EP4042633A1

EP4042633A1 - Method for deriving a partial signature with partial verification

Info

Publication number: EP4042633A1
Application number: EP20796871.0A
Authority: EP
Inventors: Olivier Sanders
Original assignee: Orange SA
Current assignee: Orange SA
Priority date: 2019-10-11
Filing date: 2020-10-06
Publication date: 2022-08-17
Also published as: US20230040203A1; FR3102023A1; WO2021069827A1; CN114762289A; FR3102023B1

Abstract

The invention relates to a method for deriving a partial signature for a subset (I) of a set of messages ({m_1, …, m_n}), called subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said method, implemented by a partial signature derivation entity, comprising: - a step (E12) of receiving the set of messages ({m_1, …, m_n}) and a signature of said set of messages, said signature comprising signature elements ((q, s)) of the set of messages, - a step (E13) of deriving a first verification element (A) calculated from the messages of the set other than those of the subset of messages, and - a step (E14) of deriving a second verification element (B) intended to prove that the first verification element is formed correctly, and of sending a partial signature specific to the subset of messages to a verification entity (12), said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element (A) and the second verification element (B), said partial signature being intended to be verified with only the messages of the subset of messages.

Description

PARTIAL SIGNATURE BYPASS PROCESS WITH PARTIAL VERIFICATION

The invention relates to the general field of telecommunications and relates more precisely to the securing of exchanges between communication devices using cryptographic techniques such as electronic signature techniques.

The electronic signature is a cryptographic tool which makes it possible to authenticate any digital data, thus acting as the equivalent of the traditional handwritten signature. This technique is now ubiquitous in our daily life, whether it is when browsing the Internet, since access to any URL in https implies the use of electronic signatures, or when paying at using a bank card. It also constitutes the very basis of anonymous authentication mechanisms, popularized by DAAs (standing for “Direct Anonymous Attestation”), and by EPID (standing for “Enhanced Privacy IDentity”). In most cases, it is not a single piece of data that is certified, but a set of n data, with n> 0, for example the name, date of birth, address, etc., of a person. The existing electronic signature solutions can then be grouped into two families: those which produce a signature of constant size, and others whose size depends on the value of n. The former are obviously preferable with regard to the size of the signature, but this constant cost hides a major flaw: the signature is valid on all the signed data and can therefore only be verified by transmitting all the data that have been signed. It is of course possible to use techniques known as zero-knowledge proofs to conceal these elements, but this only solves the problem of anonymity: this evidence, very expensive, have a minimum complexity in size linear in the number of hidden elements.

Two recent diagrams show an ability to have a constant size, both for the signature and for the proof of verification. We thus know a first construction proposed by Camenisch et al. at

Asiacrypt 2015 in the article "Composable and Modular Anonymous Credentials: Definitions and Practical Constructions" which satisfies this property. However, from According to the authors themselves, the most efficient instantiations of this construction involve proofs of more than a hundred elements, which excludes its use in practice. Indeed here, the proof of verification is of constant size but this constant is extremely high.

More recently, Fuchsbauer et al. published in the Journal of Cryptology 2019 "Structure-Preserving Signatures on Equivalence Classes and Constant-Size Anonymous Credentials" which presents a construct with the same property. Proving the validity of a signature can be done more efficiently than with the previous scheme, but the major problem here is the impossibility of proving any relation on the certified data without revealing it. For example, it is not possible to prove that you are of legal age without revealing your date of birth, which is contrary to the spirit of anonymous attestations.

One of the aims of the invention is to remedy shortcomings / drawbacks of the state of the art, and / or to make improvements thereto.

To this end, the invention proposes a method of deriving a partial signature for a subset (I) of a set of messages ({m_l, ..., m_n}), called a subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said method, implemented by a partial signature derivation entity, comprising:

- reception of the set of messages ({m_l, ..., m_n}) and of a signature of said set of messages, said signature comprising signature elements ((q, s)) of the set of messages,

- derivation of a first verification element (A) calculated from the messages of the set other than those of the subset of messages, and

- derivation of a second verification element (B) intended to prove that the first verification element is well formed, and for sending to a verification entity (12) a partial signature specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element (A) and the second verification element (B), said partial signature being intended to be checked with only messages from the message subset.

The method describes a signature system of constant size that combines the best of both worlds. Indeed, the proof of the signature can be done in a very efficient way because the proof includes a constant number of elements, the constant being of reasonable size; in fact, it requires four elements of the partial signature. This system also makes it possible to check the validity of a signature on a subset of messages without needing to know, and therefore to transmit, the other parts of the message. This scheme can be advantageously used in all use cases requiring authentication, whether anonymous or not.

Advantageously, the generation of the partial signature comprises an anonymization of the partial signature, said anonymization comprising:

- anonymization of the elements of the signature ((q, s)) by means of random scalars, and

- anonymization of the first and second verification element by means of one of the random scalars.

Thanks to this anonymization, implemented by judicious addition of random elements, a signature becomes perfectly untraceable. Thus, a signature derivation entity will present, during two different authentications of the same subset of messages, a different partial signature. In fact, with this process, all of the undisclosed messages are perfectly masked by randomness. It is recognized that the property of non-traceability of a signature is an important security property.

In an exemplary embodiment, the method comprises beforehand a generation of a secret key and of an associated public key in a bilinear environment, said environment designating a first group G1, a second group G2 and a third group GT of order first p, as well as a bilinear map e, taking as input an element of the first group Gl, an element of the second group G2 and with values in the third group GT, that is to say g, respectively h, an element of the first group Gl, respectively of the second group G2, said generation comprising:

- generation by the signing entity of (n + 1) random scalars (x, y_l, ..., y_n), said random scalars forming the secret key of the signing entity, and

- calculation by the signatory entity of X = g ^Λ {x}, Y_i = g ^Λ {y_i} for 1 ≤ i = j ≤ n, Z_ {i, j} = g ^Λ {y_i. y_j} for 1 ≤ i ≠ j ≤ n, and H_i = h ^Λ {y_i} for 1 ≤ i ≤ n, the elements X, Y_i, Z_ {i, j} and H_i forming the public key.

In this exemplary embodiment, it is described how the secret and public keys of a signing entity are calculated.

In an exemplary embodiment, the signature of the set {1, ..., n} of messages, denoted m_l, ..., m_n, comprises the selection by the signing entity of a random element q from the second group G2, and the computation of s = q ^Λ {x + y_l. m_l + ... + y_n. m_n}, said signature then being (q, s).

In this exemplary embodiment, it is described how the signature of the set of messages is calculated. This comprises two elements q and s.

In an exemplary embodiment, the derivation of the partial signature for the subset I of the set {1, ..., n} of messages comprises:

- generation of the first verification element A = Π _ {j in {1, ..., n} \ I} Y_ j ^Λ {m_j}, and

- generation of the second verification element B = Π_ {i in I, j in {1, ..., n} \ I}. Z_ {i, j} ^Λ {m_j}, the partial signature then being (q, s, A, B).

In this exemplary embodiment, it is precisely described how the partial signature of the subset of messages is calculated, or derived. The calculation of the partial signature includes the calculation of two elements A and B. The messages used to calculate the first element A are the messages which are not part of the message subset. The second element B uses messages of which one of the indices, i, traverses the set I relating to the subset of messages, while the other index j, relates to the messages which are not part of the subset of messages . The signature is formed from the elements of the signature of all the messages, the first element A and the second element B.

In another exemplary embodiment, the signing of the set of messages comprises:

- selection by the signatory entity of two scalars r and t,

- calculation of q '= q ^Λ r,

- calculation of de s' = s ^Λ r. q ^Λ {r. t},

- generation of the first verification element A = g ^Λ t. Π _ {j in {1, ..., n} \ I} Y_j ^Λ {m_j}, and - generation of the second verification element B = (Π_ {ΐ in 1} Y_i) ^Λ t. Π_ {i in I, j in {1, n} \ 1} Z_ {i, j} ^Λ {m_j}, the partial signature then being (q ', s', A, B).

In this other example it is described how to calculate, or derive, an anonymous partial signature. Random scalars are used, thus making the partial signature completely untraceable.

The invention also relates to a method of verifying a partial signature for a subset I of a set of messages {m_l, ..., m_n}, called a subset of messages, said partial signature being intended for proving the validity of a signature of the set of messages for the messages of the subset of messages, said method, implemented by a partial signature verification entity, comprising:

- reception of the subset of messages and of a partial signature specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, a first element verification calculated from the messages of the set other than those of the subset of messages and a second verification element intended to prove that the first element is well formed,

- verification of a first equation involving the messages of the subset of messages, the elements of the signature of the set of messages as well as the first element of verification and elements of the public key, and

- verification of a second equation involving the first signature verification element, the second signature verification element and elements of the public key.

The partial signature verification method is suitable for verifying that a partial signature on a subset of messages is valid or not. Partial signature verification is the same whether it is a partial signature or an anonymous partial signature. Thus, whether it is a partial signature or an anonymous partial signature, the same verification process is used. The implementation of the signature scheme is thus simplified and optimized, thus offering better performance.

In an exemplary embodiment of the method for verifying a partial signature in which a secret key and a public key have been generated for a signing entity. associated in a bilinear environment, said environment designating a first group G1, a second group G2 and a third group GT of first order p, as well as a bilinear map e, taking as input an element of the first group G1, an element of the second group G2 and with values in the third group GT, that is to say g, respectively h, an element of the first group G1, respectively of the second group G2, said generation comprising:

- generation by the signing entity of (n + 1) random scalars (x, y_l, ..., y_n), and

- calculation by the signatory entity of X = g ^Λ {x}, Y_i = g ^Λ {y_i} for 1 ≤ i = j ≤ n, Z_ {i, j} = g ^Λ {y_i. y_j} for 1 ≤ i ≠ j ≤ n, and H_i = h ^Λ {y_i} for 1 ≤ i ≤ n, the elements X, Y_i, Z_ {i, j} and H_i forming the public key, verification of the signature partial including:

- verification of a first equation: e (XAΠ_ {i in I} Y_i ^Λ {m_i}, q)) = e (g, s), and

- verification of a second equation: e (A, Π_ {i in I} H_i) = e (B, h).

The various steps of the partial signature verification process are specified here.

The invention also relates to an entity for deriving a partial signature, intended to derive a partial signature for a subset I of a set {1, ..., n} of messages {m_l, ..., m_n}, said subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said partial signature derivation entity, comprising:

- reception means, arranged to receive the set of messages {m_l, ..., m_n} and a signature (q, s) of said set of messages, said signature of all of the messages comprising signature elements of the set of messages,

means for deriving a first element, arranged to derive a first verification element A calculated from the messages of the set other than those of the subset of messages, and

- Means for deriving a second element and sending, arranged to derive a second verification element B intended to prove that the first verification element is well formed, and to send a signature verification entity partial a partial signature specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element and the second verification element, the partial signature being intended to be verified with only the messages of the message subset.

The invention also relates to a partial signature verification entity, intended to verify a partial signature for a subset I of a set of messages {m_l, ..., m_n}, called a subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said partial signature verification entity, comprising:

- reception means, arranged to receive the subset of messages and a partial signature (q, s, A, B) specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, a first verification element A calculated from the messages of the set other than those of the message subset and a second verification element B intended to prove that the first element of verification is well trained,

- first verification means, arranged to verify a first equation involving the messages of the subset of messages, the elements of the signature of the set of messages as well as the first verification element, and elements of the public key, and

second verification means, arranged to verify a second equation involving the first verification element, the second verification element and elements of the public key.

Also disclosed is a partial signature derivation and verification system comprising:

- a partial signature generation entity as described above,

- an entity for verifying a partial signature as described above.

The invention also relates to a use of a partial signature derivation and verification system as described above in an anonymous accreditation system. The partial signature derivation method and the partial signature verification method are particularly well suited to anonymous accreditations. Indeed, the need not to reveal certain parts of this data is evident in the field of anonymous accreditations and solved by the proposed scheme. The exemplary embodiment relating to anonymous partial signatures can be directly used as an anonymous accreditation system because it also satisfies the strongest intraceability properties, while offering better performance than other state-of-the-art solutions. 'art.

The invention also relates to a computer program on a data medium and loadable into the memory of a computer, comprising program code instructions intended to control the execution of the steps of the signature derivation method as described above. , when the program is executed on said computer.

The invention also relates to a data medium in which the program described above is recorded.

The invention also relates to a computer program on a data medium and loadable into the memory of a computer, comprising program code instructions intended to control the execution of the steps of the partial signature verification method such as described above, when the program is executed on said computer.

Other characteristics and advantages of the present invention will be better understood from the detailed description and the appended figures, among which: FIG. 1 shows the steps of a signature method, according to an exemplary embodiment; FIG. 2 is a schematic representation of an entity for deriving a partial signature capable of implementing the steps of the method for deriving a partial signature for a subset of messages, according to an exemplary embodiment; Figure 3 is a schematic representation of a verification entity of a partial signature capable of implementing the steps of the method of verifying a partial signature for a subset of messages, according to an exemplary embodiment.

The steps of a signature method with partial verification, according to a first exemplary embodiment, will now be described in relation to FIG. 1.

Note that we use here a usual notation in cryptography in which:

- “x_i” represents “x index i”, ie “xi”;

- "g ^Λ x" represents "g power x", or "g ^x ",

- the product is represented by a point: “. », Or by the classic sign P (capital pi) when many indexed factors are involved,

- addition is conventionally shown schematically by the sign "+", or by the sign Σ (capital sigma) when many indexed factors are involved.

The signature scheme described here operates in a bilinear environment which designates three groups, usually denoted G1, G2 and GT, of prime order p, as well as a bilinear application e called “bilinear coupling” taking as input an element of the group G1 and an element of group G2 and valued in group GT. This type of environment has become classic in cryptography and can be implemented very efficiently. It should be noted that the roles of G1 and G2 are perfectly interchangeable.

The signature scheme is based on a system that includes several entities:

a signatory entity 10. The signatory entity 10 is a computer device which comprises code instructions for implementing those of the steps of the signature derivation method implemented by the signatory entity,

a partial signature derivation entity 11. The signature derivation entity 11 is a computer device which comprises code instructions for implementing those of the steps of the signature derivation method implemented by the partial signature derivation entity 11,

a partial signature verification entity 12. The partial signature verification entity 12 is a computer device which comprises code instructions for implementing those of the steps of the signature derivation method implemented by the partial signature verification entity 12. Note that the same entity can combine several roles. For example, a signing entity can also act as a partial signature derivation entity. Likewise, a signatory entity may also be required to play the role of a partial signature verification entity.

As a reminder, a bilinear coupling e is a function satisfying among others the following properties: e (g ^Λ a, h ^Λ b) = e (g, h) ^Λ (ab) e (g ^Λ a, q) = e (g , q) ^Λ a

In the following, n denotes the maximum number of data that can be signed at a time. In the usual terminology, we speak of messages rather than data. Thus, we have a set (1, ..., n} of messages to sign, noted (m_l, ..., m_n}. For example, for an individual such messages can be a name, an address, a date of birth, etc.

The signature scheme described here makes it possible to very effectively verify the validity of a signature on any subset of messages.

In a prior key generation step E10, the signing entity 10 generates, for the signature scheme, a pair of secret / public keys Ks / Kp. Note that in another exemplary embodiment, the generation of keys can be implemented by a dedicated entity, distinct from the signing entity 10, the keys, and in particular the secret key then being transmitted to the signing entity 10 of securely, according to known methods not presented here.

Let g, respectively h, be a random element of group Gl, respectively of group G2, the signatory entity commands the generation of (n + 1) random integers less than p, (x, y_l, ..., y_n), and construct the following elements: x = g ^Λ {x},

Y_i = g ^Λ {y_i} for 1 ≤ = i ≤ = n,

Z_ {i, j} = g ^Λ {y_i · y_j} for 1 ≤ = i ≠ j ≤ = n,

H_i = h ^Λ {y_i} for 1 ≤ = I ≤ = n

The secret key Ks of the signatory in the signature system consists of the random integers (x, y_l, ..., y_n).

The public key Kp is made up of the elements X, Y_i, Z_ {i, j}, and H_i.

So : Ks = (x, y_l, · ··, y_n), and

Kp = (X, Y_i, Z_ {i, j}, H_i)

Conventionally, the public key Kp is then published, here by the signing entity 10.

In a second signing step Eli, the signing entity 10 signs n messages m_l, ..., m_n by means of its secret key Ks. To this end, the signing entity 10 selects a random element q from the group G2, and calculate: s = q ^Λ (x + y_l. m_l + ... + y_n. m_n}

The signature of the set of n messages is then (q, s).

Note that the signing entity 10 can also sign messages of size n ', with n' ≤ n with this same pair of keys, that is to say, without regenerating a pair of keys. In this case, the message of size n 'to be signed is completed with ‘0' until a message of size n is obtained, and the signing entity 10 then uses its pair of keys Ks / Kp to sign it. At the end of the signature step Eli, the signing entity 10 sends the signature (q, s) of the set of n messages to the partial signature derivation entity 11 as well as the set (m_l,. .., m_n}.

In a partial signature derivation step E12, implemented to prove the validity of the signature (q, s) on a subset of messages mi for i belonging to a subset I of the set (1,. .., n} of messages, the partial signature derivation entity 11 receives, in a reception sub-step E12, the signature (q, s) on the set of messages (m_l, ..., m_n}.

The partial signature derivation entity 11 calculates, or derives, in a step El 3 for deriving a first element, a first verification element A which aggregates all the messages mj whose index j is in (1,. .., n} but not in the subset I. The appropriate notation is (1, ..., n} \ I. The first check element A thus relates in a way to messages which do not interest l signatory entity 10, more precisely on messages which are not part of those for which it wants to prove the validity of the signature (q, s). Thus, the partial signature derivation entity 11 calculates:

A = Π_ {j in (1, ..., n} \ I} Y _j ^Λ {m _j}

At this stage, the partial signature is then (q, s, A). This signature is specific to m_i messages, with i in the set I, i.e. it is intended to be used to verify the validity of the signature of this sub-set mi of messages on the basis of the signature of the n messages (q, s) and with only the messages of the sub-set of messages.

In this exemplary embodiment, in a step E14 of deriving a second element and sending, the partial signature derivation entity 11 calculates, or derives, a second verification element B. This second verification element B is intended to prove that the first verification element A is valid, i.e. it is well formed. Intuitively, the second verification element B makes it possible to show that the first verification element A, calculated from the hidden messages, is well formed, i.e. it cannot be used to cheat on the value messages mi, for i in I, which are presented to the partial signature verification entity 12. Thus, the partial signature derivation entity 11 calculates:

B = Π_ {i in I, j in {1, ..., n} \ I} Z_ {i, j} ^Λ {m_j}

The partial signature is then (q, s, A, B). The partial signature (q, s, A, B) and the subset of messages m i, with i in I, are then sent at the end of step E14 to the partial signature verification entity 12.

Thus, whatever the number of messages of the subset of messages, whatever the number of messages of the set of messages, the partial signature is of constant size and comprises few elements, in this case four elements. . Note also that only the messages of the message subset {m_i}, with i in I, are transmitted. The verification entity 12 therefore does not need to know the set of messages {m_l, ..., m_n} or of the messages which would be linked by construction to messages of the subset of messages, such as for l age, date of birth.

In a subsequent receiving step El 5, the partial signature verification entity 12 receives from the signature derivation entity 11 the subset of messages {m_i}, with i in I, and the partial signature (q, s, A, B).

The partial signature verification entity 12 verifies in a first verification sub-step E1 6 a first equation: e (X. A. Π_ {i in 1} Y_i ^Λ {m_i}, q) = e (g, s ), (1)

The partial signature verification entity 12 verifies in a second step El 7 for verifying a second equation: e (A, Π_ {i in 1} H_i) = e (B, h), (2) If these two equalities, or equations, are satisfied, the partial signature, relating to the subset of messages mi, with i in I is valid. Otherwise it is considered invalid.

Indeed, when we develop the first equation (1), by using the definition of the first verification element A defined during the step E13 of derivation of a first element, we obtain:

= e (X. Π_ {i in 1} Y_i ^Λ {m_i}. Π_ {j in {1, ..., n} \ 1} Y_j ^Λ {m_j}, q)

Using the definitions of X and Y, we get:

= e (g ^Λ x. Π_ {i in 1} (g ^Λ {y_i}) ^Λ {Π_i}. Π_ {j in {1, ..., n} \ 1}

(g ^Λ (y_j}) ^Λ {m_j ^' }, q)

Using the rule (g ^Λ a) ^Λ b = g ^Λ {ab} and the fact that we combine the product of Y_j ^Λ {m_j} whose index j belongs to the set {1, ..., n} deprived of the set I and of the Y_i ^Λ {m_i} whose index i is in I, we obtain:

= e (g ^Λ {x + Σ_ {i in {1, ..., n}} y_i.m_i}, q)

By using the property of the coupling: e (g ^Λ a, q) = e (g, q) ^Λ a, we obtain:

= e (g, q) ^Λ {x + Σ_ {i in [1, n]} y_i.m_i}

By using the coupling property which makes it possible to reintroduce an exponent on the term of one's choice, we obtain:

= e (g, q ^Λ {x + Σ_ {i in {1, ..., n}} y_i.m_i})

Using the definition of s specified in the key generation phase P10, the term becomes:

= e (g, s)

Thus, e (X. Π_ {i in I} Y_j ^Λ {m_i {A, q) = e (g, s).

This first verification equation could be sufficient to verify the validity of the partial signature which relates to the messages m i whose indices i are in I. However, nothing says that the first verification element A is generated correctly. This is why the partial signature verification entity 12 verifies the second equation in the second verification step E16. When we develop the second equation (2), using the definition of the first verification element A, we obtain:

= e (Π_ {j in {1, ..., n} \ I} Y_j ^Λ {m_j}, Π_ {i in 1} H_i)

Using the definition of Y and H, we get:

⁼ e (Π_ {j in {1, ..., n} \ I} g ^Λ {y_j} ^Λ {m _j}, Π_ {i in I} h ^Λ {y_i}) Using the rule (g ^Λ a) ^Λ b = g ^Λ {ab} we get:

= e (g ^Λ {Σ_ {j in {1, n} \ 1} y _j.m _j}, h ^Λ Σ_ {i in I} y_i)

Using the coupling property e (g ^Λ a, h ^Λ b) = e (g, h) ^Λ (ab), we get:

= e (g, h) ^Λ ((Σ_ {j in {1, .. n} \ 1} y_j.mj). (Σ_ {i in I} y_i))

= e (g, h) ^Λ (Σ_ {i in I, j in {1, .. n} \ 1} y _j.m _j .y _j)

This term is equal to e (B, h). Indeed, by using the definition of the second verification element B and of Z, we obtain: e (B, h) = e (Π_ {ΐ in I, j in {1, ..., n} \ I} ( g ^Λ {y_j.y _j}) ^Λ m _j, h)

Using the rules (g ^Λ a) ^Λ b = g ^Λ (ab) and g ^Λ ag ^Λ b = g ^Λ {a + b}, we get: e (B, h) = e (g ^Λ {Σ_ {i in I, j in {1, ..., n} \ l} (yj.y _j.m _j)}, h)

Using the coupling property e (g ^Λ a, h) = e (g, h) ^Λ a, we get: e (B, h) = e (g, h) ^Λ {Σ_ {i in I, j in {1, ..., n} \ l} (yj.y _j.m _j)}

So, we get: e (A, Π_ {i in 1} H i) = e (B, h).

This second equation is intended to ensure that the first verification element A, which groups together all the hidden messages, that is to say the messages which are not part of the subset of messages to be signed, is well formed. By “well-formed” is meant here that the first verification element A cannot be used to cheat on the value of the messages m _ i, for i in I, which are presented for verification.

Indeed, by continuing to develop the second equation, the exponent of e (g, h) is: Σ_ {j in {1, ..., n} \ 1} y _j.m _j). (Σ_ {i in I} y_j) = Σ_ {i in I, j in {1, ..., n} \ I [y_j.m_j.y_i

We thus obtain a sum of monomials of the form y_j.mj.y i. We denote this sum of monomials by the polynomial P. We notice that the indices i and j which occur in the same monomial are different. Indeed the first sum involves the messages, indexed by j, which are not in I, while the second sum involves the messages, indexed by i, which are in I. Thus, we have the guarantee, with this equation , never to meet monomials y_j.mj.yi with i = j, which would give a square m_j.y ^Λ 2_j.

If the partial signature derivation entity 11 cheated, that is, if in the first verification element A, more precisely in the product, it added a element Y_i ^Λ r = g ^Λ (r.y_i) whose index i would be in I, then the exponent would be of the form:

(r.y_i + Σ_ {j in {1, .. n} \ 1} y _j.m _j). (Σ_ {i in I} y_i)

It would then appear in the polynomial P of the square monomials of the form r.y_i ^Λ 2, which did not appear before.

It then becomes possible to distinguish the case of a first verification element A properly formed from a first error element A. Indeed, the second verification element B is none other than g ^Λ P. By verifying the second equation (2), the partial signature derivation entity 12 is forced to reconstitute the polynomial P. The public key comprises the elements Z_ {i, j} = g ^Λ (y_i. Y_j), with i ≠ j. These elements thus make it possible to reconstruct all the monomials of the form y_j.m_j.y_i. In the case where the partial signature derivation entity 11 has cheated, the polynomial P contains square monomials of the form ry ^Λ 2_i which cannot be reconstructed from the elements Z_ {i, j} of the key public, which only exist with the condition i ≠ j. Thus, if the partial signature derivation entity 11 is honest, all the monomials necessary for the reconstruction of the polynomial P are provided in the public key. Conversely, if the partial signature derivation entity 11 has cheated, the partial signature verification entity 12 is unable to reconstruct the polynomial P.

At the end of the second step E17 for verifying the partial signature, the verification entity 12 transmits the result to any entity requesting this verification

In a second exemplary embodiment of the signature method with partial verification, the first and second steps E1 3 and 14 of signature derivation are slightly modified so as to anonymize the signature scheme described in relation to FIG. 1. Indeed, with the diagram described above, each time a partial signature derivation entity uses its signature to authenticate itself, it presents the same signature, which makes it possible to trace it.

Thus, in an additional step El 8 of generation of scalars and of calculation of new elements of the signature, represented in dotted lines in FIG. 1 and implemented with the aim of proving the validity of the signature of the m messages (q, s ) on a subset of messages mi, with i in I, the partial signature derivation entity 11 generates two scalars r and t. The partial signature derivation entity 11 then calculates: q '= q ^Λ r, s' = s ^Λ r. q ^Λ {r. t}, (q ', s') forming the new elements of the signature. Thus the elements of the signature (q, s) are anonymized by means of random scalars.

In this second exemplary embodiment, in the step E13 of deriving the first verification element, the partial signature derivation entity 11 calculates the first verification element A as follows:

A = (g ^Λ t). (Π_ {j in {1, ..., n} \ 1} Y_j ^Λ {m_j})

In the step E14 for deriving the second element, the entity 11 for deriving the partial signature calculates the second verification element B as follows:

B = (Π_ {i in 1} Y_i) ^Λ t. (Π_ {ΐ in I, j in {1, ... n} \ 1} Z_ {i, j} ^Λ {m_j})

The two elements A and B thus calculated depend on one of the random scalars. They are thus also anonymized.

The new partial signature is then noted (q ', s', A, B).

At the end of step E14 for deriving the second element, the entity 11 for deriving the partial signature sends to the verification entity 12 the new partial signature (q ', s', A, B) as well as the messages m_i , with i in I.

Thus, each time the partial signature derivation entity 11 derives a partial signature on the same subset of messages for the purpose of authenticating itself, then the derived partial signature is different. The partial signature is thus anonymous and it is then impossible to trace the partial signature derivation entity 11 during its various authentications.

Note that the new partial signature or anonymous partial signature (q ', s', A, B) is verified by the signature verification entity 12 in the same way as in the first exemplary embodiment, that is to say - say that it is treated in the same way as a non-anonymous partial signature. More precisely, this verification takes as input the subset of messages {m_i}, with i in I, the anonymous partial signature (q ', s', A, B) and verifies the same two equalities (1) and (2 ) described previously.

Thus, the implementation of the partial signature derivation is facilitated since depending on whether the partial signature is anonymous or not, the implementation of the verification of the partial signature is identical.

This embodiment is particularly suitable for use in anonymous certificates or accreditations. An anonymous certificate makes it possible to prove a property or a right linked to its holder, without revealing the identity of the latter. It protects the privacy of the anonymous accreditation holder by providing the property of anonymity and here non-traceability. It takes the form here of a cryptographic datum: the partial signature, which can be shown by its holder, here the partial signature derivation entity 11, to an organization, here the partial signature verification entity 12, for prove a property linked to his identity.

An entity for deriving a partial signature, according to an exemplary embodiment, will now be described in relation to FIG. 2.

The partial signature derivation entity 11 is computer equipment, such as a computer.

The partial signature derivation entity 11 comprises:

a processing unit or processor 30, or “CPU” (standing for “Central Processing Unit”), intended to load instructions into memory, to execute them, to carry out operations;

a set of memories, including a volatile memory 31, or “RAM” (for “Random Access Memory”) used to execute code instructions, store variables, etc., and a storage memory 32 of the “EEPROM” type (standing for “Electrically Erasable Programmable Read Only Memory”). In particular, the storage memory 32 is designed to store a partial signature derivation software module which comprises code instructions for implementing the steps of the partial signature derivation method as described above and which are implemented by the partial signature derivation entity 11. The storage memory 32 is also designed to store the public key Kp of the signature scheme in a secure area.

The partial signature derivation entity 11 also includes:

a reception module 33, designed to receive the set (m_l, ..., m_n} of messages and a signature of said set of messages. The signature of all the messages comprises signature elements, denoted (q, s) of the set of messages The reception module 33 is designed to implement step E12 of the partial signature derivation method, a module 34 for deriving a first verification element, arranged to derive a first verification element A calculated from the messages of the set other than those of the subset of messages,

a module 35 for deriving a second verification and sending element, arranged to derive a second verification element B intended to prove that the first verification element A is well formed and to send to a verification entity of a partial signature a partial signature specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element A, and the second element verification B. The partial signature is intended to be verified with only the messages of the message subset. The derivation and sending module 34 is designed to implement steps E13 and E14 of the partial signature derivation method as described above.

The reception module 33, the module 34 for deriving a first verification element and the module 35 for deriving a second verification and sending element are preferably software modules comprising software instructions for implementing those. steps of the partial signature derivation method implemented by the partial signature derivation entity.

In a second exemplary embodiment, the partial signature derivation entity 11 comprises a module (not shown in FIG. 2) for deriving an anonymous partial signature. This module is designed to generate random scalars and to calculate new elements of the signature. Thus this module generates two scalars r and t, then calculates: q '= q ^Λ r, s' = s ^Λ r. q ^Λ {r. t}, (q ', s') forming the new elements of the signature.

In this exemplary embodiment, the module 34 for deriving the first verification element is arranged to calculate the first element A as follows:

A = g ^Λ t. Π_ {j in (1, ..., n} \ 1} Y _j ^Λ {m _j}.

The derivation module 35 of the second verification and sending element is arranged to calculate the second verification element B as follows:

B = (Π_ {ΐ in 1} Y_i) ^Λ t. Π_ {i in I, j in (1, ... n} \ 1} Z_ {i, j} ^Λ {m_j}. The first and second verification elements A and B are thus anonymized by means of one of the random scalars.

The new partial signature is noted (q ', s', A, B). In this exemplary embodiment, the module 35 for deriving the second verification and sending element is also arranged to send the new partial signature (q ', s', A, B) to the partial signature verification entity 12. .

The invention therefore also relates to:

a computer program comprising instructions for the implementation of the steps of the partial signature derivation method as described above and implemented by the partial signature derivation entity when this program is executed by a processor of the device partial signature derivation,

- a readable recording medium on which is recorded the computer program described above.

An entity for verifying a partial signature, according to an example embodiment, will now be described in relation to FIG. 4.

The partial signature verification entity 12 is computer equipment, such as a computer.

The partial signature verification entity 12 comprises:

a processing unit or processor 40, or “CPU”, intended to load instructions into memory, to execute them, to carry out operations;

a set of memories, including a volatile memory 41, or “RAM” used to execute code instructions, store variables, etc., and a storage memory 42 of the “EEPROM” type. In particular, the storage memory 42 is arranged to store a partial signature verification software module which comprises code instructions for implementing the steps of the partial signature derivation method as described above and which are implemented by the entity 12 for verifying the signature. partial signature The storage memory 42 is also designed to store the public key Kp of the signature scheme.

The partial signature verification entity 11 also includes:

a reception module 43, designed to receive the subset of messages and the partial signature (q, s, A, B) of the partial signature derivation entity 11. The receiving module 43 is designed to implement step E15 of receiving the partial signature derivation method as described above,

a first verification module 44, designed to verify a first equation involving the messages of the subset of messages, the elements of the signature of the set of messages as well as the first verification element and elements of the public key. The first verification module 44 is arranged to implement step E1 6 of verifying a first equation of the partial signature derivation method as described above, and

a second verification module 45, arranged to verify a second equation involving the first element of verification of the partial signature, the second element of verification of the partial signature, and elements of the public key. The second verification module 45 is designed to implement step E117 for verifying a second equation of the partial signature derivation method as described above.

The reception module 43, the first verification module 44 and the second verification module 45 are preferably software modules comprising software instructions for implementing the steps of the partial signature derivation method described above and implemented by the partial signature verification entity 12.

The invention therefore also relates to:

a computer program comprising instructions for implementing the steps of the partial signature derivation method as described above and which are implemented by the entity 12 for verifying a partial signature when this program is executed by a processor of the partial signature verification device,

a partial signature derivation entity 11 as described above, and an entity 12 for verifying a partial signature as described above.

Claims

1. Method of deriving a partial signature for a subset (I) of a set of messages ({m_l, ..., m_n}), called a subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said method, implemented by a partial signature derivation entity, comprising:

- reception (E12) of the set of messages ({m_l, ..., m_n}) and of a signature of said set of messages, said signature comprising signature elements ((q, s)) of the set messages,

- derivation (El 3) of a first verification element (A) calculated from the messages of the set other than those of the subset of messages, and

- derivation (El 4) of a second verification element (B) intended to prove that the first verification element is well formed, and sending to a verification entity (12) a partial signature specific to the sub- set of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element (A) and the second verification element (B), said partial signature being intended to be verified with only the messages of the message subset.

2. A method of deriving a partial signature according to claim 1 wherein the generation of the partial signature comprises an anonymization of the partial signature, said anonymization comprising:

3. Method for deriving a partial signature according to one of the preceding claims comprising beforehand a generation of a secret key and of an associated public key in a bilinear environment, said environment designating a first group G1, a second group. G2 and a third group GT of first order p, as well as a bilinear map e, taking as input an element of the first group Gl, an element of the second group G2 and with values in the third group GT, that is to say g, respectively h, an element of the first group Gl, respectively of the second group G2, said generation comprising:

- generation by the signing entity of (n + 1) random scalars (x, y_l, y_n), said random scalars forming the secret key of the signing entity, and

4. Method of deriving a partial signature according to one of the preceding claims, in which the signature of the set {1, ..., n} of messages, denoted m_l, ..., m_n, comprises the selection by the signatory entity of a random element q of the second group G2, and the computation of s = q ^Λ {x + y_l. m_l + ... + y_n. m_n}, said signature then being (q, s).

5. Method for deriving a partial signature according to one of the preceding claims, in which the derivation of the partial signature for the subset (I) of the set {1, ..., n} of messages comprises:

- generation of the first verification element A = Π _ {j in {1, ..., n} \ I}. Y_j ^Λ {m_j}, and

- generation of the second verification element B = Π_ {i in I, j in {1, ..., n} \ 1}. Z_ {i, j} ^Λ {m_j}, the partial signature then being (q, s, A, B).

6. Method of deriving a partial signature according to one of the preceding claims 1 to 4, in which the signature of the set of messages comprises:

- selection (El 8) by the signatory entity of two scalars r and t,

- calculation of q '= q ^Λ r,

- calculation of de s' = s ^Λ r. q ^Λ {r. t},

- generation (E 13) of the first verification element A = g ^Λ t. Π_ {j in {1, ..., n} \ 1} Y_j ^Λ {m_j}, and - generation (El 4) of the second verification element B = (Π_ {i in I} Y_i) ^Λ t. Π_ {i in I, j in (1, .. n} \ Z_ {i, j} ^Λ {m_j}, the partial signature then being (q 's', A, B).

7. Method of verifying a partial signature for a subset (I) of a set of messages ({m_l, m_n}), called a subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said method, implemented by a partial signature verification entity, comprising:

- reception (El 5) of the subset of messages and of a partial signature ((q, s, A, B), (q ', s', A, B)) specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages ((q, s), (q ', s')), a first verification element (A) calculated from messages from the set other than those from the message subset and a second verification element (B) intended to prove that the first element is well formed,

- verification (El 6) of a first equation involving the messages of the subset of messages, the elements of the signature of the set of messages as well as the first element of verification and elements of the public key, and

- Verification (El 7) of a second equation involving the first signature verification element, the second signature verification element and elements of the public key.

8. A method of verifying a partial signature according to claim 7, in which a secret key and an associated public key have been generated for a signing entity in a bilinear environment, said environment designating a first group G1, a second group G2 and a third group GT of first order p, as well as a bilinear map e, taking as input an element of the first group Gl, an element of the second group G2 and with values in the third group GT, that is to say g, respectively h, a element of the first group G1, respectively of the second group G2, said generation comprising: - generation by the signing entity of (n + 1) random scalars (x, y_l, y_n), and

- calculation by the signatory entity of X = g ^Λ {x}, Y_i = g ^Λ {y_i} for 1 ≤ i = j ≤n, Z_ {i, j} = g ^Λ {y_i. y_j} for 1 ≤ i ≠ j ≤ n, and H_i = h ^Λ {y_i} for 1 ≤ i ≤ n, the elements X, Y_i, Z_ {i, j} and H_i forming the public key, verification of the signature partial including:

- verification (El 6) of a first equation: e (X. A. Π_ {i in 1} Y_i ^Λ {m_i}, q) = e (g, s), and

- verification (E17) of a second equation: e (A, Π_ {i in 1} El i) = e (B, h).

9. Entity (11) for deriving a partial signature intended to derive a partial signature for a subset (I) of a set ({1, ..., n}) of messages ({m_l, .. ., m_n}), said subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said partial signature derivation entity, comprising:

- reception means (33), arranged to receive all the messages ({m_l, ..., m_n}) and a signature ((q, s)) of said set of messages, said signature of all of the messages comprising signature elements of the message set, and

- means (34) for deriving a first element, arranged to derive a first verification element (A) calculated from the messages of the set other than those of the subset of messages, and

- means (35) for deriving a second element and sending, arranged to derive a second verification element (B) intended to prove that the first verification element is well formed, and to send to a verification entity a partial signature a partial signature specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, the first verification element and the second element verification, the partial signature being intended to be verified with only the messages of the subset of messages.

10. Entity (12) for checking a partial signature, intended to check a partial signature for a subset (I) of a set of messages ({m_l, ..., m_n}), called a subset of messages, said partial signature being intended to prove the validity of a signature of the set of messages for the messages of the subset of messages, said partial signature verification entity, comprising:

- reception means (43), arranged to receive the subset of messages and a partial signature ((q, s, A, B)) specific to the subset of messages, said partial signature comprising a constant number of elements comprising at least the elements of the signature of the set of messages, a first verification element (A) calculated from the messages of the set other than those of the subset of messages and a second verification element (B ) intended to prove that the first verification element is well formed,

- first verification means (44), arranged to verify a first equation involving the messages of the subset of messages, the elements of the signature of the set of messages as well as the first verification element, and elements of the public key, and

- second verification means (45), arranged to verify a second equation involving the first verification element, the second verification element and elements of the public key.

11. Partial signature derivation and verification system comprising:

- a partial signature generation entity according to claim 9,

- an entity for verifying a partial signature according to claim 10.

12. Use of a partial signature and verification derivation system according to claim 11 in an anonymous accreditation system.

13. Computer program on a data medium and loadable into the memory of a computer, comprising program code instructions intended to control the execution of the steps of the method of deriving a partial signature. according to one of claims 1 to 6, when the program is executed on said computer.

14. Data medium in which the program according to claim 13 is recorded.

15. Computer program on a data medium and loadable into the memory of a computer, comprising program code instructions intended to control the execution of the steps of the partial signature verification method according to one of claims 7. or 8, when the program is executed on said computer.

16. Data medium in which the program according to claim 15 is recorded.