the sixth step, to modify (16) by the first means (20) of calculating the update date to determine an update date equal to the date t2, and in which on each anonymous signature of a message by the group member, this message having to be transmitted to a recipient, the steps also consist of:

- during the eighth step, to update (11) the common private key memorized by the member memorization means (24) only if in addition the date (O) of update memorized by the member (24) memorisation of the member is different from the date (D) of updating of the common private key (31) updated by the first means of calculation.

3. Cryptographic anonymous signature method according to claim 1, in which the steps further consist of:

- during the third step, to calculate (3) in addition by the first means of calculation, for each member of the group, an identifier (35i) of the member and to store (4) in addition by the means (24) of memorization of each member the identifier (35;) of the member, and in that at each dismissal within the group the steps also consist: in calculating by the first means (20) of calculation for each new member of the group an identifier (35 *).

4. Cryptographic method of anonymous signature of a message according to claim 3, in which the initial steps further consist: during the third step, to be memorized by a means (36) of memorization rehé to the first means (20) of calculation the symmetric secret key (34j) of each member, the group public key (32), the public key (30) common to the members of the group, each of the different encrypted forms of the common private key (31) and each of the identifiers ( 35i), each encrypted form of the common private key (31) being associated with one of the identifiers (35;), and in which for each modification of the composition of the group which corresponds to a revocation of one of the members of the group, the the method further includes the step of:

- to delete the secret key (34;) of this member, of the storage means (36) connected to the first calculation means (20), and in that to update the common private key (31) stored by the means (24) for memorizing the member, the method further comprises the steps which consist of:

- To read by the means (25) of calculation of the member, the encrypted form of the common private key (31) which is memorized in the means (36) of memorization rehé to the first means (20) of calculation and associated with the member identifier (35i),

- To decipher by the means (25) of calculation of the member and using the secret key (34;) memorized by the means (24) for memorizing the member, the encrypted form of the private key (31) previously shared read.

5. Cryptographic method of anonymous signature of a message according to claim 1, in which the initial steps also consist of:

- during the third step, to be memorized by a memory means (36) rehé to the first means (20) of calculating the secret key of each member, the pair of asymmetrical keys (30, 31) common to the members of the group and the group public key (32), and in which for each modification of the group composition which corresponds to a revocation within the group, the method further comprises the step which consists in:

- to delete the secret key of the revoked member, from the memorized means (36) to the first calculation means (20), and in that to update the common private key (31) memorized by the means (24) memorisation of a member the method further comprises the steps which consist:

- to read by the member calculation means (25), the different encrypted forms of the common private key (31) which are stored in the storage means (36) connected to the first calculation means (20),

- To decipher by the means (25) of calculation of the member and using the secret key (34i) memorized by the means (24) for memorizing the member, the different encrypted forms of the common private key (31).

6. Cryptographic device for anonymous signature of a digital message, characterized in that it comprises:

- a first calculation means (20) for calculating (1, 2) on the one hand at least one pair of asymmetric keys (30, 31) common to the members of the group composed of n members and on the other hand a key (32 ) group public associated with the group, to calculate (3) for each member, during an interaction with the means (25) for calculating the member, a key (33 ^ group private, each key (331) group private being associated with the group public key (32) and being different for each member of the group, to determine (5) as many symmetrical secret keys (34;) as group members and to encrypt (6) the key (31) private common with each of the symmetric secret keys (34;) to obtain as many encrypted forms of the common private key (31) as non-revoked members.

7. Cryptographic device for anonymous signature of a digital message according to claim 6, in the device further comprising:

a means (36) of memorizing rehé to the first means (20) of calculation via a communication network (23) to memorize at least the secret symmetric key (34;) of each member of the group, the public key (32) of group, the public key (30) common to the members of the group and each of the different encrypted forms of the common private key (31).

8. Chip card (2) intended for a member of a group consisting of n members and intended to interact with a device according to one of claims 6 and 7, characterized in that it comprises:

a means (24) for storing a private key (31) common to the members of the group, a private group key (33 i) for the member and a symmetric secret key (34χ) assigned to the member,

- a means (25) for updating the common private key (31) memorized by the member memorization means (24) for updating (11) the common private key (31) only if one of the encrypted values of the common private key (31), calculated by the first means (20) for calculating the device, is decipherable using the secret symmetric key (341) memorized by the member memorization means (24),

a calculation means (25) for calculating (12) an anonymous signature of a message using its private group key (33) and for calculating (13) an additional signature of the set composed of the message and anonymous signature using the member's common private key (31).

9. Smart card (2 li) according to claim 8 wherein the updating means (25) comprises a decryption means for decrypting one of the encrypted values of the common private key (31), calculated (1) by the first means (20) for calculating the device, using the symmetric secret key (34ι) memorized by the member memorization means (24).

10. Cryptographic system for anonymous signature of a digital message intended to implement a method according to claim 1, characterized in that it comprises:

- at least one device according to one of claims 6 and 7 and at least as many smart cards (211) according to claim 8 as there are members in the group.