EP1832034A2

EP1832034A2 - Method for rapidly generating a random number that cannot be divided by a pre-determined set of prime numbers

Info

Publication number: EP1832034A2
Application number: EP05825311A
Authority: EP
Inventors: Marc Joye; Pascal Paillier
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Thales DIS France SA
Priority date: 2004-12-20
Filing date: 2005-12-20
Publication date: 2007-09-12
Also published as: WO2006067157A2

Description

A method of rapidly generating a non - divisible random number by a predetermined set of prime numbers.

Scope of the invention. The invention relates to a method for the rapid generation of a relatively prime random integer to a set of predetermined prime numbers and to a device for implementing the method.

A decisive advantage of the invention lies in its very rapidity compared with similar prior techniques.

The invention is particularly but not exclusively applicable to the generation of large random prime numbers. The generation of large random prime numbers has many practical applications, in particular in public key cryptography.

State of the art before the invention. There are a large number of asymmetric (also called public key) schemas for performing cryptographic functions such as information encryption, digital document signing, or remote identification of people. Popular examples of such schemes are RSA (Rivest, Shamir and Adelman), DSA, El Gamal, Schnorr, Cramer-Shoup, and so on. A common feature of asymmetric cryptography schemes is that they use one or more prime numbers whose size can vary between 160 and 2048 bits. The prime number (s) used by a scheme generally form one or more keys. Typically, some schemas like RSA require the generation of two large random numbers of neighboring size to constitute the private key. The generation of large random prime numbers is therefore a fundamental tool in public key cryptography. A simple and common way to generate a random prime number is to randomly draw a number q using a random number generator and then test its primacy using a test or a random number. a pseudo-test of primacy. If the test is unsuccessful, the value of q is incremented by 1 and the test is re-applied, and so on. Since all prime numbers are odd (except 2), a trivial improvement of this technique consists in choosing as an initial value of q an odd random number and then incrementing q by 2 until q is prime. Unfortunately, this simple technique is very inefficient in terms of speed and is therefore dissuasive when large prime numbers are to be generated. However, there are techniques for generating large prime numbers that are noticeably faster. In most of these fast techniques, we choose a random initial value for q such that qn 'is divisible by no small first (pi, p ₂ , ..., Pk) (with typically pi = 2, p2 = 3, etc. .) and q <π = pi * p2 ... * Pk - The first ones (pi, p2, ..., Pk) are here parameters of the generation. Subsequently, q is tested and transformed iteratively, until it is prime with π. Several known methods make it possible to obtain q prime with π.

In a first method, q <π is chosen randomly using a random number generator, then we test if q and π are prime between them, making sure that PGCD (q, π) = 1. case of failure, increment q or draw a new random value for q, then test q again, and so on.

The central unit of the device must for this purpose calculate the greatest common divisor (GCD) between the two numbers q and π and verify that the result is equal to 1. Indeed it is recalled that two numbers are prime between them if and only if their largest common divisor is 1. There are several well-known techniques for implementing the computation of the two-number PGCD with the aid of a microprocessor. Examples include techniques such as "Binary GCD", "Extended GCD" or Lehmer technique. Despite excellent asymptotic complexity (i.e. for extremely large numbers), these techniques are both difficult to program on portable microprocessor-based (complex) and poor performance devices. for large numbers of usual sizes such as 512, 1024 or 2048 bits.

In a second known method of document FR 2 807 426, the parameter λ = Λ (π) where Λ denotes the function of Carmichael is pre-calculated. We draw a random value q <π and we test if the number q mod π is equal to 1 or not. As long as this is not the case, q is incremented by a constant amount such that 1 or a new random value is assigned to q and the test is repeated.

In a third method, known from US 2004-0028223 and which will be called later Pallier / Joye process, is in fact an improvement of the second method described above. In the Pallier / Joye process, to compute a random and prime number q with p from an initial number qO random and less than π (qO <π), the following steps are performed: Ep: calculate λ = Λ (π), where L is the function of Carmichael,

Eq: initialize q to qO Er: calculate u = q mod π

Es: if u is equal to 1, then q is prime with p and the process ends,

And: if u is different from 1, draw a random number z, calculate q ^f = q + z (1-u) mod π, and assign to q the value q ^f

Eu: repeat steps Er to Et, as long as u is different from 1.

The method of the invention also makes it possible to generate a relatively prime random number q <π with the predetermined parameter π. An essential advantage of the invention lies in its extreme speed in comparison with the known methods described above.

Summary of the invention. The method of the invention consists in using the particular form of the parameter π to accelerate the technique of the Pallier / Joye process.

Thus, the invention relates to a cryptographic method in which a random and undividable final number (q _L ) is generated by a predetermined set of prime numbers (pi, p2, • • -, Pk) from a random number initial (qo). The method is particularly interesting for the generation of cryptographic keys. According to the invention, the following steps are repeated, iteratively for i = 1 to L, where L is an integer:

Eli: generate a parameter of rank i (7Ii) divisible by certain prime numbers of said set predetermined and first with parameters of ranks lower than i (TIi, ..., Tli-i),

E2i: modulo reduce the parameter of rank i (7Ii) a random number of rank i-1 (qi-i) obtained during a previous iteration

E3i: execute the Pallier / Joye method to modify the random number of rank i-1 reduced (qi-i mod 7Ii) and produce a relatively modified number (qim) with said parameter of rank i (π _± ), E4i: subtract to the modified number (qim) obtained in step E3i the random number of rank i - 1 reduced obtained in step E2i (result qi _m - qi - i mod 7Ii),

E5i: multiply the result of the subtraction of step E4i by the product (7Ii * ... * 7Ii-i) of the parameters of rank 1 to i-1

E6i: add the result of the multiplication of step E5i to the random number of rank i-1 (qi-i) to obtain a random number of rank i (qi), the final random number being the random number of rank L .

The succession of steps Eli to E6i is such that the random number of rank i produced at the end of step E6i is prime with the number π _± . Since the random number of rank i-1 is prime with the parameters of rank 1 to i-1 (it was built for that by repeating the steps E1 to E6), then the random number of rank i is prime with all the parameters from rank 1 to i (and therefore also with the product of these parameters.

Moreover, since the parameters 7Ii are chosen multiple of (or divisible by) some of the prime numbers of the predetermined set, the number random of rank i is necessarily prime with prime numbers of the predetermined set.

Finally, because of the use of calculation parameters (the parameters of rank 1 to L TIi, ..., π _L ) smaller than the parameter π (which is the product pi * ... * p _L of the said parameters), there is a spectacular acceleration of the speed of execution in comparison with the technique of the Pallier / Joye process as described in US Patent Application No. 2004-0028223. In the invention, L the Pallier / Joye process, but with parameters π _± much smaller than π, which considerably speeds up the calculations. As a practical example, a particular embodiment of the method of the invention has been found to be about 100 times faster when the parameters 7I 1 are chosen to be close in size and when L is of the order of 20. It can be shown that the statistical characteristics of the invention in terms of output distribution are identical in all respects to those of the process of US Patent Application No. 2004-0028223.

In step E3i, the Pallier / Joye method as described above and comprising the following substeps consisting of:

Epi: calculate λi = Λ (7Ii), where Λ is the function of Carmichael,

Eqi: initialize q _im to the value of the random number of reduced rank i-1 (qi-i mod 7Ii) obtained during step E2i

Er: calculate Ui = qi _m 'mod 7Ii

Es: if Ui is equal to 1, then qi _m is prime with 7li and step E3i ends, And: if Ui is different from 1, draw a random number z, calculate q 'i = q _im + z (1-Ui) mod π _± , and assign to qi _m the value q' i

Eui: repeat steps Er to Et, as long as Ui is different from 1.

In a preferred embodiment of the invention, the method also comprises an initialization step E0 consisting of: - choosing a random number L,

- Perform in advance the set of steps Eli, for any i varying from 1 to L, to determine the parameters (7Ii, ..., π _L ) of rank 1 to L such that their product (TIi * ... * π _L ) is a multiple of the product of all prime numbers in the predetermined set (pi * p2 ... * Pk) and

performing in advance all the steps EP ₁ for i varying from 1 to L, to determine associated Carmichael parameters (λi = Λ (πi), ..., λ _L = Λ (π _L )) at all parameters of rank i between 1 and L,

- Store the number L, the parameters of rank i (TIi, ..., π _L ) between 1 and L and associated Carmichael parameters λi, ..., λ _L ), for later use. This initialization step makes it possible to carry out calculations of constants in advance, and to make it easier for the product of the parameters of rank 1 to L to be a multiple of the product of all the integers of the predetermined set (c '). that is, the product of the parameters of rank 1 to L is divisible by each integer of the predetermined set).

In a language more familiar to specialists in the technical field, one can summarize the preferred mode of performing the method of the invention by the following steps, for i ranging from 1 to L, executed after having chosen an initial random number qo:

1. Determination of a sequence of L parameters TIi, ..., π _L where L is an integer, such that p-, divides πi * ... * π _L for all j = l, ..., k , p -, being a prime integer of a predetermined set (p1, p2, ..., Pk) of k prime numbers, and λi = Λ (πi), ..., λ _L = Λ (π _L ) where Λ is the function of Carmichael; 2. Draw a random number q;

3. Initialize π = 1;

4. For i from 1 to L do: a. Calculate q = q ° _im _im = i mod q _^ I _1; b. Calculate U ₁ = q _im ¹ mod π _lf 'c. If U ₁ = I go to step 4. g; d. Draw a random number z; e. Calculate q ¹ _± = q _im + (1-U ₁ ) * z mod 7I ₁ and assign q ^f ! to _im f. Go to step 4. b; boy Wut . Calculate q = q + π * (q _im -q _im ° mod I ₁ ); h. Calculate π = π * TC ₁ ;

5. Calculate q = q mod π;

6. Return q.

In the field of cryptography, the above method is particularly useful as a step of a method of generating a cryptographic key.

The invention also relates to a portable electronic device comprising a central processing unit and an associated program memory, mainly characterized in that it comprises a program for implementing a method for generating random numbers which are not divisible by a set predetermined number of prime numbers as described above.

Advantageously, the portable electronic device is constituted by a microprocessor chip card that can include an arithmetic co-processor.

Other features and advantages of the invention will become clear from reading the detailed description which is given below of an exemplary implementation of a method according to the invention and an example of associated device. The description is given by way of nonlimiting example and with reference to the appended drawings in which:

FIG. 1 represents the block diagram of a portable electronic device such as a smart card implementing the method according to the invention,

FIG. 2 represents the diagram of an exemplary embodiment of the implementation of the method according to

The invention,

- Figure 3 shows the diagram of a second embodiment of implementation of the method according to the invention using arithmetic operations known as Montgomery.

Detailed description of the invention. In the following description, an example of a portable electronic device is that of microprocessor chip cards and will be discussed to simplify microprocessor cards.

In the implementation of a public key cryptography scheme such as RSA, it is necessary to generate two prime numbers of large numbers. size known in advance, for example 512 or 1024 bits. These then allow the creation of a private key and a corresponding public key. The known techniques of generating prime numbers having the best characteristics in terms of simplicity and speed of computation, require, during an initialization phase, the generation of a random number having the property of being non - divisible by a set (pi, p2, ..., Pk) of prime numbers. The choice of the first (pi, p2, ..., Pk) is predetermined and may depend, for example, on the desired size of the generated first number. The randomness of this generation is fundamental, and the microprocessor card has for this purpose a random number generator capable of providing an integer of the desired bit size.

FIG. 1 therefore shows the block diagram of a microprocessor card capable of implementing the method according to the invention. The card 7 comprises a main processing unit 1, program memories 3 and 6 and a working memory 4, associated with the main unit 1. The card also comprises an arithmetic coprocessor 2 capable of carrying out modular exponentiations. , that is, calculations of the type x ^A y mod z where x, y and z are large integers. It may be for example circuits such as the ST16CF54 circuit marketed by the company STMicroelectronics or 83C852 / 5 from Philips. The card also has a random integer generator 5.

Before describing the example of implementation of the method according to the invention, it is recalled that the function Λ is Carmichael's function and that function is defined by the following relation

Λ (x) = PPCM (Λ ( _Pl ^δ i), ..., Λ (p _s ^δ s)) in which PPCM denotes the smallest common multiple and x = pi ^δl * ... * p _s ^δs where each pi is a prime number and each δi is a nonzero positive integer for l≤i≤s. We also recall that Λ (p ^δ ) = p ^{δ ~ 1} (p-1) for any odd prime number p and for any non-zero positive integer δ. Finally, Λ (2) = l, Λ (4) = 2 and Λ (2 ^δ ) = 2 ^{δ "2} for any positive integer δ> 2.

The method according to the invention generates a random number not divisible by a predetermined set of prime numbers (pi, p ₂ ,..., Pk). In the preferred mode of implementation of the invention, during a initialization step, a sequence of parameters πi, ..., π _L such that πi * ... * π _L is a multiple of pi * p2 * ... * Pk is previously constituted and the integers λi = Λ ( πi) calculated accordingly. It is therefore understood that the integers TIi, ..., π _L , λi, ..., λ _{L as} well as the number L and the binary size t of pi * p ₂ * ... * Pk, are determined by in advance and stored in one of the memories of the microprocessor card.

According to the invention, the integer q is then randomly generated by the microprocessor card by a series of operations shown in the diagram of FIG. 2.

In step 10, an integer q is drawn at random using the random number generator 5. In step 20, the variable π is initialized to the value 1. Step 30 repeats the steps L times. 40 to 100.

In step 40, the number qi = q mod K _± is calculated and qi ⁰ is initialized to qi. At step 50 is calculated Ui = qi ¹ mod πi. In step 60, U i is compared to the integer 1. If U i = I, go directly to step 90.

In the opposite case, the following steps are carried out: in step 70, a random number z is drawn; in step 80, the value of q _± is modified by performing the calculation q _± = q _± + (1-Uj.) z mod π _± ; the execution is then redirected to step 50.

In step 90, the integer q is modified by calculating q = q + π * (qi-qi ⁰ mod 7Ii) • At step 100, the integer π is modified by performing π = π *

In step 110, the integer q is reduced modulo π according to q = q mod π and is then returned to step 120.

A particular advantage of the method according to the invention is that it is easily implemented with the aid of an arithmetic co-processor allowing the addition, subtraction and modular multiplication of large numbers.

According to a possible variant of the invention shown in FIG. 3, the modular calculation steps can be replaced by Montgomery arithmetic operations (modular multiplication or reduction). The Montgomery multiplication of two integers a and b modulo c returns a * b * R mod c rather than a * b mod c, where R is a known power of 2 modulo c. Similarly, a Montgomery reduction of an integer modulo an integer c returns to * R 'mod c instead of a mod c, where R' is a known power of 2 modulo c. The advantage of such operations lies in their speed of execution in general greater than that of equivalent ordinary operations. Montgomery operations can be used to carry out the generation process according to the invention without the need for modification. A prerequisite is required so that all TIi, ..., π _L parameters are chosen oddly. In this case, the calculation steps that comprise Montgomery operations return different values, thus: a) step 40 performs qi = q * Ri ¹ mod π _± where Ri ¹ is a power of 2 modulo π _± ; b) the step 50 performs u _± = qi ^λi (Ri ² ) ^λi = qi ^λi mod π _± without any modification for the mathematical reason that (Ri ² ) ¹ = 1 mod 7Ii because Ri ² (a power of 2 ) and TIi are prime between them; c) step 80 performs qi = qi + (l-Ui) * z * Ri ³ mod TIi where Ri ³ is again a known power of 2 modulo

JCi.

The presence of the Montgomery factors R ₁ ¹ , R ₁ ² and Ri ³ is mathematically irrelevant to the outcome of the computation, which always results in a value of q relatively prime to the first (pi, p2, ..., Pk) •

It will be apparent to those skilled in the art that the present invention may be embodied in other forms while adhering to its spirit and essential characteristics. The implementation examples described above are therefore considered to be illustrative and not limiting. The scope of the invention is described more specifically within the scope of the claims given below.

Claims

claims

A cryptographic method in which a random and non-divisible final number (q _L ) is generated by a predetermined set of prime numbers (pi, P2, • • -, Pk) from an initial random number (qo) i characterized in that the following steps are repeated, iteratively for i ranging from 1 to L, where L is an integer:

Eli: generating a parameter of rank i (7Ii) divisible by certain prime numbers of said predetermined set and first with parameters of ranks lower than i (TIi, ..., Tli-i),

E2i: modulo reduce the parameter of rank i (7Ii) a random number of rank i-1 (qi-i) obtained during a previous iteration E3i: execute the Pallier / Joye process to modify the random number of rank i-1 reduce (qi-i mod 7Ii) and produce a relatively modified number (qim) relatively prime with said parameter of rank i (π _± ),

E4i: subtracting the modified number (qim) the random number of rank i-1 reduced (qj _m - qi-i mod 7II.)

E5i: multiply the result of the subtraction by the product (πi * ... * 7ti-i) of the parameters of rank 1 to i-1 E6i: add the result of the multiplication to the random number of rank i-1 (qi -i) to obtain a random number of rank i (qi), the final random number being the random number of rank L.

2. Method according to claim 1 wherein, during step E3i, the following sub-steps are carried out, consisting of:

Ep ₁ : calculate λi = Λ (7li), Λ being a function of Carmichael, Eqi: initialize q _im to the value of the random number of reduced rank i-1 (qi-i mod 7Ii) obtained during step E2i

Er: calculate Ui = qi _m ¹ UiOd 7Ii Es: if Ui is equal to 1, then step E3i ends,

And: if Ui is different from 1, draw a random number z, calculate q 'i = q _im + z (1- Ui) mod 7Ii, and assign to qi _m the value q' i Eu: repeat the steps Er to Et , as long as Ui is different from 1.

3. Method according to one of claims 1 to 2, characterized in that it also comprises an initialization step EO consisting of:

- choose a random L number,

performing in advance all the steps El ₁ , for all inclusive 1 to L, to determine the parameters (7Ii, ..., 7I _L ) of rank 1 to L such that their product (7Ii * ... * 7I _L ) is a multiple of the product of all prime numbers of the predetermined set (pi * p2 ... * Pk) and

performing in advance the set of steps Ep ₁ for i varying from 1 to L, to calculate associated Carmichael parameters (λi = Λ (7Ii), ..., λ _L = Λ (π _L )) at all parameters of rank i between 1 and L,

- Store the number L, the parameters of rank i (7Ei,. ", 7E _L ) between 1 and L and associated Carmichael parameters λi, ..., λ _L ).

4. Method according to one of claims 1 to 3, characterized in that the initial random number (qo) is of binary size close to the size of the product of the parameters of rank 1 to L (7Ei * ... * π _L ) •

5. Method according to one of claims 2 to 4, characterized in that the random number z drawn in step Et is of binary size close to the size of the product of the parameters of rank 1 to L (πi * ... * π _L ).

6. Method according to one of the preceding claims, characterized in that the modular multiplication or reduction operations are replaced by the so-called Montgomery equivalent operations.

7. A method according to any one of the preceding claims, wherein the final random number is large.

8. A method of generating cryptographic keys implementing a method according to one of the preceding claims.

Portable electronic device comprising a main processing unit (1), at least one program memory (3, 6) and a working memory

(4) associated with the main unit (1), wherein the program memory stores an appropriate program for carrying out a method according to one of claims 1 to 8.

10. Portable electronic device according to claim 9, characterized in that it is constituted by a microprocessor chip card.

Portable electronic device according to claim 9 or 10, characterized in that it comprises an arithmetic co-processor performing some or all of the related calculation operations.